1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.67
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20200422 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200423 | 2013.8.14.323 |
| McAfee | Downloader-FGQ!5E2F0CEEB885 | 20200423 | 6.0.6.653 |
| Tencent | Trojan.Win32.Bublik.burh | 20200423 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00000efc', 'size_of_data': '0x00001000', 'entropy': 6.867463969308896} | entropy | 6.867463969308896 | description | 发现高熵的节 | |||||||||
| entropy | 0.23529411764705882 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Upatre.Gen.3 |
| AhnLab-V3 | Trojan/Win32.Bublik.C243177 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Upatre.Gen.3 |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Upatre.Gen.3 |
| BitDefenderTheta | Gen:NN.ZexaF.34106.bqY@aOUkIyni |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDownloader.Upatre.A4 |
| CMC | Trojan.Win32.Bublik!O |
| ClamAV | Win.Trojan.Downloader-62779 |
| Comodo | TrojWare.Win32.Spy.Zbot.XGXB@56ryk0 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.eb885f |
| Cylance | Unsafe |
| Cyren | W32/A-e8a0dbfc!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Upatre.Gen.3 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/A-e8a0dbfc!Eldorado |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.5e2f0ceeb885f71c |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.Upatre.Gen.3 |
| Ikarus | Trojan-Spy.Zbot |
| Invincea | heuristic |
| Jiangmin | Trojan/Bublik.gsj |
| K7AntiVirus | Trojan-Downloader ( 0048f6391 ) |
| K7GW | Trojan-Downloader ( 0048f6391 ) |
| Kaspersky | Trojan.Win32.Bublik.burd |
| MAX | malware (ai score=86) |
| Malwarebytes | Spyware.Zbot |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FGQ!5E2F0CEEB885 |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.nm |
| MicroWorld-eScan | Trojan.Upatre.Gen.3 |
| Microsoft | PWS:Win32/Zbot.MS!MTB |
| NANO-Antivirus | Trojan.Win32.DownLoad3.csplaw |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM02.0.C09D.Malware.Gen |
| Rising | Spyware.Zbot!8.16B (RDMK:cmRtazo76TcFSaHX7iXQjZk+Mg0n) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/DwnLdr-LHL |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-01-16 16:59:27
PE Imphash
c626dccf7fb6f72d572fabe34daf0ccc
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000efc | 0x00001000 | 6.867463969308896 |
| .rdata | 0x00002000 | 0x00000944 | 0x00000a00 | 5.312126111158428 |
| .data | 0x00003000 | 0x00000430 | 0x00000200 | 4.010685037734623 |
| .rsrc | 0x00004000 | 0x00002678 | 0x00002800 | 4.774966130968202 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00004238 | 0x00002428 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00006660 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000040f0 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x502070 ModifyMenuA
• 0x502074 RemoveMenu
• 0x502078 EndDialog
• 0x50207c SetWindowTextA
• 0x502080 SetScrollInfo
• 0x502084 CheckMenuItem
• 0x502088 ReleaseDC
• 0x50208c GetDC
• 0x502090 MoveWindow
• 0x502094 GetClientRect
• 0x502098 EnableMenuItem
• 0x50209c GetMenuItemID
• 0x5020a0 DeferWindowPos
• 0x5020a4 EndDeferWindowPos
• 0x5020a8 TranslateAcceleratorA
• 0x5020ac SetMenuItemInfoA
• 0x5020b0 LoadStringA
• 0x5020b4 InsertMenuItemA
• 0x5020b8 GetPropA
• 0x5020bc RemovePropA
• 0x5020c0 SetPropA
• 0x5020c4 ScrollWindow
• 0x5020c8 CreateCursor
• 0x5020cc DestroyCursor
• 0x5020d0 GetSubMenu
• 0x5020d4 BeginDeferWindowPos
• 0x5020d8 DestroyAcceleratorTable
• 0x5020dc ShowCursor
• 0x5020e0 RegisterWindowMessageA
• 0x5020e4 AppendMenuA
• 0x5020e8 DragDetect
• 0x5020ec GetCapture
• 0x5020f0 CreateDialogIndirectParamA
• 0x5020f4 ReleaseCapture
• 0x5020f8 FindWindowA
• 0x5020fc CreateAcceleratorTableA
• 0x502100 CharUpperA
• 0x502104 DrawTextExA
• 0x502108 DialogBoxParamA
• 0x50210c DrawEdge
Library KERNEL32.dll:
• 0x502000 GetStartupInfoA
• 0x502004 MultiByteToWideChar
• 0x502008 lstrlen
• 0x50200c MapViewOfFile
• 0x502010 UnmapViewOfFile
• 0x502014 lstrlenA
• 0x502018 CloseHandle
• 0x50201c GetModuleHandleA
• 0x502020 GetProcAddress
• 0x502024 CreateDirectoryA
Library MSVCRT.dll:
• 0x50202c _exit
• 0x502030 _controlfp
• 0x502034 _XcptFilter
• 0x502038 exit
• 0x50203c __p__acmdln
• 0x502040 __getmainargs
• 0x502044 _initterm
• 0x502048 __setusermatherr
• 0x50204c _adjust_fdiv
• 0x502050 __p__commode
• 0x502054 __p__fmode
• 0x502058 __set_app_type
• 0x50205c _except_handler3
L!This program cannot be run in DOS mode.
qHy'q&
qHy%q!
qHy#q&
qHy$q&
qRich'
`.rdata
@.data
uP uP uu
uPuP PU
Pu PuP
PPuP u
w^uuPuP
P PuuP
P PPuu
PP uu uPPu
PP PP u P
[uSAVWAf9
GGEGGEM;r
uPuuP u
FG3@_^]
uuuP P uPu
};7A1P]
-P6t)K
:OCtj8E2qm',L0
;W-tn.)
w%;R0FS
;PCej(\;kNw
j ;Oquvyz6~
>"VUpuY+
*7V6E)
AAj%\aC
u)^nJs
HPw~#C{,
TO'4#v#>diL
vVL|6`
Vq^#@{ry)^cEA/Q
GHDI vU *h
&VafO-+
FJX}+5
,yASlvV6Ay
A>0K'vCJD,QTPF=XKL
X;k]3PtjR
#fdHtqw\#KJda,
jWnV2KC{
Ci/u+!i
,2sH ^
}/2qQZlnW
O vudS
<T!z)^CL
M|N~lf=
ll}T-nq`+6
5JfO{J7:'Ds
\SL76#C
A>0K! C8
})^+]kS
)>5$oK"#C\
fMiyF.|x
6]^B/rn
M- )NqSmi
)m#w&\w
@L8~PP
Puuuuu
IuX[_[+S
u uu uPuP uuP
FUjh(#P
QUREPMQ
<"u>"u
fFu%4 P
^0x[A-F0-9a-f]{1,8}$
0x8732ffda
!K;3`C
!KJ/W*`UE/UP;
C7(&&G:&:
1.+%W8=
4ZPUJ55D
N]8;`8
T([!%Q;YI0
A[G7VM
L'>1GX\[
F' ]+O
DrawEdge
DrawTextExA
CharUpperA
CreateAcceleratorTableA
FindWindowA
ReleaseCapture
CreateDialogIndirectParamA
GetCapture
DragDetect
AppendMenuA
RegisterWindowMessageA
ShowCursor
DestroyCursor
CreateCursor
ScrollWindow
SetPropA
RemovePropA
GetPropA
InsertMenuItemA
LoadStringA
SetMenuItemInfoA
TranslateAcceleratorA
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
EnableMenuItem
CheckMenuItem
DestroyAcceleratorTable
GetSubMenu
GetMenuItemID
ModifyMenuA
RemoveMenu
EndDialog
SetWindowTextA
SetScrollInfo
DialogBoxParamA
ReleaseDC
MoveWindow
GetClientRect
USER32.dll
CreateDirectoryA
MultiByteToWideChar
lstrlen
MapViewOfFile
UnmapViewOfFile
lstrlenA
CloseHandle
GetModuleHandleA
GetProcAddress
KERNEL32.dll
CoUninitialize
CoInitialize
CoCreateInstanceEx
ole32.dll
OLEAUT32.dll
_XcptFilter
__p__acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetStartupInfoA
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>(
KKMM""
uuDD--
117722
}}^^mm
@I'6*(******************++""
!!##**********************::v
@DZ5Lar|||
'@WmAYG_
_p\\\n
`s]]]m
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \
\ f a x . p d f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ i s a r c \
\ w i n u p d a t e . e x e
C : \ Z 5 u u P 8 J D . e x e
C : \ 2 L o e k Z X y . e x e
C : \ F j V g g 3 P 4 . e x e
C : \ j A i 0 y m t m . e x e
C : \ 6 5 1 0 5 0 a 5 d 6 a 1 0 f 5 2 a 3 9 1 4 7 0 c 8 a 8 1 a f f 2 b 6 9 7 7 f 7 6 b 0 4 2 4 0 f b 3 3 2 b 9 a a 1 4 0 4 2 6 2 e a
C : \ b 0 5 d 4 6 a 3 d a 2 9 e 7 6 1 b e b e 1 a 2 a 7 9 0 4 7 7 6 3 a 6 1 f b 8 d a 5 2 b 7 1 9 7 7 a f 7 0 e a b 7 4 a 7 e 6 b a b
C : \ c 7 e d 9 6 6 1 8 1 b 0 c 7 8 3 b f b 4 f c a e a c 9 9 2 f 9 a e 9 c 0 3 0 d 4 d f d 7 e 3 1 b 2 e d 0 c 1 b 1 7 0 c f 6 3 1 e
C : \ 9 f c 8 b f e e 9 b f c 3 a 7 9 e 5 d 6 7 5 7 6 e e d 0 9 5 2 b 9 f e 3 e 1 9 1 f 1 7 8 3 c 9 6 4 5 f 2 2 9 f 3 1 e 4 4 0 9 c 5
C : \ h D _ g S x b y . e x e
C : \ n 0 m v h A B H . e x e
C : \ 7 C Q c p x L 5 . e x e
C : \ U m R I h D O P . e x e
C : \ j q J 6 h b 3 C . e x e
C : \ E J m D S A U 5 . e x e
C : \ d p O u 1 R F s . e x e
C : \ g s 9 I F e T R . e x e
C : \ K m b 0 z A e 9 . e x e
C : \ B T h v l o x E . e x e
C : \ S u w t g j 5 m . e x e
C : \ 6 0 b 3 8 3 3 6 2 1 e f b 1 c f d e 6 2 a b c 4 5 1 b e a e 7 7 b 5 4 c 4 e 0 b 5 d 0 0 1 0 4 2 3 0 2 7 b 2 e 3 9 7 8 4 f e 4 9
C : \ 4 2 b 7 7 d 0 e 9 8 4 0 8 6 c e a 1 1 6 e 2 9 f 9 c e b f 9 e 3 9 4 9 5 3 9 a f 2 d b a e 4 c 7 e d 5 7 5 3 b 3 4 e 1 e 7 1 3 4
C : \ _ p i 6 3 y v z . e x e
C : \ A F y K f v D q . e x e
C : \ 2 A g X M N g n . e x e
C : \ M T B 6 c k p U . e x e
C : \ 0 c E E v z A Z . e x e
C : \ P I c D a k A T . e x e
C : \ L Q i w b 9 e _ . e x e
C : \ f r 8 7 d S p X . e x e
C : \ 4 Y 2 b L i N c . e x e
C : \ k h C E 3 H R 9 . e x e
C : \ 7 Y p T w o C H . e x e
C : \ 3 J M L L c E g . e x e
C : \ 3 c d 5 9 b b 3 b 6 9 2 c f 8 6 d d d d c 1 d 3 9 b 0 f 3 1 4 7 8 4 c 9 2 7 d 6 5 a b f 4 5 f 8 4 e b 9 1 9 0 a 6 2 d a e b c a
C : \ y s d S m H i e . e x e
C : \ A D _ B E y i j . e x e
C : \ Y u i M K V M Q . e x e
C : \ e 9 c 7 a 8 0 7 2 f 0 7 9 e 7 9 4 1 e b f 0 8 6 f 3 7 0 8 0 c 5 e f 7 3 2 4 b 4 a 6 c a e 5 2 7 2 a b 1 f f 7 c 9 1 8 2 3 f e 9
C : \ L D Z w c 7 6 Y . e x e
C : \ x W u T A 9 Y C . e x e
C : \ y I t S I Z I l . e x e
C : \ 2 A A r k Z F k . e x e
C : \ A a M b S G D Q . e x e
C : \ c 1 6 F K J H G . e x e
C : \ e Y s _ E m n 1 . e x e
C : \ 9 l S 5 4 m j t . e x e
C : \ i H w U g C y j . e x e
C : \ d r W g F V v _ . e x e
C : \ z 0 c J V v z o . e x e
C : \ F W V 3 a A m m . e x e
C : \ c R 5 N r l F 0 . e x e
C : \ E 8 C r W e B z . e x e
C : \ b n b 3 O p 4 a . e x e
C : \ f B 0 P 2 m Z U . e x e
C : \ 7 I 6 _ 1 w O 5 . e x e
C : \ K r m t p N p O . e x e
C : \ 8 6 V q t J w 8 . e x e
C : \ W z 0 b _ d p t . e x e
C : \ z R e b A L T I . e x e
C : \ 4 u Q j w c U i . e x e
C : \ 0 j H d T 6 8 R . e x e
C : \ 3 l C 5 a P 0 R . e x e
C : \ k j n u D g T 7 . e x e
C : \ w z t f U q e i . e x e
C : \ 2 8 Q W 9 2 l v . e x e
C : \ w G b p S e f U . e x e
C : \ k a 7 n L 8 d U . e x e
C : \ l G U j B t a j . e x e
C : \ 4 W 3 p i 9 L l . e x e
C : \ w j q B a L y I . e x e
C : \ D V V 1 b E D X . e x e
C : \ k U f Z c N S T . e x e
C : \ c d d 1 c 3 2 5 8 d c 7 3 6 a 3 c e 7 2 5 5 c 8 4 5 4 c 3 9 e 7 b 3 1 3 0 b 2 1 d 3 0 7 7 1 f 0 1 6 e 4 0 7 1 0 7 2 0 3 e e 2 1
C : \ 0 o f 9 b d r F . e x e
C : \ Z D r 4 x H S g . e x e
C : \ k 7 O P V 8 K H . e x e
C : \ S I p f 6 e g k . e x e
C : \ G X B Y b J R 8 . e x e
C : \ X P 5 j j B M 4 . e x e
C : \ n 8 o W _ E f O . e x e
C : \ L s L x t E P P . e x e
C : \ n C 0 F _ 8 Q g . e x e
C : \ Z j q 0 I 2 w L . e x e
C : \ N O m u r 1 8 t . e x e
C : \ 7 8 9 c 5 7 e 0 3 0 6 0 5 1 2 c 3 2 e b 6 e 6 c 3 e 0 4 f c b f 4 2 7 b d 5 1 f 1 a 4 5 b c f b 4 6 c 9 4 1 a 8 9 c b a 7 4 7 e
C : \ F b i M 4 R B H . e x e
C : \ u f q o l y r W . e x e
C : \ 9 f 8 2 7 e d 7 6 3 0 2 2 2 a 6 0 b a d 9 9 f c 3 e 8 f e 3 f 2 5 2 0 b 8 1 2 2 1 0 a 6 5 0 c 2 9 0 f 8 d c d 6 d 1 6 7 c 0 4 8
C : \ c 5 5 8 6 2 3 2 5 d d f 8 a f a 1 5 5 8 e e 0 1 3 1 d d f 3 2 d b 4 b 8 4 3 2 f 1 6 b 7 1 3 e 7 f f f 9 0 0 5 0 3 f 9 5 9 8 f 7
C : \ d a f 3 b 9 2 0 9 9 7 9 9 4 9 9 d 4 b c 8 7 1 e 8 d 9 2 8 4 a a d 5 3 4 f 3 4 2 5 2 2 1 4 d d f 1 a f f 6 2 e f 8 9 4 2 e 3 3 0
C : \ f 0 1 9 7 e 7 8 a d c b c 1 6 d 4 d 3 9 9 6 5 8 f 8 8 e 6 5 7 9 a e f a a 4 0 3 e 7 8 5 3 5 f 2 2 f 4 9 b e b c 7 4 4 7 6 2 a 3
C : \ c Y 2 W T 2 X W . e x e
C : \ A U a n O h M S . e x e
C : \ y 3 7 1 v O 4 3 . e x e
C : \ Q u 9 k 0 f K x . e x e
C : \ A T L l u j d x . e x e
C : \ t Q F P 8 H y n . e x e
C : \ J L p G b T h 1 . e x e
C : \ S J _ m D m U V . e x e
C : \ x s R S Z 0 T x . e x e
C : \ 7 d M F 4 _ s j . e x e
C : \ y g d 4 i 1 \ g j a z b 3 . e x e
C : \ g b O 2 j j u 0 . e x e
C : \ 6 0 3 9 6 7 6 4 7 5 8 3 e 8 0 2 4 4 8 e 4 7 2 3 b 7 a e c 3 e 3 f 9 4 2 7 6 2 c 0 5 8 d 6 e 7 f 5 8 6 1 9 2 3 7 f c 8 7 2 1 c 6
C : \ f 1 e b c 9 9 4 f 4 0 4 b 1 f b 0 d 9 a 5 f 3 7 a 5 d f b 3 3 1 3 e b 9 f d 0 7 b 0 a 6 4 c 9 1 5 c 6 4 6 6 1 5 3 2 f 2 7 a b 2
C : \ 3 5 6 d b 5 5 4 5 b d c 4 2 a f c 5 2 4 7 1 a f c 8 7 6 8 d 9 a 9 7 9 2 3 4 6 8 b d 9 2 c 8 d f 4 8 8 1 d e 7 f 9 c c 4 7 8 a c
c : \ w o r k \ 2 2 4 9 2 2 4 \ 6 c b 0 9 a 0 a 4 d 9 f 9 f 4 d e 1 a 3 4 6 9 f 0 c c f 2 9 7 f . e x e
C : \ f 7 2 d 7 6 c f c e d a e 9 7 c 1 b e 2 5 9 3 e 8 b 7 c 4 9 7 4 6 0 d 6 5 e b 9 9 0 d e 2 9 8 3 2 c b d 9 7 4 0 d 8 1 5 a d c b
C : \ 7 f 0 7 d 1 0 3 e 5 d 9 3 d 5 d c 8 0 a a f f c 8 3 3 3 2 0 b 0 2 f 2 4 3 a 6 2 7 9 3 7 e 3 c 9 1 8 e 2 5 b e 7 7 f 6 8 5 4 b 6
C : \ 2 b b c a b 1 2 9 a e 6 a a 3 b 0 8 b 7 0 c 5 1 5 e 4 7 b e d c 1 2 8 6 5 5 4 6 0 2 e d 8 3 1 4 0 1 9 5 8 2 a 5 a f 4 2 6 5 9 e
C : \ 0 e 4 f 4 0 0 a e d 8 1 2 b f 5 b 1 a d 3 b 7 2 d 9 9 c 1 b a 8 d f 1 1 6 0 c 1 e 7 f f 0 e a b 3 6 1 1 9 9 6 9 3 9 3 4 6 e 6 4
C : \ M B 9 s c t k O . e x e
C : \ 3 3 d e f b 7 7 7 1 7 e 3 c d a 3 0 4 3 1 6 0 3 3 d c a 5 e 6 7 d 9 3 0 a 0 2 8 e d a 2 6 7 4 6 7 2 3 d 6 2 9 e 1 c 6 6 0 3 6 5
C : \ b 0 1 3 7 c 5 5 c d f 1 9 0 5 7 2 5 2 2 3 8 e 1 6 5 9 4 e 9 8 7 c 8 8 d c a d 2 6 0 b 0 b a c e 2 1 e e 3 3 0 1 b 7 2 4 0 a 1 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ H t U B N n r E j . e x e
C : \ 8 4 b b 0 0 e 4 9 7 7 3 c 8 7 d e 3 5 4 5 d 4 9 a 5 3 1 9 a 3 2 4 a f 2 0 3 8 1 8 4 5 7 6 f c b f 2 1 b b b a f b 7 6 5 4 a 7 2
C : \ b b e f 9 f 2 f 2 b a 4 0 e a 4 d 3 7 2 1 a a a a e 1 2 b c 9 6 a d d 5 2 b e 8 6 4 3 2 4 a 6 c 0 d 5 a c f 8 4 2 b 5 2 c e c c
C : \ e 5 4 8 9 a 0 c c b 0 0 8 7 9 a 3 e b 7 2 0 1 d 9 5 d 8 1 2 d 5 5 3 a a b 1 5 8 b c c c c 1 0 8 3 2 0 e 8 4 b e 6 f 3 2 7 8 2 b
C : \ 3 2 8 9 f f c 1 2 7 d b 6 8 0 4 4 3 6 8 8 5 5 1 8 b 3 9 6 9 3 8 5 a b 4 d 7 4 e 5 5 f e 7 4 e 8 a 2 e c 5 3 4 2 b 8 5 b 8 3 b c
C : \ U s e r s \ J o h n \ A p p D a t a \ L o c a l \ T e m p \ j o Y j c w E o a b e B . e x e
C : \ 1 7 3 d d e b 6 3 e 9 d d 5 8 a 7 1 1 c 2 d a b f 3 3 5 9 0 f 6 1 9 0 f 4 a e c 2 d c 4 c 6 0 8 8 a 4 d f b 2 6 0 f 5 5 7 6 f e
C : \ 4 f 5 5 a c 0 a 0 5 0 3 3 4 f d 4 a f 8 7 9 d 5 a 3 f 0 e b 1 c 2 4 f f 4 9 b 5 4 e 9 8 d f b a d 7 0 8 e 1 d 5 f 2 2 6 0 8 c d
C : \ 6 7 a 5 5 a 3 4 5 1 a 8 c b 7 5 8 c 0 6 2 a 0 3 5 9 f 3 1 1 3 6 c b 6 d e d b 9 7 8 7 9 5 e d 7 7 3 7 0 d 7 4 8 d 5 e b 4 9 9 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w i n u p d a t e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c e 0 9 a d f 4 7 a a 0 c c 8 b _ w i n u p d a t e . e x e
C : \ 9 f a 1 f 0 c 7 5 6 2 b 2 8 7 a 2 2 5 2 e 2 e 4 b f d 9 6 e 4 9 3 d 4 7 c a d 6 7 5 6 1 5 a d e c b 1 6 5 8 3 a 7 4 4 e c b 7 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ 7 3 3 9 d 6 e 9 f f 1 e a 8 9 a 7 6 4 4 1 2 5 7 7 8 e e 4 c b 0 a 2 3 d 3 4 6 6 1 b 1 d 3 3 5 d 6 a 3 0 4 c 9 0 0 c 3 c f a 9 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w i n u p d a t e . p e 3 2
C : \ e 3 7 b 6 5 1 e 0 9 6 6 e b 1 d 1 e d 4 a f 1 4 d 5 0 e f 8 5 7 0 e 2 7 f f c 6 e 7 b d 0 d e 3 9 7 a c 6 2 f 7 1 a b 8 2 b a 1
C : \ d c 8 c 8 b 8 6 2 d c c b a 7 7 a 6 0 a a 2 f d 9 3 4 5 3 9 5 5 1 b b f e 2 5 b c 9 0 c a e c 1 5 e c d 5 4 5 c 5 2 b f 9 e a 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ d 2 e 9 8 d 3 e b 7 f 3 4 6 4 0 9 5 4 0 5 1 b e 9 8 2 3 6 2 0 e 4 a d 4 7 4 d 9 7 b b e f c 7 e 5 8 a 2 b f 4 7 3 d 5 6 f 2 1 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ 6 e 2 d b 7 2 e 2 6 b 0 0 d f 6 b d 5 f b e b 5 8 b c a d c b 7 1 b 6 1 5 b e 6 e 8 7 5 3 a 7 0 d 0 0 2 3 5 7 3 e 6 8 e 0 a f 5
C : \ e 2 7 9 c e 2 4 8 9 4 a 5 0 2 2 e b e 1 f 1 a 3 f 2 f 9 d f 4 7 a 6 b c 8 0 6 c a 3 7 f f 9 6 e 3 b d 8 5 e c d 7 4 f 7 e 2 8 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ 2 0 a 4 0 3 a 2 b 8 2 6 4 6 e 6 d 2 1 a 2 8 d 2 8 2 a 9 5 8 9 b c 2 a 6 d 7 5 d 9 f b 2 0 f c 6 6 b 4 3 a 3 1 2 3 5 6 3 a e f 1
c : \ t a s k \ 4 7 0 7 E A 7 0 9 2 2 3 B A C 1 6 8 6 3 F E 3 F 0 6 E 0 9 6 C 4 . e x e
c : \ t a s k \ 3 D E 4 F 0 D F 7 2 D D C B B 0 1 0 C 7 A 6 2 A B 9 9 C D E C 0 . e x e
c : \ t a s k \ 9 0 F C E D A 0 C 0 4 E E 8 B 3 D 0 4 1 F A F E 5 9 9 0 9 3 7 6 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e b 8 8 7 c f 9 f 0 5 e 6 b 4 9 b 3 a 6 . p e 3 2
C : \ 4 7 1 e 5 9 0 a 1 c f e a 6 e e c 1 6 d 0 a e 2 f 6 7 5 a 7 8 8 0 a 1 d b 3 3 0 e e e 6 2 f d b 1 f 3 a a 4 d f c 2 9 4 7 6 a 5
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 2 1 d f 7 3 8 9 f f 7 8 c d 0 c b 3 d 4 b 2 6 8 a b 6 a 7 3 f 0 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ 5 8 0 9 9 d b 4 d 9 5 8 0 0 2 8 e c e 1 f 9 e 7 8 a 0 a e 8 a c 8 9 a f c 3 e a 1 c 8 4 f a a 9 8 3 9 e 4 3 f 2 8 4 d 9 6 1 a 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w i n u p d a t e . p e 3 2
C : \ c 4 2 1 7 1 4 b e 5 a f 3 5 f b a c e 7 1 0 9 f 1 6 3 b a 6 0 f 0 1 6 8 a 3 b b 3 6 6 4 9 7 3 6 2 a 6 8 c f b 9 7 8 6 f 8 9 3 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ 6 0 1 7 d 5 8 f 0 8 e b e 2 7 8 f e 1 4 0 a f 2 2 0 f 3 e 2 5 a b 0 7 a 0 4 e 5 1 2 3 d 1 1 b 5 8 5 b 9 2 2 0 5 e a f 8 c e 1 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ 7 c a 4 d a 8 7 1 f 4 2 0 1 5 f 0 4 4 a c 7 4 a c d 5 7 9 1 4 a 2 f 4 8 3 0 6 a 1 d 9 d 2 b 0 2 6 0 a e c b 5 c 3 5 a 2 0 0 3 b
C : \ 6 a a 9 6 a d 8 1 9 c 8 a 7 3 7 b d 9 9 5 3 0 1 e 2 b 4 5 7 0 e e 9 7 7 4 0 8 d 7 2 f 2 4 0 1 f 1 7 c 2 c 0 8 4 2 c b 5 5 1 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ d f 1 5 5 2 6 b 4 e 9 b d b 2 0 d f 3 c b f d a 2 9 b c 8 c 8 a f b 2 6 1 5 2 d 9 e c f b 4 4 3 3 3 4 c 1 d b 7 9 6 e 8 3 e 9 e
C : \ 4 2 b 7 f d c 4 a 9 0 3 b 1 2 0 3 0 a 0 5 7 f b 2 0 2 5 5 c 5 7 2 6 7 6 5 2 8 5 2 0 c 3 6 7 f 1 0 a d d 2 6 d 3 c b b 3 f 5 e 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 f 7 6 4 a 9 5 c 6 3 a 7 c 5 a 0 5 5 6 1 f f 3 b 3 d 3 6 e 9 0 4 5 9 a 2 9 a 9 4 0 c 4 d 5 7 a 8 b f b c 5 d d 4 d 3 8 9 7 4 8 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 c e f b 5 4 4 c e e 2 a 8 0 6 7 2 6 5 0 0 8 d 8 0 d 6 2 a c 9 e d 1 b 1 3 f e 8 5 8 2 6 0 e 1 0 e e 2 0 d 5 9 c 8 a 0 f 7 6 f . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 8 f 3 c 7 e 4 c 3 d 5 3 c 1 2 1 e 4 3 9 b e c 7 f 7 4 3 4 4 f a c 4 5 4 f 3 1 b d a 1 5 4 a f 4 2 c 8 6 d 4 b 4 7 3 5 8 5 b b . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 4 9 4 2 d 2 0 5 e 2 d 0 7 4 d 6 6 7 4 3 e 4 8 9 9 7 9 0 8 2 4 2 c c c a f 0 9 6 d d e 4 7 5 6 c 0 e 0 4 b 7 1 e 5 a c 0 f b 5 . e x e
C : \ 7 d 6 6 e 6 f 1 8 b 6 7 5 d f 6 e 9 7 f 2 e 0 a a 7 9 e a 7 1 3 c 6 9 6 8 0 d f b c 5 1 f a 3 0 0 c b e 5 e 0 6 1 f 4 b 3 e d f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 f c e e b f 6 e 1 6 0 9 5 b 0 a 5 a b 9 6 4 c 6 8 3 6 e 0 3 7 a 8 6 d 6 5 7 a a a b 5 4 8 b 7 e 8 9 a c 8 8 c f 2 e e c 2 1 8 . e x e
C : \ 8 a 4 0 8 a 7 b 0 c 0 c 6 d 0 3 d c b 6 0 d b 5 a 0 d d 1 2 9 b 9 8 2 d 8 f 8 a 3 2 9 b 5 6 f d 8 0 7 e f c e 8 c c 2 6 e 6 a 6
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.