0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.57
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20200226 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200226 | 2013.8.14.323 |
| McAfee | PWSZbot-FPJ | 20200226 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0c35d | 20200226 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意
(50 out of 63 个事件)
| ALYac | Trojan.Zbot.IDF |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Zbot.IDF |
| AhnLab-V3 | Spyware/Win32.Zbot.R95040 |
| Antiy-AVL | Trojan[Downloader]/Win32.Agent |
| Arcabit | Trojan.Zbot.IDF |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | HEUR/AGEN.1026734 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Zbot.IDF |
| BitDefenderTheta | Gen:NN.ZexaF.34090.bqY@aeqtucbi |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDownloader.Upatre.A4 |
| CMC | Trojan-Downloader.Win32.Agent!O |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.Spy.Zbot.XGXB@56ryk0 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.65e2de |
| Cylance | Unsafe |
| Cyren | W32/Trojan.GHQD-5341 |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Zbot.IDF (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.HDG |
| F-Secure | Heuristic.HEUR/AGEN.1026734 |
| FireEye | Generic.mg.6792f7b65e2de27f |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.Zbot.IDF |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Agent.emoc |
| K7AntiVirus | Trojan ( 0050357f1 ) |
| K7GW | Trojan ( 0050357f1 ) |
| Kaspersky | Trojan-Downloader.Win32.Agent.hdxl |
| Lionic | Trojan.Win32.Agent.tqYS |
| MAX | malware (ai score=83) |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | PWSZbot-FPJ |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.mt |
| MicroWorld-eScan | Trojan.Zbot.IDF |
| Microsoft | PWS:Win32/Zbot.MS!MTB |
| NANO-Antivirus | Trojan.Win32.Agent.csovle |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM02.0.7FEF.Malware.Gen |
| Rising | Downloader.Waski!8.184 (TFE:dGZlOgWUSjSScTwwDQ) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Upatre |
| Sangfor | Malware |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-01-14 16:36:49
PE Imphash
08906af48dc1e3914c84968df6f6f693
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0000114c | 0x00001200 | 6.734950006751952 |
| .rdata | 0x00003000 | 0x00000554 | 0x00000600 | 5.215507317611741 |
| .data | 0x00004000 | 0x00000190 | 0x00000200 | 3.765396815972499 |
| .rsrc | 0x00005000 | 0x00002678 | 0x00002800 | 3.4747903294789246 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00005238 | 0x00002428 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00007660 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000050f0 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x403060 ReleaseDC
• 0x403064 GetDC
• 0x403068 RegisterClassExW
• 0x40306c CreateWindowExW
• 0x403070 GetMessageW
• 0x403074 TranslateMessage
• 0x403078 DispatchMessageW
• 0x40307c SendMessageW
• 0x403080 DefWindowProcW
• 0x403084 PostQuitMessage
• 0x403088 DrawTextExW
Library KERNEL32.dll:
• 0x403000 HeapAlloc
• 0x403004 GetStartupInfoA
• 0x403008 GetProcessHeap
• 0x40300c GetModuleHandleA
• 0x403010 lstrlenW
• 0x403014 HeapFree
• 0x403018 CreateFileW
• 0x40301c ReadFile
• 0x403020 lstrcpyW
Library MSVCRT.dll:
• 0x403028 __p__acmdln
• 0x40302c _controlfp
• 0x403030 _except_handler3
• 0x403034 __set_app_type
• 0x403038 __p__fmode
• 0x40303c __p__commode
• 0x403040 _adjust_fdiv
• 0x403044 __setusermatherr
• 0x403048 _initterm
• 0x40304c _exit
• 0x403050 _XcptFilter
• 0x403054 exit
• 0x403058 __getmainargs
L!This program cannot be run in DOS mode.
qHy'q&
qHy%q!
qHy#q&
qHy$q&
qRich'
`.rdata
@.data
}}[} @
[[ @[@}
[@[@[}
@[ }
} @}
[}@ }}@[@ [[}[
@ [}
@ [[} @@ @
@@@}[@
}}}[} @}
[[@[@
[[[[@
[ }[[@
t(=t0@
MQ3PPPUR
@ }}@ @@
[uSAVWAf9
GGEGGEM;r
@[[ }[UV3W}
FG3@_^]
}[ [ @[}
t}C}^}o
3NZ0cW
zPCQ&JM}6
d3uF&FP
gFnP=C[
2ZRfs8J>
mVvP=C[}&
.|ZpP @L*/
[Ig51NN
gFnP5AZ
C5:g3GM
ZfG,Q8/w
_zlA&A[>-
|CME:}[
zVvd1]G
m]gA1[q
[]fg%Z[
C5/zzlS
N_g5'G[
m_GM7ZJ*A(/
p.X]Tw9
}C+[bHM
WiPT/>z
'9+1<>}@-Z
z~"]C}
PQ/>?(8
p1</<}K
('+}[>}
PS/>?(8
1j}C}Sbl>]
vvuj-KN/8
YTcWyhC}/
6!zc(s
^32ij+8
GP{ -\*[
{(-F}{'Qxw6!
u|0)!%[VF
s[D>]Gb
-[.}'q_
k8vT]P/>c(|[U
y}C1f'k>]aaT
}C '1>
PmQ7ZN
&S#zX,P1/
5m3vP
>}Va]7@SR.
>j^-B"
IuX[_[+S
@}[@ @}}
FUjhP2@
QUREPMQ
<"u>"u
fFu%P0@
>)V,_M23_G
A5C!2_8
)D ^G:"^`@B
""A-)Y
VF+TP
2I\P4!/
YO"]JK?
86a)J"T
BUW,L+7L
\OE@Z",3
DrawTextExW
ReleaseDC
RegisterClassExW
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
DefWindowProcW
PostQuitMessage
USER32.dll
lstrcpyW
ReadFile
CreateFileW
HeapFree
lstrlenW
GetModuleHandleA
GetProcessHeap
HeapAlloc
KERNEL32.dll
_XcptFilter
__p__acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetStartupInfoA
).7)/8[
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>(
@@<@@@@@@@@@@@@@@@@@DDDDDDDDDDDD
ddddddddddddddddddddd`
ddddddtttddddddddddddllllll`
llldddddd`
tttttttttdddddd\
ddddddddddddlllllllll\
dddddddddddddddddd\
\dL\P|X
l o n e s o m e
n o n m e t a l
p i l i n g
C : \ U s e r s \ B a b a \ A p p D a t a \ L o c a l \ T e m p \ R a r $ E X 0 0 . 4 2 6 \ V o i c e M e s s a g e . e x e
C : \ 8 5 f b 8 1 d 7 a 6 0 d 5 0 a 9 7 d e c 9 a a f f 5 9 8 a 1 e 6 f a 0 e 0 c 4 c 7 3 c 0 5 2 6 1 d 9 8 2 1 5 e 1 e 6 8 8 e 3 1 b
C : \ 3 c 3 7 8 0 d c b e c a f 0 8 3 3 2 e 2 2 4 0 6 3 1 a b 9 7 d 4 8 6 4 e 5 8 0 4 8 f 1 3 a e 8 9 a d 0 b 6 f 0 c 0 0 7 3 0 6 f 7
C : \ V G D O F H _ 8 . e x e
C : \ 7 F Z L W N 2 g . e x e
C : \ 7 9 7 d B w l P . e x e
C : \ I b 0 P 1 l a B . e x e
C : \ y Y V Z v 0 I S . e x e
C : \ C 4 8 D J q S M . e x e
C : \ X o o o n 1 i Q . e x e
C : \ n c j A i o 2 I . e x e
C : \ b l m T k 9 w U . e x e
C : \ t l O J u d q e . e x e
C : \ 9 a 8 5 b e d 0 d 4 b 5 4 1 e 8 a 6 f 6 2 8 9 4 b 9 e 1 3 d d 7 0 2 e 3 6 4 e e 4 2 3 4 f b b d b 5 8 3 8 4 a e f 3 7 f b 6 7 b
C : \ Q p O 3 4 s y 8 . e x e
C : \ l Q w d Q S o H . e x e
C : \ n E m e z c W C . e x e
C : \ f 0 4 e b 5 6 f c 5 a f 5 f f 8 2 8 8 a 6 3 8 3 6 e 5 d d 3 e b 9 8 1 e 9 9 c b b c 5 a 0 4 6 e a d e d f c 2 b d 1 3 d d a b 8
C : \ 1 8 c 3 d 0 7 c 2 d a 7 b f f b b d c b 6 9 f b a 4 f 8 e 9 9 e 6 3 1 a d 7 7 f 6 4 7 a 7 e 4 2 4 5 3 4 0 3 9 1 7 f 6 0 5 3 9 1
C : \ o z C s n 1 w a . e x e
C : \ p i 0 x 5 V J e . e x e
C : \ Y L 5 e k a t h . e x e
C : \ i n 7 p g J Y P . e x e
C : \ 8 6 W z o e i Z . e x e
C : \ Y 4 c Y P p h O . e x e
C : \ w U L j I m C v . e x e
C : \ 8 D W J m n X f . e x e
C : \ I 8 U Q K N w E . e x e
C : \ y 8 G l 7 L p 0 . e x e
C : \ j 7 _ 7 U 0 1 l . e x e
C : \ p n K s D E R P . e x e
C : \ A Y W 9 9 f n V . e x e
C : \ s F Z X D M W S . e x e
C : \ K m F f T t i J . e x e
C : \ 0 W O r R u b L . e x e
C : \ k o J V m C m j . e x e
C : \ 0 X u c M n T g . e x e
C : \ H y k r j b a k . e x e
C : \ 3 M P S G Q D E . e x e
C : \ E g u R d _ x z . e x e
C : \ _ M X P u h A D . e x e
C : \ u 5 w F 3 J Y D . e x e
C : \ n F E Q p w z A . e x e
C : \ K O F B H a 8 F . e x e
C : \ e s 2 b X c 7 X . e x e
C : \ U S 8 u u n r 1 . e x e
C : \ r 7 T v x t o 4 . e x e
C : \ x Z F H U z W d . e x e
C : \ R V c U Q _ t M . e x e
C : \ Y o 6 X i g K x . e x e
C : \ T 7 D x v D 8 A . e x e
C : \ M H w u _ S k 7 . e x e
C : \ D K O S n S a D . e x e
C : \ A 2 y L s i _ C . e x e
C : \ U C W j 2 l S p . e x e
C : \ T R U X h A G q . e x e
C : \ s p n H 6 d N t . e x e
C : \ 7 1 Q L O y x i . e x e
C : \ 1 l r O A i 2 K . e x e
C : \ A D X Z h R f D . e x e
C : \ F a 8 7 T z 7 Z . e x e
C : \ v J O 9 h 6 2 b . e x e
C : \ _ H P K h j E y . e x e
C : \ Z j H H 6 h T k . e x e
C : \ a a b 2 i V H D . e x e
C : \ N W w 6 Z C D h . e x e
C : \ 2 7 b j N F X X . e x e
C : \ S Y K u D S J f . e x e
C : \ w X 4 Q C 0 w v . e x e
C : \ g L u p b m V Z . e x e
C : \ 9 g Q U d y 9 7 . e x e
C : \ e k i V c X F e . e x e
C : \ 3 d 2 2 2 3 9 f 9 7 1 a 8 5 4 b 3 9 8 2 c f d 8 4 8 c 0 c 6 e 0 2 f 0 f 1 7 7 3 5 9 1 5 5 a 1 6 3 4 4 f 3 6 1 8 7 6 6 6 e a e 9
C : \ a 2 0 2 3 4 3 e 0 0 e e 7 2 2 e 0 5 c 1 b 1 a 7 c f d 9 3 9 3 8 2 0 c 6 c 7 b 1 e 5 c d 5 d 1 1 4 0 3 d 8 7 7 1 2 a e 9 9 0 8 e
C : \ 1 5 5 1 5 c 3 1 b d 3 6 7 9 1 e 4 b 5 0 6 2 1 a 1 0 f b 2 3 f e a a a f 1 8 f a 4 5 a f 0 b e 3 f 8 c 8 d 0 1 9 1 6 d a 9 b 9 9
c : \ m a p p _ s t a r t _ f o l d e r \ s n o w b a l l . e x e
C : \ 9 8 8 6 1 f 4 2 c 9 c 7 b 2 c c b 8 0 7 4 2 f 7 e 4 2 f c c c e 8 9 8 8 b 4 a 9 2 a 9 6 5 1 6 6 c 2 6 4 8 2 6 6 9 4 2 5 4 2 d b
C : \ a g B C S U h p . e x e
C : \ r M V s P 5 3 J . e x e
C : \ O 8 f m N H X b . e x e
C : \ J T X S Q j I U . e x e
C : \ Q 9 4 W H q i q . e x e
C : \ H r x j F G P R . e x e
C : \ s g O 0 6 N 8 _ . e x e
C : \ 2 7 7 8 5 e 3 a c f d e 7 7 2 9 a 2 c 9 8 f 7 6 3 d e 6 3 4 1 d 3 a 1 c c 8 a 3 5 e 4 f d 1 7 f 7 c b 5 5 3 d 0 6 3 a 6 3 6 9 a
C : \ b e 6 c 1 6 8 1 9 d 5 b 8 9 c 4 b d a 1 8 b 7 2 b 0 1 4 d 5 9 4 4 2 6 4 4 4 a 6 6 1 5 9 d 2 f 1 7 c d a 0 a 9 2 0 3 d b 5 f e 3
C : \ d 6 7 1 4 5 3 b 7 3 f 0 b b f b 8 b 7 5 5 c 1 b d 9 f f a 5 d 8 a d 4 6 c f b a 8 2 1 8 f d 9 1 6 e f 7 6 8 9 e 7 4 f f 7 0 a 3
c : \ 5 q u n 2 t \ t g w 6 7 d . e x e
C : \ f 6 a 3 1 0 4 d 5 e 0 1 0 4 0 7 3 7 b 8 5 6 a 4 a d a b a a c 9 7 b f 4 3 1 c 6 1 7 5 4 7 0 a 6 1 5 7 f e 8 b 9 2 b a 6 5 c a 5
c : \ h t n 7 l 5 \ 2 p g 6 l 9 . e x e
C : \ a c 3 2 2 d 0 2 1 7 1 7 1 d 3 9 a 3 8 9 f e 7 4 d f 7 3 f d 5 e 0 d e d 4 2 3 7 c 3 0 e 6 e c 4 4 a d f e 8 3 7 2 5 a d 1 0 c 5
C : \ 8 5 5 6 2 3 7 5 . e x e
C : \ 8 5 5 7 8 4 1 1 . e x e
C : \ 0 c 9 a 9 a d 1 b b 2 e 7 a 9 0 d 9 2 c 0 b 5 1 3 7 d 5 1 9 8 e e d 7 0 5 f 4 1 f 1 e 8 c 9 5 6 a e 4 6 b 0 6 3 c e 9 9 d 0 8 2
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ i Y 0 i q v x d g 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 1 2 a 8 d 3 e 8 f 4 d 8 a 7 1 d 9 8 7 e c 9 9 5 8 3 8 2 4 d 2 . v i r u s . e x e
C : \ 5 2 d f c e 1 0 2 7 a c 1 c 8 6 9 5 c 1 c 5 3 a 2 5 5 9 d e 7 d c 5 2 6 d 3 a 7 f 8 e 9 9 0 4 8 2 d c e d b d f 5 e 2 d a 4 4 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ b a 8 d 6 8 7 4 4 9 5 9 b b 2 2 a 0 3 2 9 c 9 9 5 7 9 5 b d 4 5 b 2 4 e b 0 4 1 7 0 7 d e 0 d b 7 3 c 7 0 d 7 9 8 a 6 9 8 b 1 1
C : \ 5 4 7 2 9 4 6 6 9 e c 2 3 5 6 8 7 6 e 3 0 3 0 e d 1 3 6 a 9 4 f 9 a 6 b f 8 9 0 4 2 e a 9 8 5 d a 8 e f 6 4 9 f c 3 b 1 0 b 0 3
C : \ 2 1 e a 8 3 7 6 9 d 8 e 5 4 c 6 5 9 0 b 9 5 c c a a 6 b b c f e a 0 b 6 5 d c a 1 f 3 1 b e 6 2 5 f 0 d 1 c 7 7 8 9 6 c 5 7 c c
C : \ 0 6 6 0 0 6 f 7 1 7 2 9 2 e e 9 1 f 9 3 3 8 4 d 6 d 2 0 2 8 3 6 b 6 5 e 2 1 4 e 6 8 e e 8 e 1 6 6 c 8 5 a d 1 b 8 0 5 c 1 d 4 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ 7 a 0 a 6 e c c 8 e a 6 6 d 8 d 8 9 7 9 d 8 5 2 9 9 8 6 c a 4 c d 4 b 7 1 7 5 0 e 8 9 5 7 9 8 4 5 f 1 b 0 2 a 1 c 8 8 0 b b 5 c
C : \ e 0 e 5 a b 2 0 0 b 8 2 b 3 a 8 7 7 5 5 9 9 d c 7 f 9 e 6 9 2 2 6 c e 4 d 4 8 1 3 3 0 f 1 5 b 8 d e 9 e 6 3 9 1 9 9 f 1 e 8 5 d
C : \ 8 b 1 f b 9 4 1 c 3 1 3 2 0 4 5 2 6 7 c f e 8 8 a c 1 4 2 c a f 4 a 2 3 e 9 0 5 b f 0 f 8 f f a b 2 9 6 e 9 c 8 e f c 9 9 2 9 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ 3 1 2 d 6 0 9 8 2 2 a 9 d c 5 1 0 b 0 c 1 4 6 2 d 1 d 7 a f 6 8 d 7 a 0 7 1 4 7 5 8 a 4 9 e f 5 5 0 2 3 4 f 0 4 2 b 3 d d d 6 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ 5 7 0 b 1 f 7 5 c 5 9 9 f 3 4 8 1 0 4 3 5 4 7 8 e 9 2 2 0 3 8 1 0 7 5 0 8 c 0 a 6 e b d a 0 b 5 c 5 1 d 4 b f 3 8 d 3 3 e 4 2 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ a 3 1 4 5 0 9 e 0 b e a 9 9 3 c d 1 1 f 8 a 7 b 0 0 3 1 9 a 8 b 6 a b 5 1 8 c 1 c 5 5 4 8 b d a 6 c d 2 f c b a 8 d 2 0 0 d 1 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ e 0 d 7 9 7 e e 3 8 a 1 9 6 8 2 7 2 9 1 4 f 0 f 2 7 1 a 3 8 c 4 7 4 c 3 9 b b 3 7 1 b a b a 7 b 5 7 6 5 a 2 7 6 b 6 6 e b d 3 4
C : \ 7 7 2 6 d a 8 5 6 b 3 7 4 d e 1 1 d d a a c e 3 4 e 7 0 c 0 4 a 3 0 1 a 0 2 4 8 2 f 1 9 3 3 2 a 9 9 0 6 2 9 b 9 3 8 c 4 7 e 8 0
C : \ b c c e e 7 2 2 0 7 8 3 f e f 6 1 5 d 8 1 8 8 d 2 1 a 8 0 3 d 1 5 7 0 8 f e b 6 6 f 3 c 3 1 f 3 1 9 3 e 0 8 4 8 b 2 d c e 4 0 3
C : \ 1 8 b 9 6 0 8 3 8 a 1 b 9 5 f 2 8 0 0 6 9 b 6 6 a a b 2 b 8 e 4 9 b 6 5 2 4 5 0 f a 4 c 6 5 5 8 8 e 9 8 c 5 b 7 b 2 3 9 9 9 9 c
C : \ 1 b d 9 f 4 b 4 7 3 0 9 3 2 5 b f 7 6 a 0 8 e 2 8 7 d 9 2 6 5 6 4 7 8 e 4 7 d 8 5 6 0 b 2 c 3 5 c 4 c 7 9 8 0 8 8 5 5 5 f f 2 2
C : \ 2 2 f b f 5 c 8 2 1 5 9 c 6 5 3 7 9 b 1 6 d 1 4 b 7 d 0 0 6 5 8 b 2 e c 9 5 d 3 9 2 8 3 b 8 f 1 a 8 1 7 7 c 6 7 0 1 2 9 1 2 5 0
C : \ U s e r s \ J a s o n \ A p p D a t a \ L o c a l \ T e m p \ d o _ n o t _ d e l e t e _ 0 9 2 3 0 3 c e 2 7 1 7 4 0 5 4 5 c b 4 b b 1 e 0 a b 7 4 7 1 0 6 b f 3 7 2 2 c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d t t c o d e x g i g a s . 4 9 3 0 a 4 2 4 4 4 d a f 7 7 f 2 b 1 a c 1 e f 3 c 3 a 8 0 5 c 8 f c a 3 6 4 9 . e x e
C : \ 7 a 1 6 2 b b 4 3 a 7 0 2 3 1 5 5 3 3 5 5 2 0 b 3 9 9 9 3 3 e 9 e c 6 7 9 a f 5 7 6 2 2 d 9 5 2 0 4 d f 4 8 0 9 2 0 2 2 3 e e e
C : \ 7 8 5 6 b a e f 7 e 1 1 9 1 d 6 0 0 2 6 b c 0 b c b 8 0 f 5 c 8 c b b 2 a 0 d 5 9 9 0 0 6 e 8 b 6 1 9 0 1 5 7 1 c c 0 a 6 a 1 a
C : \ e e 3 3 d e f 3 5 5 5 9 c 4 5 d 6 1 4 a d b 3 5 8 c b 1 9 9 d b f 1 3 3 b 1 2 4 b 5 b 6 b 2 9 2 c d 2 d 0 6 8 9 0 5 e 0 2 7 6 1
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.