2.8
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.71
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-ASIE [Trj] | 20191220 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Kryptik.mp | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191220 | 2013.8.14.323 |
| McAfee | Cutwail-FDGO!67C95153ED3F | 20191220 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b078a8 | 20191220 | 1.0.0.1 |
静态指标
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545315.421125 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545315.93775 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | .code |
| section | .data2 |
动态指标
提取了一个或多个潜在有趣的缓冲区，这些缓冲区通常包含注入的代码、配置数据等。
分配可读-可写-可执行内存（通常用于自解压）
(6 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(3 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00000b71', 'size_of_data': '0x00000c00', 'entropy': 7.01283901867524} | entropy | 7.01283901867524 | description | 发现高熵的节 | |||||||||
| section | {'name': '.data', 'virtual_address': '0x00003000', 'virtual_size': '0x0000076d', 'size_of_data': '0x00000800', 'entropy': 6.977289520012138} | entropy | 6.977289520012138 | description | 发现高熵的节 | |||||||||
| entropy | 0.24390243902439024 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
一个或多个缓冲区包含嵌入的PE文件
(1 个事件)
| buffer | Buffer with sha1: f8cbd004ecf7b671fe3e4e9f65ac38d383084a82 |
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意
(50 out of 63 个事件)
| ALYac | Trojan.GenericKD.1408738 |
| APEX | Malicious |
| AVG | Win32:Agent-ASIE [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1408738 |
| AhnLab-V3 | Trojan/Win32.Zbot.R88085 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Generic.D157EE2 |
| Avast | Win32:Agent-ASIE [Trj] |
| Avira | TR/Yarwi.AD.5 |
| Baidu | Win32.Trojan.Kryptik.mp |
| BitDefender | Trojan.GenericKD.1408738 |
| BitDefenderTheta | Gen:NN.ZexaF.33556.ey3@aqofndp |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDownloader.Upatre.A6 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.Kryptik.BOZ@546pmn |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.3ed3f6 |
| Cylance | Unsafe |
| Cyren | W32/Trojan.HEYR-7073 |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.GenericKD.1408738 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.GNM |
| F-Secure | Trojan.TR/Yarwi.AD.5 |
| FireEye | Generic.mg.67c95153ed3f649e |
| Fortinet | W32/Small.AAB!tr.dldr |
| GData | Trojan.GenericKD.1408738 |
| Ikarus | Trojan.Win32.Badur |
| Invincea | heuristic |
| Jiangmin | Trojan/Bublik.ggf |
| K7AntiVirus | Trojan-Downloader ( 0040f6bd1 ) |
| K7GW | Trojan ( 004ebb4c1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=80) |
| Malwarebytes | Trojan.Dropper |
| McAfee | Cutwail-FDGO!67C95153ED3F |
| McAfee-GW-Edition | BehavesLike.Win32.Cutwail.km |
| MicroWorld-eScan | Trojan.GenericKD.1408738 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.Bublik.cqkilw |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM19.1.0173.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Dropper |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-AEUC |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2004-09-03 14:07:40
PE Imphash
39b2903b7498188e4955572bbeb0f3fe
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000b71 | 0x00000c00 | 7.01283901867524 |
| .code | 0x00002000 | 0x0000004b | 0x00000200 | 0.9732653088455998 |
| .data | 0x00003000 | 0x0000076d | 0x00000800 | 6.977289520012138 |
| .data2 | 0x00004000 | 0x00001028 | 0x00001200 | 4.049573972244926 |
| .idata | 0x00006000 | 0x00000570 | 0x00000600 | 4.048733903394875 |
| .rsrc | 0x00007000 | 0x0000229c | 0x00002400 | 3.889150628673532 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00007130 | 0x00001ca8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00008dd8 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00008dec | 0x0000031c | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x00009108 | 0x00000193 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library user32.dll:
• 0x40618c GetMessageA
• 0x406190 DefWindowProcA
• 0x406194 PostQuitMessage
• 0x406198 GetDoubleClickTime
• 0x40619c UpdateWindow
• 0x4061a0 GetQueueStatus
• 0x4061a4 LoadIconA
• 0x4061a8 RegisterClassA
Library GDI32.dll:
• 0x406300 CreateBitmap
• 0x406304 IntersectClipRect
• 0x406308 ExcludeClipRect
• 0x40630c UpdateColors
• 0x406310 GetTextExtentPoint32A
• 0x406314 CreateCompatibleDC
• 0x406318 DeleteObject
• 0x40631c TextOutA
• 0x406320 SetBkColor
• 0x406324 SetTextColor
• 0x406328 Rectangle
• 0x40632c CreateSolidBrush
• 0x406330 GetStockObject
• 0x406334 CreateFontIndirectA
• 0x406338 GetTextExtentExPointA
• 0x40633c GetTextMetricsA
• 0x406340 CreateFontA
• 0x406344 RealizePalette
Library ADVAPI32.dll:
• 0x406250 RegQueryValueExA
• 0x406254 RegOpenKeyA
• 0x406258 GetUserNameA
• 0x40625c CopySid
• 0x406260 GetLengthSid
Library IMM32.dll:
• 0x4064a0 ImmGetCompositionStringW
• 0x4064a4 ImmSetCompositionFontA
• 0x4064a8 ImmGetContext
• 0x4064ac ImmSetCompositionWindow
Library kernel32.dll:
• 0x4060f0 GetModuleHandleA
• 0x4060f4 GetProcAddress
• 0x4060f8 HeapCreate
• 0x4060fc HeapAlloc
• 0x406100 ExitProcess
• 0x406104 FreeLibrary
L!This program cannot be run in DOS mode.
`.data
.data2
.idata
M-1M-5
:YGHPOOY
^\_`!N
oHVc~n
`EoCYN~b^K
sziB8E
w1xw^4
~Yb5DV
P|Zj\d
gwAq4T
PL;Hna'
V@YV75
.tZp@7
CreateWindowExA
play e:\\rrrtwr\agef.wav alias PRFT
LoadLibraryExA
user32.dll
LoadCursorA
Winmm.dll
TranslateMessage
mciSendStringA
_GEV7i
u=np30
a'JLRCV
XYDc;\
@GR'7^
X@#9 (
9U`e)
>c5q7!
k187/[
0000000000
0000~00000000000>0000
0G00I0300I0
000000q0000G0
000000
0I0000I0
000000
00G00A000000000
0G00I0300I0;00I0
0000H00F00G00y0000000$0A000300A000A000
03000000
0G00A000
000000(00000
000C0~0200G0
00 0I0
0000 0v0000000
0G00A0000
0000000
0000000
0000000
000000A000000
000#00
000000
000,00
000#00
000*00
000"00
000*00
000*00
0000G00(00(00
0#000G0
00A000A000000
000'00
000000
000200
000300
000 00
000*00
000000
000-00
000200
000#00
000!00
000200
0000K000
00300000
000A000a0
0#000A000000
000'00
000000
000200
000300
000 00
000*00
000*00
000*00
000-00
000!00
0000K000
00300000
000A000a0
0#00000
0G00A0000
0000000
0000000
0000000
000000A000000,00
000200
000"00
000*00
000*00
000"00
000*00
000*00
0000G00(00(00
0#000G0
00A000000
000200
000*00
000#00
000!00
000-00
000+00
000.00
000000
000#00
000100
000100
000300
000$00
000$00
000#00
000000
0000K000
00300000
0030003000300030003000
000300000 0000000
0G00A000I0
0000000
0000000
0000000
0000000
0000000
0000000
0000000
0000000
0000000
000000N0G0
0000000
0000M0
000p00000M0
000p00000M0
000p00000M0
000p00000M0
000p00000M0
0000000(00&000000300(0000
0#000C0~030000000G0
0000000300I0
00q0000
00K0000000
0003000300
00W0000I0
00K00~00000
0003000300
0090000I0
00K00>00000
0003000300
0000I0
00K00:00000
0003000300
000000M0
0003000300030003000300030000000(00&000000300(0000
0#000G0
0003000300030003000K000000000C0~0200
00300030000000200G00I0
0000A0~00A0~00I000000000
0G00?000000
0000C0~0G0
0(00&000000300(0000
0#000C0~030000I0
00 0000C0~0G0
000000M0
000.00M0
00030003000300000000030000000C0~0200 0I0
000000 0v000000000
0G00?000000
0000A0~00A0~00K00
0A0~00I0000G0
00K0300w00000n00F00
0300I0
00K0300G00w000000d0200
0030000000C0~0200A00000 0v000000000 0v000000000
0G00?000000
00I0000
00G00(00(00
0#000C0~00B0=0000G0
00I000
0000I0
0000I00C0~020
0G000000>03000
00300000
0C0~0200I0
0000G00A0
0000?00000>0G00
00300000
0C0~0200I0
0000G00A0
000b0 0v000000000 0v000000000
0G00?000000
00$0I00I0
0000A0000~0$0I0
00G0C00000A000G0S00000I0S00000K0
0x000000000G0
00v00000I0S00000000
0000G0
00I0;00I0300I0
000b0I0K00000I0
0003000300
000000C0~0200A000
0300 0I0
000000 0v000000000
00I08000;00I03000000I0
000b0I0
00 0v000000000 00~00000
0G00A000
00$0I00$00
0300I0
0000I000
000300G0
00 0I0
000000 00~00000
0G00A000
00$0I00$00
0300I0
0000I000
000300?00^0000G0
00 0I0
000000 00~00000
0G00A0000
000000I0
0000I0
00"0_00000G0
00"0_00000I000I000A0~00I00G0
0A00000
00300030000000K0
003000000
0G00A000
00I00I0300G0
00A0000~0$000$0
0$0g000300A00000$00000
00000A00000 00000
user32.dll
GDI32.dll
Msacm32.dll
ADVAPI32.dll
IMM32.dll
kernel32.dll
GetModuleHandleA
GetProcAddress
HeapCreate
HeapAlloc
ExitProcess
FreeLibrary
GetMessageA
DefWindowProcA
PostQuitMessage
GetDoubleClickTime
UpdateWindow
GetQueueStatus
LoadIconA
RegisterClassA
RegQueryValueExA
RegOpenKeyA
GetUserNameA
CopySid
GetLengthSid
CreateBitmap
IntersectClipRect
ExcludeClipRect
UpdateColors
GetTextExtentPoint32A
CreateCompatibleDC
DeleteObject
TextOutA
SetBkColor
SetTextColor
Rectangle
CreateSolidBrush
GetStockObject
CreateFontIndirectA
GetTextExtentExPointA
GetTextMetricsA
CreateFontA
RealizePalette
ImmGetCompositionStringW
ImmSetCompositionFontA
ImmGetContext
ImmSetCompositionWindow
acmDriverID
acmStreamOpen
H8( xp
H@0 P@
80PHxp
@8( h`
H@`Xh`
0(0((
0 @800
hXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXP`X`XXPXPXPXPHH
H@xp0
( ( ( ( ( (
( ( ( ( (
xxxxxxxxx
( ( ( ( ( (
0 ( ( ( 0
( 0 0 0 0 0 0
P@XH0 0 0 0 0 ( 0
( ( ( ( ( ( (
( ( ( ( ( ( 0(
0 0 0 0 0 0 0 (
H@`X`XH@
8(0 0 0 0 0 0(
0 0 0 0 0 0 0 0 8(H@PHH80 8(H@PH800 0 8(P@XHH80 0 0 0 0 0 8(
0 0 0 0 0 0 0 0 0 (
0 0 0 (
0 8(8(0 (
0 8(8(8(8(8(0 8(
8(H8H8H8H8H8H8H8@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0H8
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
3@@Pr9
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
E=>99:vt
[pxpxppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppxppppppppppppppppppppppppppppxpppppppppppppppppppppppppppppppppppppppppppppp
k111111
ppppppppp
ppppppppppppR
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNJNNNNN
}m/\:wK
pppppCpp
pxpppp`
07B78:tie
z11z1z11
|>>>>>>>>>>>
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 5
C o m m e n t s
C o m p a n y N a m e
F i l e D e s c r s i p t i o n
F i l e V e r s i o n
5 . 2 . 1 . 2
I n t e r n a l N a m e
g o . e x e
L e g a l C o p y r i g h t
C o p y r i g h t ( C ) 2 0 1 0
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
g o g . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
P r o d u c t V e r s i o n
5 . 2 . 1 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
C : \ U s e r s \ j k t a y u \ A p p D a t a \ L o c a l \ T e m p \ 7 z O A 2 F 5 . t m p \ 2 0 1 3 1 1 1 8 1 2 3 9 8 7 8 4 5 2 4 . e x e
C : \ v i r u s . e x e
C : \ _ j p t O T w b . e x e
C : \ O p O w J h z y . e x e
C : \ 0 2 G c g n 7 r . e x e
C : \ Y 1 O h x b y p . e x e
C : \ 0 0 1 D U P I B . e x e
C : \ 4 h v d S Z O I . e x e
C : \ S I D q p x p X . e x e
C : \ R D R y x y i d . e x e
C : \ 9 K z 3 J M g j . e x e
C : \ j U N r E J E H . e x e
C : \ z a 0 9 S 6 o l . e x e
C : \ X R g u S 7 I N . e x e
C : \ z r 8 8 d U E h . e x e
C : \ g n Y D X L 6 h . e x e
C : \ s Q m f w u m Z . e x e
C : \ 1 c H m K i n h . e x e
C : \ E _ 3 j k L q G . e x e
C : \ K X T R 8 c H U . e x e
C : \ V q a Y R Y K 3 . e x e
C : \ o d N B S U o g . e x e
C : \ q 4 Q 8 e Y 9 M . e x e
C : \ v 9 2 L t l A A . e x e
C : \ 7 y n K p J A C . e x e
C : \ 0 j 8 V U a J U . e x e
C : \ S J p H t 7 6 M . e x e
C : \ t O 0 D z 5 y i . e x e
C : \ 1 a 0 8 b 1 f 7 5 8 6 0 f e 5 d 2 c 3 a 5 9 5 6 d e b 0 a 5 0 d d b f b c 3 e 9 5 8 b f 8 7 9 f f 6 f 0 0 7 e 5 9 4 e 7 9 e f c
C : \ 0 1 9 8 f e 6 7 a c 2 e 7 a f 3 2 f 6 e 4 4 6 a 6 b e 2 2 5 d 9 5 c 5 0 e f 4 d d c b 7 f f 5 0 e 0 2 6 3 c 1 7 0 f 5 8 a f f 8
C : \ 2 a 5 b e a 4 5 2 4 6 7 a 8 a d 8 1 8 c e d 9 2 f 2 a 2 2 1 9 2 4 7 f 9 1 b 5 6 f c c 4 7 1 9 5 c e 1 9 2 0 a c f 5 5 0 7 6 e 8
C : \ 8 c d b 3 0 1 6 4 8 2 0 5 1 6 2 a a 7 2 9 5 2 3 c f a d 1 6 b 9 0 9 6 e 3 1 0 2 2 1 4 d e 7 c 7 5 2 4 5 b 3 6 d c 8 e 1 3 c 6 a
C : \ B a j g p L W 1 . e x e
C : \ i P m s X z T w . e x e
C : \ T d Z C 3 P s t . e x e
C : \ m s 2 R S e N T . e x e
C : \ M n H V b _ T D . e x e
C : \ D c O b s b r S . e x e
C : \ R t F N _ b a 6 . e x e
C : \ 0 0 e 5 Q o a 4 . e x e
C : \ F 0 z d M 9 s F . e x e
C : \ q 8 f c b R 8 y . e x e
C : \ I b D f C y T X . e x e
C : \ P a t t W h 7 o . e x e
C : \ M d c n x V r z . e x e
C : \ L W G E z _ S H . e x e
C : \ T z 9 G e n c z . e x e
C : \ d r Z 3 W 5 2 7 . e x e
C : \ 8 x i z 2 P n k . e x e
C : \ m x U d 1 a X 3 . e x e
C : \ f W V 2 Y 9 R q . e x e
C : \ o x t U c 2 M W . e x e
C : \ d 7 0 4 7 7 5 6 4 3 f b a b 1 c b a 4 e 8 1 d f 4 8 f a a b 3 4 9 8 4 3 e a a 1 f e 4 d 4 4 d 0 9 8 2 1 9 0 e d c 8 5 6 0 4 0 1
C : \ S H w w 5 u 1 R . e x e
C : \ Q 4 i m C p 9 l . e x e
C : \ n h 3 h L A C W . e x e
C : \ i J u 9 n K G v . e x e
C : \ a 7 W k 9 e e l . e x e
C : \ M h T 3 B k t 1 . e x e
C : \ m T U 5 s 3 L f . e x e
C : \ F F V L 2 B n 1 . e x e
C : \ y 6 T 6 m k U D . e x e
C : \ Q a 1 Y g j M V . e x e
C : \ C 4 A e Z w S b . e x e
C : \ q F j N g m p y . e x e
C : \ O M 2 e b 5 z p . e x e
C : \ A X w o 0 k A m . e x e
C : \ z S 6 f R 9 j D . e x e
C : \ b a N 9 k t A 2 . e x e
C : \ o U q o I 0 0 w . e x e
C : \ n 9 r y r t e m . e x e
C : \ E f _ d 7 h c K . e x e
C : \ m s 5 l F f B v . e x e
C : \ W i s 2 K R Q E . e x e
C : \ p C Y M L S C 5 . e x e
C : \ u m y B g l J j . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ G P 4 Z X C L 7 T . e x e
C : \ f 6 0 c f 8 3 1 b 4 0 2 0 b 1 b d 2 6 5 b 8 9 e d 5 3 1 0 c f 8 d 9 0 9 0 6 3 4 3 4 c e e c 4 7 a a c c 8 a c 7 3 2 e 6 7 f 4 e
C : \ Q p d P t a z Y . e x e
C : \ 1 m C c a r z G . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ 6 X l E j f h O I . e x e
C : \ X e g J u 9 G 5 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ m k 7 i v y H 3 2 . e x e
C : \ 3 a f 6 d 9 9 f c 4 d 4 e 3 4 5 b 6 8 2 c 9 2 d b 7 b 6 f 3 4 8 e a f e b 6 d f 9 0 8 f 6 c b 1 9 1 2 6 f e 9 b c 7 0 0 a 7 1 c
C : \ 2 3 8 4 8 f 4 5 4 8 2 a e d 3 2 5 1 7 6 5 8 a 1 3 9 c 3 5 e e 3 6 5 2 4 f 8 e 8 a f 5 0 e 3 d 6 f b c a a 0 3 2 4 9 8 9 f 4 9 2
C : \ 5 f 6 a b 0 e 6 4 c 3 8 a 7 d 3 f 6 c c 0 b 1 c 0 7 1 9 8 3 5 c a 7 e c 3 b 7 5 e 5 d f 3 4 3 7 3 1 2 6 4 1 3 5 5 8 5 0 a e b 9
C : \ 2 d 9 K D d T q . e x e
C : \ 2 O 9 _ y q j h . e x e
C : \ e h H m d 4 o f . e x e
C : \ e 9 C E X x X S . e x e
C : \ S v p 8 7 z p N . e x e
C : \ c f 9 8 1 b 7 3 4 0 9 d a 0 c 9 c 4 8 b 2 5 b b c a f 6 0 8 e d 4 c 8 8 d 2 d 1 4 7 9 b 5 6 7 4 1 8 f b 9 4 8 7 9 d 1 7 7 0 8 2
C : \ 9 8 5 1 2 c 0 0 e d d 1 b 5 6 6 5 5 9 4 1 4 2 d b d 2 9 e 7 f c 7 3 1 a a d 1 2 2 6 6 f a b 3 0 d f 6 a 3 b 9 9 1 a 9 4 9 2 d d
C : \ 4 a 4 3 6 f e b 0 6 b 9 f 3 6 a 2 e 4 7 a 8 2 4 f 2 8 8 4 9 8 5 0 3 4 b 6 6 e f 4 b 8 8 a 9 c 6 9 7 3 0 d b 9 d e 6 6 4 e f e e
C : \ 7 1 6 c 7 b c 4 a 9 a e f c f 2 9 b 5 6 0 6 7 9 2 4 f b a 6 2 8 e a a 4 9 3 7 2 d 4 7 a 8 7 0 1 6 b 5 6 0 1 e 7 6 8 f 1 9 e a 4
C : \ m l L f h 7 n a . e x e
C : \ 0 f B l L H s n . e x e
C : \ k V 6 z j G 4 6 . e x e
C : \ q 4 Q F F S n N . e x e
C : \ d B 3 f C f f 6 . e x e
C : \ N C Q Q d 5 Z X . e x e
C : \ X b 8 R p Z 8 _ . e x e
C : \ d n r j N D V 7 . e x e
C : \ E J v 9 Z P l e . e x e
C : \ c a b a 1 2 b 1 0 6 0 6 3 3 8 2 f 4 6 4 b d 0 b 2 3 5 5 1 0 2 8 6 d d d 3 2 9 4 8 a b 8 0 f 3 b e 5 3 9 9 1 0 4 3 9 b b 3 f 7 c
C : \ 0 8 4 8 b f 5 0 0 3 7 3 1 6 a 4 8 d 9 4 b 0 6 8 d 8 7 8 6 5 8 3 a 0 9 2 6 3 3 a 5 0 f f d 9 1 0 5 7 c a b 7 0 c e a 6 c 3 a 3 8
C : \ 7 e 7 d 8 f 9 0 2 e 9 a 9 2 7 1 4 3 1 e d 1 9 8 e 3 e 0 e 5 3 f a c f f 2 2 f 4 8 7 5 d 0 2 f 5 e 2 9 8 e b a 9 8 1 9 3 8 a 5 9
C : \ j Z Z l 0 b C a . e x e
C : \ K S i O r n e 1 . e x e
C : \ m n z Z V _ K l . e x e
C : \ X h U X p Q p _ . e x e
C : \ 5 B E X R 2 W D . e x e
C : \ _ o T w Z p H y . e x e
C : \ 9 n 5 y P K 5 8 . e x e
C : \ h x l o Q U F _ . e x e
C : \ a d c R f 8 0 9 . e x e
C : \ b x F 5 o o 2 b . e x e
C : \ y E I s h X X B . e x e
C : \ I c G d s B b 7 . e x e
C : \ B F W 4 M R s 2 . e x e
C : \ E 2 Z f T q 1 a . e x e
C : \ Z M z c z e O 1 . e x e
C : \ r f A m U F s z . e x e
C : \ X v T G n 7 t a . e x e
C : \ u 8 S g g Q c K . e x e
C : \ s j r N Z 0 C R . e x e
C : \ c 3 a 9 z 5 c H . e x e
C : \ P V Z L H m c p . e x e
C : \ d e U a b 8 f z . e x e
C : \ 6 5 P H _ J s 5 . e x e
C : \ U u Y S l d z l . e x e
C : \ k L F I u d 7 a . e x e
C : \ Q S R t n M O n . e x e
C : \ q u s A A F V h . e x e
C : \ m M F Z H I F U . e x e
C : \ z a f I X B G F . e x e
C : \ 3 e b l v E u 5 . e x e
C : \ M 6 X b Z j U N . e x e
C : \ T B d E 6 2 b 0 . e x e
C : \ c L W a 5 o z R . e x e
C : \ N D F T 2 k 2 Q . e x e
C : \ l Q t X D B g l . e x e
C : \ r 5 1 a p o m A . e x e
C : \ S 8 z c H 1 m M . e x e
C : \ _ g 7 _ e B 8 Y . e x e
C : \ _ 4 Q V A u J i . e x e
C : \ _ O 5 d 7 3 U 2 . e x e
C : \ 7 i Y b a 3 d C . e x e
C : \ K m 6 Q S Z I Q . e x e
C : \ h i U U W S I b . e x e
C : \ 8 U 0 E S N 5 7 . e x e
C : \ L 7 p 9 o l z S . e x e
C : \ 3 O T i E N J W . e x e
C : \ 9 Y S 1 N z E 0 . e x e
C : \ T B y V m J d j . e x e
C : \ b 1 6 5 a 9 0 0 8 e 2 e 6 b 6 d d 2 c 7 4 d a 6 2 e a 2 6 e 0 5 9 e a a 9 7 7 1 4 1 d 0 6 8 f 4 f d 5 5 5 3 8 f a e e 8 5 a 5 3
C : \ 2 c f 6 6 6 3 1 6 e 9 b 3 c f a 2 a 0 2 c b a c 3 b b 1 5 e 2 a b 3 8 6 7 1 7 b f 8 c e 5 0 9 4 2 9 3 0 8 6 3 3 3 d 1 4 f a a c
C : \ f 5 d f 1 1 2 4 2 4 9 5 d 6 1 f 6 d d e e 4 7 9 9 d b c 2 f 6 e e 1 3 0 1 1 b 6 e f 3 e 3 a d a 4 e 4 2 b 8 6 0 c 3 7 2 5 b a 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 8 b a d b 2 4 f 8 7 5 7 d b 6 c b 2 9 0 d 6 c 5 7 d 7 a 8 1 4 e 8 1 0 b 8 c 5 5 5 c d d a 4 3 8 2 4 e 1 1 a 1 4 3 9 b 6 a 4 b 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ f 8 5 2 2 5 4 0 5 d a 5 e f e 1 c 6 3 5 8 f 1 5 0 a c c 3 5 e 2 f 8 c 7 d 5 0 4 b b f 1 9 9 4 9 4 b 3 c 4 0 3 6 4 1 d 3 8 0 f d
C : \ 3 d 4 8 1 0 d 8 b c 0 3 f a 0 a a d b 6 3 8 3 5 4 d 2 e c 1 f 5 d 9 b 3 c 1 6 b 8 2 8 0 7 b b e 7 8 6 f c 4 c f 0 a 2 d 1 8 c d
C : \ U s e r s \ A d m i n i s t r a t o r \ A p p D a t a \ L o c a l \ T e m p \ C j p j r n . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 9 5 9 2 f 8 1 a 2 6 0 5 6 e c c a 6 9 1 e 6 f a 7 7 5 c 9 1 2 . v i r u s . e x e
C : \ 1 7 6 8 3 8 b f 8 c a 9 5 6 c 0 4 9 0 f 9 7 3 0 8 7 f 0 5 1 e a 3 d 7 0 c 1 a f a f 0 3 4 4 a d 3 3 6 f 4 a 2 5 6 3 6 b 1 6 b 9
C : \ d c a c a 3 9 0 1 7 5 9 1 3 d a a a b 5 5 1 3 8 f e e d d c 0 8 2 1 2 e 0 d 1 4 7 c 7 d d d e d a f 9 d 2 b 5 1 8 4 e 8 e b b 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ b c 3 2 1 0 b d 4 0 0 e 5 a 9 0 0 a 7 4 3 8 c a 0 a 6 0 d 7 1 2 8 7 d e a a b d d 8 b 8 3 0 e 8 d a 9 9 c 0 5 0 4 8 b a 7 7 8 1
C : \ 4 3 c 9 7 4 8 2 5 d 5 4 7 2 4 0 c 3 5 e 0 2 f 4 c 9 2 e f 5 c 0 0 f d 8 b 6 2 9 d 9 b 9 9 4 9 6 d b 5 7 e 7 9 2 8 b 1 8 7 0 f 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 9 e 0 f c 8 3 3 9 a 8 6 c 8 5 _ b u d h a . e x e
C : \ 9 7 a 2 2 9 0 b 6 0 4 6 4 b 5 b d e 9 f c 4 8 f 9 9 a b 6 2 9 0 c c f 2 a 1 a 3 5 3 8 7 3 2 7 9 7 3 e 7 9 7 0 8 e 8 c f 0 e 2 e
C : \ 3 5 f 1 7 f a 2 5 9 0 9 5 f 9 2 2 1 0 c 2 b 6 a 3 9 f 2 5 c 6 0 7 8 c 0 c 1 a 6 8 1 f 0 b 0 8 b d d a 7 b 8 f 6 8 e b b 3 7 5 a
C : \ b 7 9 c 6 b 7 4 a 8 1 5 6 8 d a 1 d 1 e c a 2 3 1 b 9 8 2 0 b a 6 3 5 7 0 0 2 f 8 b e d b 6 0 9 6 3 1 1 2 a d 5 b 9 a 7 3 a 2 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 7 3 e b 2 7 5 0 2 b 6 8 3 d 3 2 6 4 f a 7 6 0 a 6 3 7 a 1 3 b 0 c d f b 0 a 7 c 4 e 8 f d 3 f 4 9 e 6 2 f d 9 4 5 1 d e 6 b 2 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ c e 2 e 2 e 7 7 2 7 6 8 f 3 9 d 6 f 6 f 0 f 9 1 7 d 9 e 7 e e f f 7 e 7 f 3 c 2 b a 9 9 a 0 6 6 f e e e a 1 5 c c a 5 a 0 f b a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 4 7 3 8 5 e b c 2 d 4 4 0 6 d 5 0 7 1 c 9 9 6 d 8 7 4 a c 5 1 7 6 4 4 a 8 7 0 3 b 8 9 a 7 9 9 d 5 1 7 8 7 f b 8 7 1 7 1 2 8 e 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 8 c a c 9 0 0 a 1 9 0 7 0 4 0 4 9 4 9 4 e 3 3 b 2 a 7 b f 6 f 0 a 9 f 5 2 e 6 5 a 1 9 e c 4 f 1 2 9 9 d 4 1 a f 6 7 a f 6 f 3 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 8 e f c 0 e c a e 4 6 c 2 3 a a 3 b 3 b e c 5 f e 2 d c 7 1 d 4 d 3 1 7 4 0 d e 6 3 b a 5 a 5 a d f 1 e 2 6 2 7 c 8 9 4 b c d 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ c 9 5 c 6 2 3 b a 7 c 3 8 b 5 b 1 b 6 e 1 e a 1 b 9 1 7 c c a e d b 6 e 3 7 2 9 9 9 9 e 1 2 4 c 2 0 6 4 0 d d 8 2 5 6 9 7 b 4 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 5 e 5 2 3 7 6 2 3 3 8 a b 5 1 _ b u d h a . e x e
C : \ 9 b 7 2 b d c f 6 e a a 6 5 2 9 4 8 8 3 c a c 1 d b d 1 f 6 c 8 0 b c d 2 a 7 2 b 2 4 3 d 9 2 c 9 3 e 3 f 4 6 f 5 8 3 f a b d 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 6 1 2 0 6 f 2 2 f 4 4 3 3 2 d 3 1 8 6 a 4 d a 1 0 8 d b 8 c 3 f 0 e a 8 6 a 5 c b b f 1 5 4 9 e a 4 d 8 6 5 f 5 9 f 3 4 a 7 8 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 8 b 3 9 a 9 7 0 f 2 1 6 2 2 3 1 f 5 8 2 8 0 1 1 6 a a 1 f b 1 5 9 4 b 8 e c 1 c 1 5 5 5 c c 0 4 7 c 5 5 f 8 e 6 8 5 8 b 3 e 2 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 4 6 8 1 9 d 3 b 9 c 4 2 c 2 3 2 a 6 3 c 6 1 c 2 b c 6 9 b 4 4 c f 7 e 5 8 9 5 6 4 1 a a 6 9 0 c a 8 1 b a 4 8 b 4 5 8 c c 1 2 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 4 2 9 8 3 7 9 0 9 2 e 4 3 8 e 3 c c 4 2 5 4 8 1 2 6 9 c e e a c 2 f 5 f f 5 8 d 9 e c 5 c 8 1 7 7 4 0 9 3 e 3 8 e d d 7 e 9 0 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ a 5 1 7 5 f 8 5 b 2 a 5 9 5 e a a 4 1 6 9 3 e 0 e e 0 e 1 2 6 f 7 a 8 a b b e 9 e 2 1 3 0 e e 5 0 6 c 0 5 b 4 0 9 3 c e e f 1 c
C : \ 0 4 e d 9 3 3 4 b a 5 6 c 6 3 6 d 8 e 1 c d 7 3 b 0 f e 2 f 9 7 9 3 8 8 f 7 d d 9 0 1 2 4 6 0 9 8 3 c 3 e 1 f e 8 e 6 3 9 9 d e
C : \ d e d 4 5 2 8 2 6 b 2 e c 0 f b 7 0 4 e 5 f b d 2 1 7 d 7 7 7 8 e 2 e 6 1 1 d 3 3 7 7 7 b 4 8 9 e 7 5 7 5 6 4 c a a e 3 d c d 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ f 2 f a d 1 1 b c f c 8 5 0 a a b a e 3 6 9 4 7 6 6 c d 2 e 3 8 e e e c 9 2 4 0 c 3 1 7 8 d 4 6 d 5 7 5 4 4 3 5 3 b 5 4 8 0 d b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 7 9 c b f a 9 4 d 2 e 3 9 9 f 5 a a b 6 5 6 c 2 7 3 e 8 a 8 4 c 1 2 7 d 9 1 0 f 5 4 b 0 a 2 e b 9 2 3 1 b d c a 3 d 4 4 4 f 8 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ e 6 1 3 e b f 3 4 f c 7 2 b 2 6 d 8 e 1 9 4 a b 3 b f e 1 a 8 4 d f 1 2 f 6 b d b 9 a 6 3 6 1 d 8 6 9 1 c f 2 3 4 5 9 b 4 b f 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 6 3 9 a 7 8 2 e 0 1 6 f e d b 6 b c b f 2 3 4 1 f c c b 2 6 b 3 d 3 9 a 5 a f d 1 f a 7 1 5 d b 7 1 5 0 b 5 5 9 c a d 8 f 3 f c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 f c f 6 8 2 4 9 2 3 2 5 c 1 5 _ b u d h a . e x e
C : \ 8 7 2 4 6 9 5 c f b 5 4 a 7 9 8 d 3 1 f 6 7 5 2 8 1 c 1 e 2 7 5 b 6 6 4 1 8 5 6 4 4 9 3 2 2 e e 1 9 c 1 5 e 2 f e b d 6 f b 6 5
C : \ 7 8 f b e 4 8 5 e d 5 1 d 9 5 a d 0 4 5 b 1 4 4 0 e f 9 2 f 3 a 3 5 7 8 b d f 8 c 3 6 4 4 3 e 1 c b 5 9 c b c e c 2 9 0 0 d 8 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 0 a 8 5 f d 1 b 4 2 9 7 c 4 b _ b u d h a . e x e
C : \ 7 4 1 6 8 9 4 d d f b 3 8 d 9 e c b 2 5 3 0 5 f 2 9 3 f 7 e 6 d d 2 0 9 5 f 9 0 f 5 5 4 5 7 c f a 5 a 6 7 2 2 1 6 f 3 0 e 8 0 5
C : \ e 7 c 2 e b 6 f d a 7 b e 4 0 3 f 2 4 3 9 6 7 b 6 5 6 1 b 9 0 1 f f c d a 2 0 0 7 8 b e 2 0 f 8 8 3 2 7 f 9 1 5 2 f f 1 7 8 c 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 8 5 5 1 2 3 a f 9 4 3 b e 5 5 6 1 5 4 8 b 2 b 5 1 7 4 0 a b a 9 2 e 0 6 8 a 4 7 e 7 b 3 3 f f 4 0 8 7 8 3 b 5 2 d a 0 d f c 6 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 6 2 2 3 9 2 3 7 7 d 9 c b d 7 c 0 8 e 7 6 d f 2 3 3 e 9 e 2 3 c 2 b 4 e e 3 3 d 7 6 9 8 a 7 6 e f 1 8 a 4 7 1 d d 9 5 6 7 a 3 5
C : \ d 9 d e c 5 3 8 9 9 c 0 8 1 5 c 6 6 3 e 8 7 a 5 d 3 5 c 6 f 0 0 e 7 2 8 f d 8 7 c d 0 4 0 8 b 0 c a 3 d 3 7 b 1 1 9 c 0 1 1 6 3
C : \ a d 2 5 d e 7 2 3 9 9 f f a 1 6 4 0 b 3 9 9 b f e 8 e 3 4 4 8 3 b 4 5 1 0 7 2 2 0 d e a 7 c d 0 2 3 c 6 0 b 2 4 e 0 1 c b c 5 0
C : \ d 6 b c 0 5 f 0 0 1 b e d e f 2 7 0 1 8 7 b 8 e d f 1 6 f 4 b 0 6 8 0 6 0 f e a d 8 e b e 3 8 2 2 0 f d 9 7 e a 5 1 8 f 3 a c a
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ e 7 f b 7 7 d 5 d 9 5 3 a 7 f 2 f 7 6 4 b 1 b 8 2 0 1 8 d 2 3 c 3 2 5 4 7 4 2 1 b 9 8 7 d 4 f b a 3 d 5 8 a 2 1 0 0 9 5 c b 6 1
C : \ 9 9 3 5 6 6 2 8 b b 3 9 0 a 0 d 8 a 9 8 c f e 5 6 9 d 1 0 8 9 1 b 4 4 3 0 8 9 0 3 8 2 a 8 2 1 3 9 a 0 8 1 4 e b b 4 7 c e 0 a e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
Process Tree
-
089079074d5bbd5811dda6c96116d2d5532bb64765911ba44f839de4bdb46342.exe (1612)
"C:\Users\Administrator\AppData\Local\Temp\089079074d5bbd5811dda6c96116d2d5532bb64765911ba44f839de4bdb46342.exe"
- budha.exe (2160) "C:\Users\ADMINI~1\AppData\Local\Temp\budha.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 3.33.130.190 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| maitikio.com | ||
| cry-havok.org |
A 15.197.148.33
A 3.33.130.190 |
15.197.148.33 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49164 | 3.33.130.190 cry-havok.org | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 81f11933a1eb502d_budha.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
| Size | 66.9KB |
| Processes | 1612 (089079074d5bbd5811dda6c96116d2d5532bb64765911ba44f839de4bdb46342.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 9852d2667e4dfa383f641275efdb125a |
| SHA1 | ae45f08b2f28de8e0e74eef8def83850a335ee4d |
| SHA256 | 81f11933a1eb502d38c672d6f6259c55089e3fb21bdfa45350f1f74228b1eaf4 |
| CRC32 | 2A4FB014 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | f8cbd004ecf7b671fe3e4e9f65ac38d383084a82 |
|---|---|
| Size | 5.0KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | c756e15d916c6f99898b22bbbea64ada |
| SHA1 | f8cbd004ecf7b671fe3e4e9f65ac38d383084a82 |
| SHA256 | b85e69c2a7fe688108dfeece6642e2589dd57e85eaf615d44ae58b44b0326c92 |
| CRC32 | AD32B654 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |