1.2
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.52
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Trojan-gen | 20191219 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.ck | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191219 | 2013.8.14.323 |
| McAfee | GenericRXIM-MU!6D25E5FFBBEF | 20191219 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07675 | 20191219 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
动态指标
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意
(50 out of 58 个事件)
| ALYac | Gen:Variant.Ulise.41348 |
| APEX | Malicious |
| AVG | Win32:Trojan-gen |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.41348 |
| AhnLab-V3 | Trojan/Win32.Agent.C3082988 |
| Antiy-AVL | Trojan/Win32.Agent |
| Arcabit | Trojan.Ulise.DA184 |
| Avast | Win32:Trojan-gen |
| Avira | TR/Agent.emh |
| Baidu | Win32.Trojan-Downloader.Small.ck |
| BitDefender | Gen:Variant.Ulise.41348 |
| BitDefenderTheta | Gen:NN.ZexaF.33556.cq2@aiF5P!i |
| Bkav | W32.AIDetectVM.malware1 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.fbbef7 |
| Cylance | Unsafe |
| Cyren | W32/S-107e7686!Eldorado |
| DrWeb | Trojan.Packed.3036 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Gen:Variant.Ulise.41348 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-107e7686!Eldorado |
| F-Secure | Trojan.TR/Agent.emh |
| FireEye | Generic.mg.6d25e5ffbbef7841 |
| Fortinet | W32/Zbot.QNYM!tr |
| GData | Gen:Variant.Ulise.41348 |
| Ikarus | Trojan-Downloader.Win32.Small |
| Invincea | heuristic |
| K7AntiVirus | Spyware ( 0040f78b1 ) |
| K7GW | Spyware ( 0040f78b1 ) |
| Kaspersky | Trojan.Win32.Agent.ibbb |
| MAX | malware (ai score=81) |
| Malwarebytes | Backdoor.Bot |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | GenericRXIM-MU!6D25E5FFBBEF |
| McAfee-GW-Edition | BehavesLike.Win32.Downloader.pt |
| MicroWorld-eScan | Gen:Variant.Ulise.41348 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.Agent.cqjtkw |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.FBE7.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Upatre-YT |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.10b07675 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2004-10-14 13:48:53
PE Imphash
d16556a9c6a0f4eeed93067c1f806aaa
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00006000 | 0x00004600 | 3.617846775833521 |
| UPX1 | 0x00007000 | 0x00003000 | 0x00002400 | 6.267469876195921 |
| .rsrc | 0x0000a000 | 0x00002000 | 0x00001800 | 4.5502417514925915 |
| .imports | 0x0000c000 | 0x00001000 | 0x00000400 | 4.3369124188141415 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000a17c | 0x00000ea8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x00007020 | 0x000000e8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x0000b028 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x0000b040 | 0x00000318 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x0000b35c | 0x00000193 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library KERNEL32.DLL:
• 0x4050f0 GetModuleHandleA
• 0x4050f4 CreateSemaphoreW
• 0x4050f8 GetProcAddress
• 0x4050fc HeapCreate
• 0x405100 HeapAlloc
• 0x405104 ExitProcess
• 0x405108 FreeLibrary
Library GDI32.dll:
• 0x405388 CreateBitmap
• 0x40538c IntersectClipRect
• 0x405390 ExcludeClipRect
• 0x405394 UpdateColors
• 0x405398 DeleteDC
• 0x40539c GetTextExtentPoint32A
• 0x4053a0 CreateCompatibleDC
• 0x4053a4 DeleteObject
• 0x4053a8 TextOutA
• 0x4053ac SetBkColor
• 0x4053b0 SetTextColor
• 0x4053b4 Rectangle
• 0x4053b8 CreateSolidBrush
• 0x4053bc GetStockObject
• 0x4053c0 SelectObject
• 0x4053c4 CreateFontIndirectA
• 0x4053c8 GetTextExtentExPointA
• 0x4053cc SetMapMode
• 0x4053d0 GetDeviceCaps
Library Msacm32.dll:
• 0x40554c acmStreamOpen
Library OLE32.dll:
• 0x405528 CoCreateInstance
Library user32.dll:
• 0x4051c8 CreateWindowExA
• 0x4051cc GetMessageA
• 0x4051d0 DispatchMessageA
• 0x4051d4 DefWindowProcA
• 0x4051d8 PostQuitMessage
• 0x4051dc GetForegroundWindow
• 0x4051e0 SetForegroundWindow
• 0x4051e4 CreateMenu
• 0x4051e8 GetSystemMenu
• 0x4051ec GetDoubleClickTime
• 0x4051f0 UpdateWindow
• 0x4051f4 GetQueueStatus
• 0x4051f8 GetClipboardOwner
• 0x4051fc FindWindowA
• 0x405200 LoadIconA
• 0x405204 LoadCursorA
• 0x405208 RegisterClassA
Library Winmm.dll:
• 0x40556c mciSendStringA
L!This program cannot be run in DOS mode.
.imports
E%)E%-
2Q?@HGGQ
g@N[vf
X=g;QFvZVCy
LoadLibraryExA
status recsound c:\\fwfew\qef
TranslateMessage
user32.dll
GetModuleHandleA
CreateSemaphoreW
GetProcAddress
HeapCreate
HeapAlloc
ExitProcess
FreeLibrary
CreateBitmap
IntersectClipRect
ExcludeClipRect
UpdateColors
DeleteDC
GetTextExtentPoint32A
CreateCompatibleDC
DeleteObject
TextOutA
SetBkColor
SetTextColor
Rectangle
CreateSolidBrush
GetStockObject
SelectObject
CreateFontIndirectA
GetTextExtentExPointA
SetMapMode
GetDeviceCaps
acmStreamOpen
CoCreateInstance
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
PostQuitMessage
GetForegroundWindow
SetForegroundWindow
CreateMenu
GetSystemMenu
GetDoubleClickTime
UpdateWindow
GetQueueStatus
GetClipboardOwner
FindWindowA
LoadIconA
LoadCursorA
RegisterClassA
mciSendStringA
`.text
.idata
U(,XwQ
i[[*{<
@GetModuleH%and
Cre Semapho
W#ProcAdd
Exi'#F efA
rsectClipR
Cclude
Upd1CoarUDe
ZDCText/
}gl*4ObjP5Ou
t+tBkY
olidBrushStk!PS^ct/!Fodir
~[e"vic
_xmfkwacmSmOp;
(ies6mBdAWc
"fdowl~s
h'fz8nu'yIMG
<Time<="!ve
boCdOwn*Da
Cu!=lAgY<afh
3lmc|i<OBg
lY?`7 Ju,
`r .cvf
lPK&'.r
`{,'Lm)
XPTPSWXaD$j
\\\\\\mmm\
\\\\\\onmnmmmmm\
\\\\\ooooooonnmmmmmm\
\\\\\\qqqppqoqoooonnmmmmmm\
\\\\\\sqqqqqpqmqopoooooonnmmmmmm\
CCCCCCCCC\\\sssssssqsssqoqqqqoqoqnoonnmmmmmm\
Cssssssssssssssssssqqqssqoqmqooqnooonnmmmmmm\
!"+578Xsssssssssssqqspqqqoqoooooonnmmmmmm\
"#-78Ksssssssssqqssqppqpqpoqn_VF?
Wmmmm\
!++57DsssssssssqsqsqsfZPF>)
Pnmmmm\
!"+578ssssssssdaMH<0
Qmmmmm\
!!++57issssR00))'
1?HTfmmmmm\
!"#-6XssssR0)*'$
'0>FPZdooooommmmmmmm\
!#+-NssssT0>BHMU_iqqpqqpooqnoooZQ_nmmmm\
!!"+AsssssqssqqqqsqpqpmZQFB$
mmmmm\
!"-ssssssssseaRLB4$
mmmmm\
!pssssFE0)'
1mmmmm\
assssF0)*$
))BFQVdnnnmmmmmm\
LssssM0)4?BMLXZhppoqoooqnoonmmmmmm\
AsssqmpqsqqqqqqppqppoqTV??$
_nmmm\
0qssssssssqsqsqpqpppoq
Pnmmm\
pssssdXsqsq>
Lqppppoq
Vnmmm\
(%$mqsss00Tsqs>
dpppqnoUVVooonnmmmm\
%%'_ssssB00oqsL
'mpppqqooooonnnnmmm\
Cs &%%&((QssssE0*>qqM
FqppnohVP??
Hnmmm\
Cs% %%&&((,(FssssE0*)PsL
ZpqpoB
Cs%%&&%,,,..:ssssE0*0'eM
1mmmm\
Cs,,,,,,....1ssssR0)N$4H
4poomVUVoomnmmmmm\
Cs1,1,1111111hsssT00aL''
Vqoqnoooonnmmmmm\
Cs33133133434_qssT0)am0
fooWUF?>
mmmmm\
CsF<:99<94:93VsssT/*RsZ
_mmmm\
FqL<:::::::::HqssZ0.HdqB
Ummmm\
Li_>=========Bsss400'0so$
4qh,.?FmQUVZommommmm\
LXsBBBBBBBBBBBqssaRRPZoqmqqqpqqpoooqnoomnnmmmm\
FqVFFFFFFFFFFmqssssspsqqsqpqpppppoppponnnmmmm\
Q`pHFFFFGFGCG_sssssssqsqssqppppppppppoonnmnmm\
FqbFHIIIIHIHZqsssssssppppppppqppppppoonnnmmm
TqZLILLLLLLVsssssspppppsqpqppqooqonnX
LdqVOOMMOMOOqsssssssimhi__Z_MMMMMMMqF
Hiq^QQQQQOQZZZZQQRPQRPPQPQQQQQMQQQsF
FesfTTTTTQVQQTTTTTTTTTTTTTTTTVQTTsH
HXqqcQVVXVXUUUUUUUUUUUUUUUUUVVXUqC
XHcqsnc^ZZZZZZZZZZZZZZZZZZZZZZZqF
THapqsqqqqqqqqqqqqqqqqqqqqqqssF
LLCFFFFFFFFFFFFFFFFFFFFFFFFFF
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
GDI32.dll
KERNEL32.DLL
Msacm32.dll
OLE32.dll
user32.dll
Winmm.dll
DeleteDC
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
acmStreamOpen
CoCreateInstance
LoadIconA
mciSendStringA
KERNEL32.DLL
GetModuleHandleA
CreateSemaphoreW
GetProcAddress
HeapCreate
HeapAlloc
ExitProcess
FreeLibrary
GDI32.dll
CreateBitmap
IntersectClipRect
ExcludeClipRect
UpdateColors
DeleteDC
GetTextExtentPoint32A
CreateCompatibleDC
DeleteObject
TextOutA
SetBkColor
SetTextColor
Rectangle
CreateSolidBrush
GetStockObject
SelectObject
CreateFontIndirectA
GetTextExtentExPointA
SetMapMode
GetDeviceCaps
Msacm32.dll
acmStreamOpen
OLE32.dll
CoCreateInstance
user32.dll
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
PostQuitMessage
GetForegroundWindow
SetForegroundWindow
CreateMenu
GetSystemMenu
GetDoubleClickTime
UpdateWindow
GetQueueStatus
GetClipboardOwner
FindWindowA
LoadIconA
LoadCursorA
RegisterClassA
Winmm.dll
mciSendStringA
A b o u t
M S S a n s S e r i f
Z _ c f i n k p
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 5
C o m m e n t s
C o m p a n y N a m e
M S F T C o r p
F i l e D e s c r s i p t i o n
c a l c . e x e
F i l e V e r s i o n
2 . 1 . 1 . 2
I n t e r n a l N a m e
c a l c . e x e
L e g a l C o p y r i g h t
C o p y r i g h t ( C ) 2 0 1 1
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
c a l c . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
P r o d u c t V e r s i o n
3 . 1 . 1 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
C : \ D O C U M E ~ 1 \ m e d q u i s t \ L O C A L S ~ 1 \ T e m p \ T e m p o r a r y D i r e c t o r y 1 f o r S T D _ 2 6 1 [ 1 ] . z i p \ S T D _ 2 6 1 . e x e
c : \ 9 2 b f 4 f 7 1 d a b f d d 5 f a 6 d 9 e 5 a d 6 f a 9 d 9 e a . e x e
C : \ c 6 a 9 5 8 3 6 2 a c c 8 d b 5 5 4 e b b 8 0 5 9 2 c a c 1 b 2 b 5 c c c 9 d 9 a 6 5 e d 7 f 2 b e 4 6 6 2 7 6 7 0 a e 0 1 e 9
C : \ R U C l u f g N . e x e
C : \ u f b g B u I A . e x e
C : \ f u 5 H X o I R . e x e
C : \ 5 I 5 a J u 9 j . e x e
C : \ I b F 1 v u 7 D . e x e
C : \ C n e o m e l N . e x e
C : \ c O Z V j R 7 M . e x e
C : \ 5 j y 8 r S 8 2 . e x e
C : \ M 1 d y H K E 0 . e x e
C : \ a e 3 0 4 0 7 4 0 6 6 d f 0 a a 5 3 f 0 7 b 4 c c 3 a 5 d 9 c a 4 8 7 1 7 b 6 3 5 5 4 b b e 8 3 6 1 8 8 2 e e 8 2 b 0 b 7 6 b 8
C : \ e 0 7 2 f f 9 0 5 c e 2 5 0 c 5 a 6 9 e b 5 6 6 c f 4 9 c 2 0 5 4 1 4 8 c 1 d 3 2 d b 7 3 1 5 7 4 e 4 0 4 f 0 5 5 8 b d 6 1 d d
C : \ 2 7 x _ b c X M . e x e
C : \ R k 9 u x d z C . e x e
C : \ D B q w E Z 2 Q . e x e
C : \ S _ W L Z S 0 m . e x e
C : \ i d o R W E B d . e x e
C : \ 1 t t O 5 S B t . e x e
C : \ I f d p C U e W . e x e
C : \ R d 6 J i B X C . e x e
C : \ K r a T 9 h 5 L . e x e
C : \ 4 d 2 5 d 4 2 1 9 3 9 6 c e d a c a 4 9 8 e 8 0 7 0 f 4 3 e 6 5 6 0 c f 5 8 8 6 d d 0 7 b f a 9 6 a f 1 7 6 f 4 6 3 8 3 b c 5 5
C : \ a 3 a 3 3 2 4 f e 1 a 0 a c 0 0 4 2 9 e a b 9 9 6 d e f 4 9 c c 8 c 9 8 5 7 7 2 9 6 c 1 4 1 7 0 2 f e d 1 2 f 0 7 f d 9 a 6 1 c
C : \ F 5 s e H Y T I . e x e
C : \ R j J D 9 k u 2 . e x e
C : \ 6 Z E t S 5 9 s . e x e
C : \ u F 7 M M e h b . e x e
C : \ z R E e 2 u w b . e x e
C : \ N Y g o A G U J . e x e
C : \ y 0 B t E M I I . e x e
C : \ I Y J P B G _ r . e x e
C : \ f T E N I o _ G . e x e
C : \ q 7 N 0 h X b 9 . e x e
C : \ j t 4 M p 2 H s . e x e
C : \ i T l R x l s T . e x e
C : \ l L 9 1 U g 3 D . e x e
C : \ I i A H i C _ K . e x e
C : \ 6 5 f 0 2 a 2 5 5 d 3 f b 1 b d d 5 8 e b 0 2 e b 6 6 d 1 f 0 4 5 6 6 8 e b 9 0 1 e 4 e 6 9 8 0 d d c a a d 0 e f e d 2 d 5 5 9
C : \ 4 d b 7 7 5 f 1 4 e b 9 8 3 5 1 a 2 6 7 0 0 8 f c f 9 b 6 6 f 0 e 4 4 2 1 f 1 b a d b e e 6 5 1 3 b b 9 4 f 5 8 9 0 5 e b e 4 f
C : \ 4 S l h j S p D . e x e
C : \ h Q a B o 6 G G . e x e
C : \ _ s m K 8 A a U . e x e
C : \ R k z 7 C N S p . e x e
C : \ d o p p A N S w . e x e
C : \ Y 2 N b j C q U . e x e
c : \ n 3 v 9 j 5 \ q c 1 4 2 0 . e x e
C : \ b 3 2 d 5 5 8 1 0 c d a 7 f 9 7 b d 1 4 7 2 7 0 7 0 d e e c a 3 b 8 6 b d 2 b a b 0 6 2 3 9 f 9 d c 5 3 b 1 2 5 4 5 c 3 5 0 7 f
C : \ 2 d 7 9 6 c a 1 f e 5 4 b 2 7 2 8 8 d e 9 1 2 f b a b d 6 c c e e 9 0 3 7 e e 0 f 6 7 6 e 5 c 4 d 1 e 7 8 f e f 7 d f 2 b 6 d 0
C : \ 7 2 f 1 c f 8 f 5 a c 6 8 2 4 c 4 8 a 4 9 9 3 3 7 d 7 c c f 4 9 3 6 8 d 7 e 8 c 3 6 8 0 5 0 0 b d 2 5 0 2 8 7 9 0 0 f 2 e 5 0 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ d v z N w b 6 x R . e x e
C : \ 5 3 _ f u g w F . e x e
C : \ z 7 I O A 9 D 7 . e x e
C : \ 9 9 0 9 f 9 6 5 e 3 9 2 6 c d 2 3 d d c 3 f 6 d 0 e e 0 f 2 b 0 3 f 3 2 2 b d 1 a a 2 6 b 3 a 0 6 b 6 6 c a f e 3 0 3 0 9 7 8 b
C : \ f d a 5 d b 7 7 0 2 3 9 a 2 8 8 8 d 6 4 2 8 9 8 0 f 6 7 2 1 2 0 f 2 1 3 b 1 7 2 a 2 e a 3 e 3 5 8 f a 9 c c b b 5 2 d 5 3 c 7 7
C : \ 6 k x s 9 d S 2 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ g z U Y 7 i Z T . e x e
C : \ 3 e d 3 a f d 0 b 5 d c a 3 e 8 1 3 e 6 c 4 3 3 7 d f 2 c d c 1 c 6 c c 4 2 8 8 0 1 e d 2 e e 9 3 b e d 9 9 4 c b a f 5 4 f d b
C : \ U s e r s \ L i s a \ D e s k t o p \ P X E 5 v O T 7 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ i U s a H p p X . e x e
C : \ 7 0 6 8 5 b f 9 8 b c f e f 2 8 2 2 d d 3 7 1 a 1 d 5 5 b 6 0 e 0 6 2 1 c d c e c 0 8 e a 9 b 8 5 0 5 d 3 2 5 d 0 d 3 1 7 8 9 4
C : \ a 2 1 9 d 5 8 3 1 b 4 9 0 4 e f 2 d b 2 7 8 6 b a 8 f 8 0 7 b c a 4 7 6 d 6 0 4 0 b 0 c 7 6 a 7 0 d b e 2 f 6 3 2 1 4 4 3 a b 5
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ X g G n c 7 R E . e x e
c : \ t a s k \ 4 D D D 1 5 C B 7 3 2 C D 9 3 0 5 9 A 3 4 F 0 A 0 4 1 4 4 A 4 F . e x e
C : \ V I D 6 5 1 9 8 3 6 6 1 . e x e
C : \ 5 4 a e 6 3 5 a 1 3 5 2 0 b 2 b 7 7 6 5 c 1 b 9 c f b 0 f e f d d 8 b f f 1 3 2 6 0 8 1 1 5 3 a 2 9 c c 8 3 1 1 9 4 3 0 7 8 b 9
C : \ 0 f 8 1 2 a 8 9 c 9 9 7 f 7 d 1 7 8 1 0 e f a 9 2 5 1 7 d b b b a 2 3 a a a 7 1 0 6 6 c 9 e 6 2 0 0 2 4 f b 3 d f f 4 9 2 9 6 9
C : \ 9 b 5 4 4 a 6 a 0 e f 8 a 4 6 c 7 0 5 9 3 c f d c 8 0 1 e 4 e 3 5 2 6 f 3 d 4 b 9 f 2 1 9 e 7 e f d f 0 8 5 8 9 4 6 4 8 d 1 d 8
C : \ V I D 6 5 2 3 3 7 4 6 9 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ U y k S G o n L . e x e
C : \ 3 a 7 b a d 1 8 4 3 b 6 f 6 c 7 9 f 2 3 e 1 5 e 9 0 6 b 4 2 3 f b 3 c d 1 4 8 3 d 2 9 f e 5 4 c d 3 e f 3 3 f b 8 f 1 a a 6 f 7
C : \ U s e r s \ L i s a \ D e s k t o p \ m t m j R w a R . e x e
C : \ 8 i J Q I p d K . e x e
C : \ 7 6 b 0 1 f 1 9 9 a 7 5 3 d c 8 4 c 3 0 b 8 3 2 c b 5 c 4 8 5 8 4 9 e 0 0 1 8 a 8 0 d 5 6 3 5 4 a 2 6 3 c 6 3 c 2 f 2 e 8 e 8 4
C : \ d 0 0 7 5 b 5 0 f a 7 1 2 c 9 1 d a 3 d 1 1 3 a 6 4 7 4 0 2 b 1 f 2 3 7 c 3 6 9 e 6 d 9 1 d 9 9 0 c 2 b 3 8 d 0 e 5 2 2 4 6 0 7
C : \ 2 9 4 6 1 0 e f 2 f f 5 5 6 8 5 b 4 e f 4 0 4 a 0 e 8 b a 9 b 4 9 3 7 6 c 9 5 3 5 b d c c a 1 4 2 7 b 0 2 f d 0 0 7 d 9 5 0 1 b
C : \ d a 4 7 a 4 7 e 4 c f 7 8 7 9 c e d a 6 a c 4 7 8 8 2 e b a 2 a e 3 b e 2 f e 4 0 0 2 e 3 d 2 c 9 e 5 5 5 1 e 7 6 1 7 0 b f b 5
C : \ c f e e a 7 c a 0 d c 0 4 b 1 5 a 2 d 6 5 e 8 1 d d f 6 3 5 8 f a 4 d 0 b b 2 5 1 5 e 9 5 f c 5 d 5 4 f f 0 a 0 0 f f 0 7 a 7 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ p S O n q y F w . e x e
C : \ g H A N T 8 0 K . e x e
C : \ 4 6 c 1 4 e a b 5 d d 3 3 3 8 2 3 1 e 3 a f a 5 d d e 4 9 d 1 5 8 b 4 3 3 a c 6 5 e 0 e 3 1 5 0 8 f 4 8 d 7 0 3 d f 8 4 0 4 9 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Z 8 G 2 t t F T . e x e
C : \ c 8 f 0 c b b 8 f 8 6 d 7 b 2 0 8 8 d c c a 2 b 7 5 7 1 1 6 8 f 7 9 c 6 e 6 3 7 1 f 1 2 0 d 1 0 1 d 8 f 9 3 4 c 5 4 e 7 3 1 4 2
C : \ b 5 0 f 6 b a d 6 b e 9 5 9 6 b 9 2 e 2 7 e 5 1 8 c 3 5 8 f 3 b 0 f f d 9 3 3 5 a 8 f b 2 b 8 5 d 4 6 7 1 f 1 4 d e 4 4 b 2 d 9
C : \ 8 9 0 1 b e 7 5 9 7 a 7 d 5 2 a 7 3 c 0 c 4 5 b c b 8 1 4 b 7 e 4 0 e 3 6 8 4 e e 5 e 5 1 a 0 2 9 8 6 e 5 b 3 e 0 f c 3 5 5 b 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 5 O 0 l z Y t p . e x e
C : \ t t h m B B h T . e x e
C : \ b c d 7 e 6 9 f b a 9 5 5 8 8 9 6 a 1 e a d 5 7 c 9 a 8 2 8 e 3 e 4 f d 7 d 1 f 6 b 1 2 4 f 1 f c 9 4 1 e f 5 8 7 b c 5 d 1 c 1
C : \ 6 7 1 1 d 3 3 3 9 7 1 6 6 5 8 6 0 f c 9 5 3 8 e f f 7 8 5 5 8 7 5 6 c 8 2 6 f 4 c 7 a e 0 b 9 1 e 5 7 6 b 0 4 4 1 b 9 7 9 8 6 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ J B E o I J M z . e x e
C : \ v Y g v 5 p 9 3 . e x e
C : \ f 2 6 0 7 2 6 3 a 9 5 6 d 9 a b a e 4 a 1 a b 9 2 a 2 1 6 d 9 f 5 0 0 c 6 7 0 d 9 b e 6 1 4 d e 2 5 2 7 4 9 1 2 e 8 c 7 8 4 c 2
C : \ 7 a 4 6 d 7 9 d 6 c 1 d b a 7 4 8 3 9 5 c 8 1 9 7 e 6 b 1 5 e b 7 7 9 8 6 3 b 4 3 4 2 8 f 7 5 6 c e e e 0 c 3 6 5 b 1 2 e 6 7 2
C : \ b 3 0 6 3 a 2 4 0 e f 4 d 8 b c 0 4 c b f 6 2 d c 5 8 5 e 8 4 2 a a e 9 8 7 7 a 9 9 a 6 2 a 6 1 d 6 d 5 a 2 e d b 5 e 0 8 b d 8
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ S b C r P 7 E C G W . e x e
C : \ t X 1 3 e K A R . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D U D E g q B 7 . e x e
C : \ 6 8 4 f a 0 1 5 1 4 a f 1 6 a 3 8 4 2 7 8 4 6 d 2 c 4 f 4 e 7 c c d 2 6 9 4 b 8 4 5 c a f 2 8 a 3 d 7 2 9 1 f 3 0 9 d 2 4 d 8 9
C : \ f 5 a 3 b a 0 7 f 9 7 5 a e 8 d 8 5 a 4 7 3 9 d 5 3 2 b 9 6 e 0 7 e d 1 f 2 9 b 3 b b 0 6 c f e b 0 1 7 5 2 5 3 b 4 f 8 3 b 1 5
C : \ b F L t w J 4 u . e x e
C : \ d 8 4 1 b a 4 9 2 c 0 b 3 c 3 3 3 2 2 7 c 5 1 6 f 9 b 5 a f 7 c a e c 6 2 5 b 4 8 5 2 f a 9 8 a 5 6 0 8 4 b 5 0 c 3 0 7 5 4 8 b
C : \ U s e r s \ L i s a \ D e s k t o p \ g v z 2 w 5 3 U . e x e
C : \ 9 E 9 l J P 3 s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ d n s O J G q L . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 7 4 f c d b c 2 5 6 7 a 1 b 7 2 2 7 3 4 b a 5 e 8 c 7 a 2 e 4 e 8 0 8 3 7 0 0 6 9 d 7 a a 2 6 e 4 9 7 3 3 d 8 b f 6 d 8 f f 8 7 . e x e
C : \ 3 5 8 d 9 6 6 4 9 c 4 6 d b 7 8 a 6 9 3 0 e c b 6 6 3 1 a d 3 7 4 7 1 f 6 5 0 2 a 4 2 4 8 b b d a 1 9 f c 5 9 9 7 d 2 2 7 a 3 f
C : \ U s e r s \ L i s a \ D e s k t o p \ Z x S 2 N B Q q . e x e
C : \ 3 T T C w U h A . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ V d 1 K b W f i . e x e
C : \ Y K E h U c x m . e x e
C : \ 5 5 5 6 7 0 5 a 2 e 8 d a f 5 4 1 8 5 e c 3 c f 9 3 8 7 2 0 b d 3 d f 9 1 3 b 7 f 9 6 f 0 e e 7 b e 8 5 3 1 b a f 1 9 3 c 3 e c
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ u r Q J b j q a . e x e
C : \ r z n O C q O T . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ y R v e 3 2 E N . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ N o L J L i x x B b . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 c a 6 4 9 c 3 f 9 8 5 6 f d f 0 c 3 2 2 f 3 9 2 d 1 7 4 c 5 9 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 2 1 4 d 4 e 4 8 7 a c d 3 a 8 d b 1 6 5 d 8 7 1 8 4 7 7 a 6 0 1 4 a 5 4 b 3 b d d f 4 4 c b d 1 e b b 8 f d b 2 2 0 c c 0 5 0 3
C : \ a 6 e 1 4 8 0 d a 2 2 3 6 a 0 f 1 b a e 3 d 9 2 b 8 5 b 1 3 7 5 5 7 1 3 9 6 4 f 7 7 8 f a b 8 6 9 0 3 b e e f 1 2 d a a f 6 0 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 3 8 e 9 0 d c c e 3 7 f 1 6 0 5 c a 4 5 9 c c c 8 1 4 7 7 e c 0 b e d 0 0 1 5 5 2 0 d e e c 7 b e a a 7 7 9 d a c 3 a 1 2 d c 0
C : \ 2 5 d 2 8 9 b 6 2 c 2 d 4 2 e 9 c f 7 5 1 0 4 5 d c e 4 d 2 3 b c b d 5 9 8 d 2 d e 4 2 f e e e 5 a 8 3 6 d 9 f 9 e 4 c c d 7 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 2 f 9 9 a c 6 f c b 1 1 d a 4 _ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ b 0 8 c 9 0 7 3 a a 7 c c 7 a e f b 8 f a 1 b b b 2 1 e 0 f 1 9 8 7 1 9 b 8 e 6 2 1 d f 7 b 1 9 a 7 0 7 1 0 e 1 f f 3 b 6 f 6 4
C : \ 1 8 9 1 b f 6 b f 8 0 c e 7 d 3 2 3 d 4 c e b 8 b b b d 7 f b f e 0 4 3 a f 1 4 2 a f b e 0 c c 2 0 9 7 5 d 8 9 9 7 d 8 6 3 a 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ a c 5 0 6 1 0 a 0 b d 3 d b 3 2 8 c 1 2 6 0 b 4 f 4 0 8 4 d 8 1 2 6 7 1 0 d c f a 7 5 c 6 c 7 9 e 4 a c b f a f f b d 7 b 5 d 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 1 4 6 5 e e c 6 b f d 1 e 5 0 _ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 8 f 6 5 e 4 b e 3 b 1 b f 2 7 _ b u d h a . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 4 8 3 1 a e c 2 8 a 0 2 a 9 3 5 1 f 5 8 d 6 2 3 1 b 2 f d 2 3 b c 1 e 9 4 1 1 2 6 b f 9 b 9 6 a 8 a a 0 c a 4 f d 4 8 f 3 4 4 1 . e x e
C : \ 1 0 4 1 1 5 8 8 7 5 b 0 6 b c c 8 5 1 a e d a f d 5 7 2 1 b 4 9 f 3 7 9 f 4 c b 3 7 4 b 1 0 e 9 8 1 e b f 8 b 5 d 1 4 5 2 e f a
C : \ 9 6 4 b 8 d f 5 6 a d 6 f 3 9 2 0 8 4 a 5 f 5 1 0 f 1 0 5 d 0 5 c 4 5 0 b b 4 3 6 2 b b c d 1 2 8 e 6 6 3 b a 6 1 0 3 f 5 9 3 9
C : \ 3 9 5 e 5 a 0 1 f 8 f a c 2 b 5 1 d 6 f f 9 b f 3 2 6 f 7 e 8 7 1 a f b d 9 a b c 0 1 b f 0 2 c a d 5 1 3 1 3 b 0 5 2 2 0 e 6 9
C : \ a d f c 0 2 9 1 7 d 4 c c 2 a 1 0 d 3 a 8 0 0 e 6 2 2 6 9 9 6 7 d d 6 5 3 3 8 4 a 0 8 d 3 7 7 9 8 f 5 c 2 0 e 7 9 e e 0 6 e d 8
C : \ 6 4 2 d a 8 f 6 4 e 6 f c e 4 3 a b c 4 4 2 2 9 8 2 6 b b 7 d f c b d 5 e a a 3 7 e 0 7 3 e 6 0 0 a 4 e b 3 e a 1 3 0 d 0 9 e 8
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.