2.0
低危
DACN
0.14
FACILE
1.00
IMCLNet
0.68
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545282.515125 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727545282.8435 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545282.421125 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545282.7815 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | .MPRESS1 |
| section | .MPRESS2 |
| section | .imports |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
查找外部 IP 地址
(1 个事件)
| domain | icanhazip.com |
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\vadftol.exe |
网络通信
与未执行 DNS 查询的主机进行通信
(3 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
| host | 66.215.30.118 | |||
在用户文件夹中创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\vadftol.exe |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 66.215.30.118:443 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-04-06 22:23:41
PE Imphash
9f4c6542128fba942a3b092c3a5337cf
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .MPRESS1 | 0x00001000 | 0x00015000 | 0x00012a00 | 4.328828745705522 |
| .MPRESS2 | 0x00016000 | 0x00001000 | 0x00000e00 | 5.911928312189219 |
| .rsrc | 0x00017000 | 0x00005000 | 0x00004800 | 5.110486608201651 |
| .imports | 0x0001c000 | 0x00001000 | 0x00000800 | 4.107418970266605 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_CURSOR | 0x00013828 | 0x00000134 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_CURSOR | 0x00013828 | 0x00000134 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_BITMAP | 0x0000f3e8 | 0x000000b0 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_BITMAP | 0x0000f3e8 | 0x000000b0 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_ICON | 0x00017168 | 0x00004228 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_DIALOG | 0x0000f2a0 | 0x00000062 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_CURSOR | 0x00013960 | 0x00000014 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_GROUP_CURSOR | 0x00013960 | 0x00000014 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_GROUP_ICON | 0x0001b480 | 0x00000014 | LANG_POLISH | SUBLANG_DEFAULT | None |
| RT_MANIFEST | 0x0001b4d4 | 0x00000152 | LANG_POLISH | SUBLANG_DEFAULT | None |
Imports
Library USER32.dll:
• 0x40812c EndDialog
• 0x408130 SetWindowTextW
• 0x408134 SendMessageW
• 0x408138 DestroyWindow
• 0x40813c DialogBoxParamW
• 0x408140 DefWindowProcW
• 0x408144 BeginPaint
• 0x408148 EndPaint
• 0x40814c PostQuitMessage
• 0x408150 CreateWindowExW
• 0x408154 LoadStringW
• 0x408158 LoadIconW
• 0x40815c LoadCursorW
• 0x408160 LoadAcceleratorsW
• 0x408164 RegisterClassExW
• 0x408168 GetMessageW
• 0x40816c TranslateAcceleratorW
• 0x408170 TranslateMessage
• 0x408174 DispatchMessageW
Library KERNEL32.dll:
• 0x408010 IsProcessorFeaturePresent
• 0x408014 HeapReAlloc
• 0x408018 GetStringTypeW
• 0x40801c MultiByteToWideChar
• 0x408020 LCMapStringW
• 0x408024 HeapSize
• 0x408028 RtlUnwind
• 0x40802c IsValidCodePage
• 0x408030 GetOEMCP
• 0x408034 GetACP
• 0x408038 GetCPInfo
• 0x40803c GetCurrentProcess
• 0x408040 TerminateProcess
• 0x408044 IsDebuggerPresent
• 0x408048 UnhandledExceptionFilter
• 0x40804c ReleaseMutex
• 0x408050 CreateMutexW
• 0x408054 TerminateThread
• 0x408058 CreateThread
• 0x40805c WaitForSingleObject
• 0x408060 GlobalAlloc
• 0x408064 FindNextFileW
• 0x408068 Sleep
• 0x40806c CreateDirectoryW
• 0x408070 FindFirstFileW
• 0x408074 FindClose
• 0x408078 LoadLibraryA
• 0x40807c GetModuleHandleW
• 0x408080 lstrlenW
• 0x408084 lstrcpynW
• 0x408088 GetLastError
• 0x40808c LoadLibraryW
• 0x408090 GlobalSize
• 0x408094 GetModuleFileNameA
• 0x408098 GetCommandLineA
• 0x40809c HeapSetInformation
• 0x4080a0 GetStartupInfoW
• 0x4080a4 SetUnhandledExceptionFilter
• 0x4080a8 GetProcAddress
• 0x4080ac ExitProcess
• 0x4080b0 DecodePointer
• 0x4080b4 WriteFile
• 0x4080b8 GetStdHandle
• 0x4080bc GetModuleFileNameW
• 0x4080c0 FreeEnvironmentStringsW
• 0x4080c4 WideCharToMultiByte
• 0x4080c8 GetEnvironmentStringsW
• 0x4080cc SetHandleCount
• 0x4080d0 InitializeCriticalSectionAndSpinCount
• 0x4080d4 GetFileType
• 0x4080d8 DeleteCriticalSection
• 0x4080dc EncodePointer
• 0x4080e0 TlsAlloc
• 0x4080e4 TlsGetValue
• 0x4080e8 TlsSetValue
• 0x4080ec TlsFree
• 0x4080f0 InterlockedIncrement
• 0x4080f4 SetLastError
• 0x4080f8 GetCurrentThreadId
• 0x4080fc InterlockedDecrement
• 0x408100 HeapCreate
• 0x408104 QueryPerformanceCounter
• 0x408108 GetTickCount
• 0x40810c GetCurrentProcessId
• 0x408110 GetSystemTimeAsFileTime
• 0x408114 HeapFree
• 0x408118 HeapAlloc
• 0x40811c RaiseException
• 0x408120 LeaveCriticalSection
• 0x408124 EnterCriticalSection
Library GDI32.dll:
• 0x408008 TextOutW
Library COMCTL32.dll:
• 0x408000 None
L!Win32 .EXE.
.MPRESS1
.MPRESS2
.imports
mjZ!441_T&r
@P9SU)!s$S[
EF#!5$MX4M4'S]$!f<DW=SQ#TR5!55OQc
P<w]$@X"D49UA<S[5U4#SW !s$NY%DF1Dc
v45l[%Dr<oU5!s$DY
U\PD@9Jw%U4"@@
SF>e]5U[)!X$MQ
bX#iU4D45g]5HNPHF%Mu<B4<DD(bF1Dd?DG
dL$S[5R4'O]5
P<hZ5OQ
U{$NZPO@"D@ Oc
UQ>Uw>DW
PA#v4$Qg>sQ%R@PO@"D@<RQ1EXPO@"D@5Er<!}$SZ$D@ H[
i@ TQ)OR
PQQPDL
!U HW$NZzfqPNN<@
9E[#o`f
pQD5DV9
(!]1IU9
b!5:!d
*4Y-9PQ:P(DA!=B!4 44Y7#PQ,P(DK!=L!4 >4Y
P(Du!=v!4
!=`!4
P(Di!=j!4
PQtP(D
!4 f4Yi}PQ~P(D
!4 p4YsgPQ`P(D
!4 z4Y}iPQjP(D1!=2!4 D4YGSPQ\P(D;!=<!4 N4YI
6p[%PKdc
%PKd1B%9J$Dw=t
}%\@!\fe!^
B$)I4Pxe
Bz4POT
=tX/5Pr
BG}_!v
P!FHd!4SK5P!
"pAny=T}
-&qjS:Av1jIc!4RK6P!t}%2a
=t`}%.a
=TP!4}
I>!4!4
=t0HXIR/6G@6i
TSj#Ue
|rUtR)
W4PA8I
lT`CH`G
I4PBpe
)d}%Na
C!:w^@%bR=T}
N'i"""7C9oA
5;5RatS
-&"}%.a!4
,^8*"4
q^:xXa
(=TaG]}z
A>BC$P
6;(4Qa4T3
yJpHAD
"_!:w^@"mwbSw{5PGA!4
ta2"#7RE6}
jq*%N)d}%
wv THXwc}
4K0:AJ1zA
'=t$TK6}%
-^Ppb}%
q>m2h6'y*
WGAQ:A>
Sd3X=t<
bV!Id6R=t0
-^v\Q!
W<F6moaId
K#R:Ta:IPa}
d!4RK6P!t
P!FHI\;D!4:
!4`I\i
Id6S=t0
T<=7"}$gAXTk3.=^
t,EPMQUR
GHuGHHGH
Au^H9Et:YEP6e
TTEh,@
Rj jdh
Pj jdh
hRdPMQ
uPtt@u
Hu3!Eu
S^`N`H
j$Y~\d9
QY^`[_^]UU3N_N
P@u@tP
@t@ttP@@@ut
=Mu^FF#
NMIIII
P@utuu
PuuPtuu
RPPuVF8%
uUEPSS}
=?sJMsB
Y;t)UEP
v_utPPuP
uu@@tt
uuu@@uP
PPPP@u
@UHS3VWSSSE]]]]]]
u@uu@t
P@tuPt
JFFRXu
-^PvPYu
Qw/Q\kx
tPPutt
YY]jXh
8csmu*x
YYuTVWh|@@
3]j hH@
3PPPPPe
@Y<v*V
^SSSSSyj
;tFtA3
VW39=@
t.t$<"u
t?VSPv#
3Y[_^5$@
3PPPPP
FA>\t>"u&
3wf93t
f90uW=
VVV+V@PSVVE
E;t8P!
YE;t*VVuPuSVV
j@j ^Vp!
H3H/5@
;rSWf9M
YYt:V5
YF\=(@
~lt#W}
43_V5@
YYt0V5
1E3PeuEEEEd
Y__^[]Q
E_^[]E
9csmu)=@
E3E3;u
UQSV5@
;r>Pu(
woVW=@
F$|3@_^
Y+t"+t
+tY+uC}
Uw\]Yp
u>OdMGd
u wdSUY
ffffffE
YM_3[,
3PPPPP
B(;r3_^[]
1E3PEd
tAt2t$
3M_^3[
ft'Ou"+
jPfDJXdf
WPWPWv
whu;5 @
8]tEMap<u
TM_^3[j
PY^hS=@
YYu,9E
3W;to=@
oYY~PE
PJY9_t
uV$Y_^[]
t4V0;t(W8jYt
Fpt"~l
j JYNj
lVYYYEE
YuSVWT$
URPQQh
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
DDDDDDDDDDDDDD
S3VW;~ E
@;u+H;}
39](SSu
]9]tWuu
};~Bj3X
3;t?uWuuu
t"SS9] u
EWYuwEYe_^[M3
Mu(Eu$u u
ES3VW]9]
39] SSu
ESJEYe_^[M3
uY3MW0u
6v v$v(v,v0~v4vv
nv8fv<^@v@SvDKvHCvL;vP3vT+vX#v\
vlvpvtvxv|@
P6YF0;
P$Yv4;5@
PnYF<;
P\YF@;
PJYFD;
P8YFH;
P&YvL;5@
Y^]USVWUj
P(RP$R
UPjht@
t:|$,t
;t$,v-4v
UQPXY]Y[
FGIuX^_]
KuZUVD$
UV3PPPPPPPPU
$s ^UV3PPPPPPPPU
$sF ^UWVSM
[^_%(@
USER32.dll
EndDialog
SetWindowTextW
SendMessageW
DestroyWindow
DialogBoxParamW
DefWindowProcW
BeginPaint
EndPaint
PostQuitMessage
CreateWindowExW
LoadStringW
LoadIconW
LoadCursorW
LoadAcceleratorsW
RegisterClassExW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
KERNEL32.dll
IsProcessorFeaturePresent
HeapReAlloc
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapSize
RtlUnwind
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
ReleaseMutex
CreateMutexW
TerminateThread
CreateThread
WaitForSingleObject
GlobalAlloc
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
LoadLibraryA
GetModuleHandleW
lstrlenW
lstrcpynW
GetLastError
LoadLibraryW
GlobalSize
GetModuleFileNameA
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetProcAddress
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
RaiseException
LeaveCriticalSection
EnterCriticalSection
GDI32.dll
TextOutW
COMCTL32.dll
!3#-=9
;*#681
".7")
=-5"13"(
/2*1,!0
/6)<2/=
#.-+$,<.
&1.*8.<
:*;($+
#=;+$0
+'!1-#
;<;3/:
47+;,3
<88"):
bad allocation
CorExitProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
Unknown exception
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVtype_info@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
www30www
xwwwwwxwwwwrwwwwww
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
USER32.dll
EndPaint
GDI32.dll
TextOutW
COMCTL32.dll
lQ+QQQf
UWVS|$
t$dD$\
T$L3;\$L
t$t#t$lD$`T$x
D$t#D$hl$x
D$t+D$\$
D$@d$@L$@
;s#D$H
t".)D$H+r
)D$H+r
L$H+t$`+
T$8L$PL$xf
D$\l$TD$X3|$`
D$`L$D
;s`)L$4|$4
t$4D$H|$t
D$`D$t+D$\
l$8f++
D$T&++f
T$TD$PT$PL$XL$Tl$\D$\l$X3|$`
;s/D$H
;s;D$H
)D$H+f
t$(Nt$(uL$0
T$,|$`
)D$H+f
l$$Ml$$uP
)D$H+f
$L$ d$
p4$Ft$\tZL$
9l$\w`$
BD$tIt
|[^_]W@
7Ajv*)
5CMR15
chyemwlv{ip}lohihjkmkp}isxjvxit{jo
jmhilpkp~kp}kq~kp~lslqmq
lrlqlr
orlkml
~||xvvwuuxutvtt|zz
xvvqookiikiijjiiggzww
qooeccfecwuu
|}wv..
""* ' ' ' '
% 026(/
lt + (!-!/ '!' ' '!' ' ' )
"!* * *!+ ) %
(", * + * *!* *!+!*
# &!, * *"* *!*
"- *"+ * *"+ * + * (!+
##!'","+!*!+"*
(!(#(
!*"*!*!+!*!*"+!*"- *
&"#*$.#*!)#*!) %$0
!Yd^hZZ[T+*
'!(FM^h\^^`22 &!- '
^h]gbi`ebeBI
#!)"*!)#*!)!)"*!)"+!,
(&%*&.#+")#+")#*'2!) & &&0%*&0",)1%-'1#,!)"- &!*$2(2"))3"*#+#.$.(1%.")$*")"+")")"+")#+")
'$%*&2#*"(")"(%.'.#("%,9,9&0(2%+"'!'(1.;,9+7)5$, "!'%-'0.;)0)2'0%,&-%+$*$*%+$*$*%+$*&-$,
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>
USER32.dll
EndDialog
SetWindowTextW
SendMessageW
DestroyWindow
DialogBoxParamW
DefWindowProcW
BeginPaint
EndPaint
PostQuitMessage
CreateWindowExW
LoadStringW
LoadIconW
LoadCursorW
LoadAcceleratorsW
RegisterClassExW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
KERNEL32.dll
IsProcessorFeaturePresent
HeapReAlloc
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapSize
RtlUnwind
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
ReleaseMutex
CreateMutexW
TerminateThread
CreateThread
WaitForSingleObject
GlobalAlloc
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
LoadLibraryA
GetModuleHandleW
lstrlenW
lstrcpynW
GetLastError
LoadLibraryW
GlobalSize
GetModuleFileNameA
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetProcAddress
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
RaiseException
LeaveCriticalSection
EnterCriticalSection
GDI32.dll
TextOutW
COMCTL32.dll
! H o k e u j
t h i n k p r o b a b l y i t w a s q u i t e a n a t t r a c t i v e
a r d l y t h o u g h t o f i t s i n c e t h e n - t h a t h e h a d a c h a r m
a r d l y t h o u g h t o f i t s i n c e t h e n - t h a t h e h a d a c h a r m
m s c o r e e . d l l
r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
@ M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
K E R N E L 3 2 . D L L
W U S E R 3 2 . D L L
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
( ( ( ( ( H
h ( ( ( ( H
H
@ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @
K i l i m a n m e n
H o r a p p l i s t
r i c h e d 3 2 . d l l
B i s a n o l e d M a x e k
b u t t o n
r i c h e d i t
@ @ @ @ @ @ @ @ @ @ @ @ @ @
Z i m b a n d a
M S S a n s S e r i f
C : \ F M 3 7 x r 6 F . e x e
C : \ C O E g B M U w . e x e
C : \ c N H a P w X J . e x e
C : \ 9 7 1 2 5 8 8 0 0 f 5 5 b 5 7 7 5 9 b 3 c 6 9 c 8 0 5 1 2 7 7 8 5 f c f 9 f d 5 . e x e
C : \ 3 b 4 2 1 c 6 a 7 2 7 2 c 6 2 b c c f 3 b e 2 7 1 9 4 a 3 e f e 8 8 5 c 6 e 8 2 . e x e
C : \ O K A U k O g v . e x e
C : \ d 9 4 P c d Y C . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 2 3 e 2 a 1 6 f 4 5 e 5 2 8 9 c b c c 0 9 7 2 d 4 2 6 d 6 e b 2 1 d 0 7 0 5 2 9 e 2 0 c 8 d 4 7 9 c 1 2 c 6 1 8 4 c f b 9 9 6 2 . e x e
C : \ 5 f a 8 4 8 d c 5 0 0 0 1 a 2 9 7 6 b 5 a 1 2 e b 2 a 3 1 3 f a a 0 8 8 b 1 5 3 3 2 4 e 8 d 7 3 d 0 9 2 e 5 c 9 a 4 0 a 0 e b e
C : \ 7 c 1 f d 7 d 8 f 5 1 f 7 8 c 7 c f 7 3 f 7 c b 8 8 b 7 0 e 9 f 7 2 9 a 9 c 6 8 5 d 5 6 0 2 5 5 a 7 f b 8 e f 5 8 5 6 a b b 5 2
C : \ 7 d f a 2 2 9 8 5 4 d 4 5 1 d 7 2 0 2 c d 2 4 6 7 3 3 c 4 0 d 5 8 8 6 e 7 b 1 2 d d 3 f c d 3 d f c c d 4 0 3 e 9 6 1 f b 0 f 5
C : \ U s e r s \ L i s a \ D e s k t o p \ E E s T t t M O . e x e
C : \ g j S n u _ W 4 . e x e
C : \ b 8 9 e 9 2 5 a b e 4 3 2 c 9 0 b d a 1 a 2 6 5 c c f 5 6 c 3 0 5 b d a b 2 1 3 a e 9 4 8 6 a 1 e 9 e 4 1 e c 7 a 6 8 5 b 2 2 d
C : \ U s e r s \ L i s a \ D e s k t o p \ x I w Y q 2 f 4 . e x e
C : \ K z 4 K j n I T . e x e
C : \ a d 2 3 1 4 e 7 6 c a 1 1 0 a 3 8 2 c 3 7 c 5 7 a c 1 d 2 b b d b 0 d a 8 7 8 f 5 5 0 0 c 5 a e f c 5 b 1 c 8 0 2 9 6 d c e a 2
C : \ e 8 6 9 8 d 3 0 e 4 2 8 0 d d 3 6 f 7 2 1 e e 0 c e 1 1 e e 8 0 0 b 7 c 7 d c 1 3 b 9 7 4 b 2 4 e 8 6 1 4 b f 0 2 a 6 6 7 6 7 9
C : \ 1 5 1 9 c 9 c 1 c 7 6 4 d 7 1 8 4 1 a 5 c 8 5 0 5 5 7 6 1 c 1 6 0 0 8 1 c f a 5 0 f 5 2 0 3 6 6 b f 5 2 3 3 0 6 6 b 0 e 9 9 a 1
C : \ U s e r s \ L i s a \ D e s k t o p \ j Q n k 4 v H g . e x e
C : \ N X h c M 9 s p . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 7 A D O g 8 Y c . e x e
C : \ 5 d 5 c 7 5 4 3 2 4 e 5 a 7 6 9 1 1 9 e d 1 0 4 d 0 6 1 7 3 0 7 e 4 d f 4 1 a 4 a e b 7 6 3 7 e 3 b 5 1 9 b 6 8 a 3 f 7 5 9 6 b
C : \ U s e r s \ L i s a \ D e s k t o p \ o Q t V z f h 4 . e x e
C : \ B W s D w o H 8 . e x e
C : \ 4 c d 0 c a 5 a 2 c 8 a a 4 d 9 8 8 6 8 6 7 8 8 a b 8 6 2 2 e 7 2 3 f b 1 0 1 a 9 5 9 b 3 a e b 2 1 e 7 4 e c 8 3 7 4 4 c 2 e b
C : \ U s e r s \ L i s a \ D e s k t o p \ j y f m j J f 2 . e x e
C : \ 6 f q r z B R B . e x e
C : \ c 1 6 a b 7 b 6 3 0 6 8 1 f f a 4 c f 8 3 8 9 6 d 7 6 4 6 9 7 9 7 0 5 b c 0 e 6 d 5 8 2 c 0 d 3 4 4 3 f 9 6 6 1 0 0 b 5 f 6 5 6
C : \ U s e r s \ L i s a \ D e s k t o p \ C u x q Y y J Z . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 9 c 3 0 6 5 e 3 c f 8 a 4 8 e 0 9 4 6 2 d 7 8 a 6 6 7 b e 4 7 1 b 8 0 5 6 1 9 3 3 7 1 c 9 8 d 0 4 2 1 1 6 1 6 4 a 1 4 9 f 8 a d . e x e
C : \ 3 2 7 1 0 e 7 a e 1 9 2 d 1 1 4 4 0 8 6 5 2 b 8 b 6 4 b 0 7 f c 2 f f 8 c d 6 7 8 8 6 5 5 2 8 7 0 1 6 3 1 9 e a e 3 c 2 f 4 b 8
C : \ x 3 y D g t M H . e x e
C : \ d 0 8 1 0 1 b 5 e 9 f 6 6 3 6 d 5 8 e c e 0 a 9 8 8 f e 5 c e e b 1 7 2 9 6 5 6 3 5 2 8 6 5 a b 9 c 3 f 8 a 2 e 7 9 e b 5 5 0 5
C : \ U s e r s \ L i s a \ D e s k t o p \ x v q P Q P v Z . e x e
C : \ 4 0 9 0 2 8 2 d 9 a 9 4 0 9 a f d d 3 3 3 4 9 0 9 3 5 6 2 d d 9 8 7 2 a b 4 d c c 0 a f 3 f 9 3 d 2 8 1 e e c 2 a 1 7 7 9 b d 4
C : \ 6 f b 8 3 7 c 3 5 d 5 2 8 5 f 6 2 2 0 4 d 1 e c 5 d 4 8 2 6 4 c 8 6 c 7 3 f 1 f d 3 2 3 d 7 a 4 b c 4 e e 5 1 e 0 8 a 2 d 9 b d
C : \ U s e r s \ L i s a \ D e s k t o p \ n y K 9 n y y o . e x e
C : \ 4 e 5 6 7 2 f 4 8 4 5 9 1 5 1 e 8 1 2 f 0 1 b 3 6 d 5 a 7 4 f 5 9 5 c 2 b 2 e 4 e a e 5 9 2 d 4 1 d 9 4 a 3 1 b 5 3 7 4 6 e 7 d
C : \ C H b 5 j f U a . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ S Y n M J z P 2 . e x e
C : \ G J 5 W r n N L . e x e
C : \ 4 6 9 9 0 5 8 f 5 9 f 4 b f 0 0 a 9 f 0 e 5 a 0 0 1 e 2 7 2 3 2 e 7 7 6 d a 2 f f b 4 4 f c c b 9 1 a 7 d 8 5 1 3 2 a 7 6 5 a f
C : \ i O j C U L B l . e x e
C : \ 9 2 b 1 2 1 c 0 7 0 5 5 0 5 f 3 6 0 a 4 2 1 c 9 c e 0 1 5 6 8 7 8 3 7 a b 5 0 8 c 3 8 a d d d c 4 7 9 7 6 1 a 6 5 0 b 7 3 9 5 f
C : \ 9 f 2 4 0 3 e 1 a a f f b b 5 7 1 6 2 0 7 1 d 1 2 c 9 2 0 2 b 6 d 6 6 a a 7 a f d c f 4 5 b 6 a 1 5 5 6 e f 1 6 b 8 5 c 6 a 5 2
C : \ d Y P 1 s C 2 v . e x e
C : \ 3 d 2 0 e b 7 3 8 d 1 8 6 3 c f e 8 7 b 7 f 1 f 2 4 3 3 d c e d a 1 1 6 6 4 6 a b 8 9 1 e 2 4 b f 2 9 7 5 1 a e 3 a 1 8 2 f 0 b
C : \ 8 5 5 3 8 b e 1 7 9 a 7 2 e e 9 1 b 7 6 d 9 7 5 d 0 b 1 6 d 8 9 9 d 3 5 7 a 1 7 7 f 6 3 0 0 f b 0 5 3 8 5 5 1 6 e 1 6 1 f 3 8 c
C : \ c b c e 7 b e 8 7 4 a f 0 4 b 6 e a 2 d 0 5 3 a 0 0 7 a d 1 4 2 4 7 1 b 0 c f e c e 3 5 2 c c 0 9 4 2 e 3 7 2 5 4 e 0 d 2 8 f 4
C : \ U s e r s \ L i s a \ D e s k t o p \ S W q i M z 8 k . e x e
C : \ 6 f d c f c e e 8 1 7 8 7 2 9 2 f 2 0 a a c f 0 3 4 8 7 b 2 0 7 4 d 1 6 e d 6 0 c 3 f 3 c 7 9 a b 6 7 2 5 9 8 3 a 9 e f e 1 a d
C : \ 4 a e b a 6 1 0 2 8 1 d 1 0 f e 9 2 a a 7 9 6 9 0 d c 0 c b 9 8 9 c c 6 a f 5 f 3 f 0 f 0 8 c d 7 4 d 7 e 7 a 0 8 f 5 d a 4 4 5
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 1 8 b 1 b d 8 4 a d f f f 0 9 9 2 b 6 6 4 e 4 a 9 b 5 5 4 b 8 9 7 2 1 f 3 b 9 0 0 4 a 5 6 5 3 9 d 2 a 2 b 5 3 2 d f 2 f 0 1 2 6 . e x e
C : \ 0 a 5 3 5 c 7 e 8 8 9 a 3 0 c c 5 a 6 b 6 5 c c 0 0 3 9 1 e 9 6 b 0 e 1 2 2 5 9 c e 5 0 5 e 1 5 8 e d 7 a f 4 0 a 5 c 0 6 7 4 0
C : \ 9 7 c 7 c d 8 1 d 8 b 1 a 4 d b d 1 7 f 8 b e 9 a 0 9 0 7 5 e 5 1 3 5 b a 5 d 3 d 9 f 8 0 8 4 9 b f 6 6 9 0 7 0 5 5 5 1 3 9 7 8
C : \ U s e r s \ L i s a \ D e s k t o p \ s 7 d n X o p h . e x e
C : \ n X x w J Q S i . e x e
C : \ 7 5 9 8 1 4 a 7 0 b 4 7 3 e 2 0 5 3 3 9 f 5 a 7 d 8 8 b 9 c 8 5 8 8 4 8 9 6 5 1 f 7 5 a e a 4 0 d d d 7 f d 6 b 0 6 9 9 b 2 c 2
C : \ f 9 3 0 0 a 8 c d a 0 3 d 3 2 3 2 7 b 7 0 d e 3 7 6 9 5 7 6 b 2 2 2 7 0 4 8 b 6 0 a b 2 7 5 4 2 5 7 5 1 1 6 1 6 0 9 5 c a 0 7 9
C : \ f L k x 3 I A n . e x e
C : \ W I N D O W S \ s y s t e m 3 2 \ a 6 4 3 7 d e f 0 0 2 6 f 4 b 4 3 a 4 f e 1 6 3 6 d a 1 6 b d 9 a 5 7 4 6 d 6 5 a 3 b 4 0 1 2 8 e 5 e f e f 7 9 2 5 d 3 0 d e 8 . e x e
C : \ 5 1 e c 1 7 8 a 8 5 6 d 2 d 9 b 9 c e a f d 8 e f f 9 1 4 3 f 6 5 4 4 f c d 5 f a 2 4 2 a 2 1 c 1 8 c e a 5 e 7 5 5 9 4 5 1 4 4
C : \ U s e r s \ L i s a \ D e s k t o p \ H K d J f H 7 X . e x e
C : \ r e 9 s x E 1 l . e x e
C : \ 3 0 3 0 9 c 9 3 3 c b f 2 7 3 5 8 7 c 2 e 6 4 3 8 6 5 2 d 1 d 2 b 8 3 7 3 7 1 d c 7 a 8 c 1 a e a c d 7 9 0 3 e f 1 f 9 3 f 0 b
C : \ F N 2 K 7 z Y D . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ A I F D e J Z g . e x e
C : \ 4 0 2 8 8 a 8 1 f 8 6 b 5 3 e 2 0 e c e f c e 8 5 5 3 6 b 9 9 f 4 d 7 e 6 e a 6 1 9 9 a 2 2 4 f 7 a 5 9 6 4 2 8 0 a b 9 b f 1 6
C : \ 5 8 9 9 6 c 1 f 1 4 3 6 3 9 e c e 2 c e c 0 d 4 e b d 7 a 3 e 8 c 6 8 5 a 0 4 a 0 7 4 4 8 2 8 4 2 1 2 2 8 b d 1 0 7 a a 4 d 7 4
C : \ j 1 p q r D v C . e x e
C : \ 0 e c 0 6 1 6 4 3 5 1 f 8 e b 7 4 4 c 3 5 5 8 a f 7 f 8 7 9 a 5 4 4 9 c a 2 8 2 a f 9 e 9 0 a 3 1 2 3 4 e a 3 a e d 3 8 1 b b e
C : \ 7 6 b e 5 3 2 5 2 f c 1 c a c 5 6 3 a d 9 a 2 9 a 5 6 6 3 f b a c 8 4 1 5 d a 5 8 c a 7 6 1 1 4 2 4 3 6 a d 6 8 d 9 b 9 a 8 d 4
C : \ U s e r s \ L i s a \ D e s k t o p \ j T l b f T c E . e x e
C : \ D N C U b 8 Y N . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ r 5 c a d 3 t L . e x e
C : \ K f J 7 1 a 9 4 . e x e
C : \ a b c 3 b 6 7 5 9 0 3 f 8 d b b 8 3 c 4 e 7 8 0 9 b f c 8 a a b b 6 8 7 a 1 5 6 e 9 c 7 1 6 8 6 2 d d c 5 7 f 1 a 5 3 3 c 8 4 1
C : \ 1 c c e b b 5 a 6 0 3 8 1 a b 8 f f 6 1 e a 8 c d 7 0 2 d 3 c a f d f d 4 9 c 1 4 2 7 1 d e 8 8 7 1 0 f 2 b 0 b 4 4 6 d 0 6 c 3
C : \ 7 5 3 1 c d 8 4 9 1 a 2 6 1 d f b 4 4 f e 0 d a e 6 2 0 f c 4 3 b f c 0 2 4 b c 7 3 b 0 7 5 c 5 6 8 6 3 d a b c e 5 c a 1 d 1 9
C : \ 8 b 3 4 f 9 6 d b e 5 7 6 f 9 0 f 9 6 5 a c 3 7 8 2 3 b 7 0 6 c a d a 9 7 2 7 9 9 e 7 d 7 f 5 a 8 7 3 5 2 a e 3 2 e a 6 4 6 2 3
C : \ w D r C X Q V C . e x e
C : \ a d 9 d 7 5 1 d 0 4 0 a 5 b f 2 d a c 0 b 0 f 7 1 6 b 5 2 6 d f 2 2 a 7 f 0 6 7 6 5 1 2 3 5 f b 4 8 4 b e b b 1 0 8 f 1 4 f 9 8
C : \ 3 2 8 1 3 e e e a 6 1 3 8 e 1 1 d f 6 b 9 c e 4 9 b 4 2 9 6 5 e 4 6 d d e 1 1 6 f 1 b 8 6 1 b 9 e 2 c a c a 0 6 5 6 0 9 b d d b
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 3 e 4 6 9 3 0 b d 8 4 1 7 0 e 3 1 2 5 5 1 d e 0 e c a 1 4 b 9 b d c 8 9 0 a 3 3 9 2 d 1 1 4 c 0 8 6 5 0 0 a e d f d d f e d 8 0 . e x e
C : \ 3 8 t t _ 4 e E . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ W k M n W F 3 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ f 8 8 d e 9 d a a 2 8 c e d 4 0 0 d 3 4 7 5 f d 7 8 b f 8 c 7 5 2 c f 6 5 b c b e c 8 a 0 4 9 d f e a 7 f 4 d 3 a 3 0 7 0 7 e 7
C : \ U s e r s \ L i s a \ D e s k t o p \ V R g f n q f m . e x e
C : \ 7 0 f 2 5 f e 9 5 9 e d 1 9 5 4 2 e f 6 2 e 1 d 9 4 5 1 4 7 5 d 7 1 c 2 e 7 6 d 0 b 1 3 5 4 f e 3 c a 5 9 f 0 0 d 5 3 7 0 2 c 0
C : \ U s e r s \ L i s a \ D e s k t o p \ G s J a K 9 W a . e x e
C : \ C 8 j J j F J z . e x e
C : \ 0 2 a b 3 0 f 6 4 3 9 3 3 5 6 d c 8 f 8 0 7 8 8 1 6 c b f b d d a b 6 7 f 7 0 b 3 1 1 a 2 0 3 5 a 4 4 f e 2 7 1 d 8 2 a a 7 a 3
C : \ U s e r s \ L i s a \ D e s k t o p \ T f T c F 2 r M . e x e
C : \ M C O v M m t _ . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ f c 8 b f d 4 4 2 0 3 c 8 a 2 0 5 e 8 9 3 f 7 0 6 2 0 9 6 1 8 8 4 d 8 e 6 8 e d 5 e d 3 1 8 7 0 1 3 b d 6 6 5 6 5 3 4 e c 0 d 6
C : \ 2 3 3 3 2 6 9 f 6 0 7 2 e c f 4 a 5 c e 8 e 8 6 f 6 b a c 0 6 c 0 8 6 c 4 c 4 c 1 f d 0 7 f 1 7 a 9 d 1 2 1 1 8 4 2 c 6 9 e 4 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 6 b 6 4 c 1 7 6 a 8 e d 7 e 9 5 9 c 2 c a 8 8 a 2 0 7 e 6 e 2 6 c d d a c 0 a e a 6 2 3 b 4 a 1 0 d 2 e 8 b d f 4 d 0 9 b 0 3 0
C : \ K r 6 1 2 V p x . e x e
C : \ 8 6 9 6 1 7 8 8 a f 9 2 f 1 2 0 5 e 6 4 7 9 f 7 3 5 e b 5 7 2 c 3 d e e 4 2 f 1 5 7 1 d 1 0 6 a d b 8 1 7 a 5 b 9 f a c f d 6 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ l D I n u n Z 2 . e x e
C : \ l J t 9 3 v Q B . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ w i 8 R I R A D . e x e
C : \ _ B n V A A r I . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 9 9 9 b b 9 3 2 1 d 8 5 e b 0 5 c f d e a c 0 f 2 4 e 8 0 1 4 2 c a e 9 1 d 5 0 3 0 4 4 4 6 1 0 f 2 e 1 a 9 3 1 c 6 2 d c 7 e 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ a 3 d 8 b 9 3 8 9 1 9 9 4 0 a 1 7 5 b 8 d 2 9 6 c a 2 0 b 0 2 4 6 8 5 e 1 6 e 0 b c 3 3 1 2 5 b 2 5 7 0 9 c f 4 5 8 1 d b 1 4 f
C : \ f r 7 l U s 9 N . e x e
C : \ d 2 1 e 1 a c 2 f 2 9 2 e e c 6 e 1 e 3 f 2 c 2 d 2 b 0 1 a b 8 c 8 d d b a a 9 f 1 7 e b 4 a c a 0 4 6 e 2 b 5 6 d 8 b b b 1 7
Process Tree
-
027455aa2a28af65063631bb5a79ae4d21c083f6808c561453ad540562065fcd.exe (2336)
"C:\Users\Administrator\AppData\Local\Temp\027455aa2a28af65063631bb5a79ae4d21c083f6808c561453ad540562065fcd.exe"
- vadftol.exe (600) C:\Users\ADMINI~1\AppData\Local\Temp\vadftol.exe
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| icanhazip.com |
A 104.16.184.241
A 104.16.185.241 |
104.16.185.241 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49164 | 104.16.184.241 icanhazip.com | 80 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 3e14a033e2145f8f_vadftol.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\vadftol.exe |
| Size | 109.3KB |
| Processes | 2336 (027455aa2a28af65063631bb5a79ae4d21c083f6808c561453ad540562065fcd.exe) |
| Type | MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS |
| MD5 | 404455b11f2638c4ce26c0d6965f5029 |
| SHA1 | e3aef158945b53603deebf60f930d26e361a68e7 |
| SHA256 | 3e14a033e2145f8fcbde150a08926ee023014cab95975e43592d2194fde8b5fe |
| CRC32 | 9A842E3B |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.