1.0
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.49
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200501 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200503 | 2013.8.14.323 |
| McAfee | Downloader-FWF!7D0F82C7839A | 20200503 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b59472 | 20200503 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | idata |
| section | pdata |
| section | xdata |
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意
(50 out of 61 个事件)
| ALYac | Trojan.GenericKD.1395615 |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1395615 |
| AhnLab-V3 | HEUR/Fakon.apf.X1353 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Generic.D154B9F |
| Avast | Win32:Malware-gen |
| Avira | TR/Crypt.XPACK.Gen3 |
| BitDefender | Trojan.GenericKD.1395615 |
| BitDefenderTheta | Gen:NN.ZexaF.34108.gCZ@aG7cxsci |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | TrojanPWS.Zbot.Gen |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.Injector.KXE@5415yx |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.7839a0 |
| Cylance | Unsafe |
| Cyren | W32/Trojan.SHKH-0622 |
| DrWeb | Trojan.DownLoad.64691 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.GenericKD.1395615 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.GLR |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen3 |
| FireEye | Generic.mg.7d0f82c7839a0697 |
| Fortinet | W32/Small.ABS!tr |
| GData | Trojan.GenericKD.1395615 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Bublik.gff |
| K7AntiVirus | Trojan ( 0001140e1 ) |
| K7GW | Trojan ( 0001140e1 ) |
| Kaspersky | Trojan.Win32.Bublik.bkgg |
| MAX | malware (ai score=84) |
| Malwarebytes | Trojan.Email |
| MaxSecure | Trojan.Malware.121218.susgen |
| McAfee | Downloader-FWF!7D0F82C7839A |
| McAfee-GW-Edition | BehavesLike.Win32.Sivis.nt |
| MicroWorld-eScan | Trojan.GenericKD.1395615 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.Bublik.cocjal |
| Panda | Trj/Zbot.M |
| Qihoo-360 | HEUR/QVM20.1.F8BC.Malware.Gen |
| Rising | Downloader.Small!8.B41 (TFE:dGZlOgJ7lvWZ5RsfNA) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-AERJ |
| Symantec | Trojan.Gen |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-11-12 14:13:45
PE Imphash
1355c8b0fadb1935e414f47fa976fffa
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00002016 | 0x00002200 | 6.4469927459582825 |
| .rdata | 0x00004000 | 0x0000035c | 0x00000400 | 4.365743423683014 |
| .data | 0x00005000 | 0x00000430 | 0x00000600 | 4.739945098226479 |
| idata | 0x00006000 | 0x00000358 | 0x00000400 | 3.5468724718567737 |
| pdata | 0x00007000 | 0x000000dc | 0x00000200 | 0.0 |
| xdata | 0x00008000 | 0x000004ee | 0x00000600 | 5.495730287182584 |
| .rsrc | 0x00009000 | 0x00002990 | 0x00002a00 | 4.681513805480964 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000090ec | 0x00002734 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000b820 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x0000b834 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.dll:
• 0x504008 GetCurrentProcess
• 0x50400c GetLastError
• 0x504010 GetLocalTime
• 0x504014 GetModuleHandleW
• 0x504018 FormatMessageW
• 0x50401c HeapAlloc
• 0x504020 HeapFree
• 0x504024 lstrcmpW
• 0x504028 lstrlenW
• 0x50402c GetProcessHeap
• 0x504030 ExitProcess
Library USER32.dll:
• 0x504038 DefWindowProcW
• 0x50403c CreateWindowExW
• 0x504040 EndPaint
• 0x504044 GetMessageW
• 0x504048 GetSystemMetrics
• 0x50404c GetWindowTextW
• 0x504050 MessageBoxW
• 0x504054 PostQuitMessage
• 0x504058 RegisterClassExW
• 0x50405c SetCursor
• 0x504060 SetWindowTextW
• 0x504064 ShowWindow
• 0x504068 TranslateMessage
• 0x50406c BeginPaint
• 0x504070 DispatchMessageW
Library GDI32.dll:
• 0x504000 TextOutW
L!This program cannot be run in DOS mode.
*%y%y%yy!y%yy
y$yRich%y
`.rdata
@.data
#U-,TP
Uuv3#;
UR$-u|v5
#32h P
3;_\_M
PUWSV5
zVZ3@P
cJUbjj
`UQn`] M
U5EUUM
EEUWSVM
U?@>??>PRQE5
UVSWt$
UUQUUQI
SZyWZ]
+H;ub#
WWRRRRh
SY5+hP
s#JMpod<t
WSV0EU]
n5E#0h
Pd"UAE3
MU~235P
E+33EMMEMME
&3RRVD
}AEUv\gE
UM.3 K
sEnPE&
egQHJP
jjA MPjUA
_oMUA5
xOMxUU
R(vMMU
qAYBA3!q8A
UUpkAxv
UjbAE\n$
EE;L"E
QU4.?E
U~j{EM
EVWE@3
jPMj)IU
UU$6F{EUXm
y1MKQMQ
`TQM.[
Y\UyU3 AAQ;n
UEQ|AUE
DAEE$'ME
ABOQZUE
]UMUP4&AU4:hMM5=8
PI<9QU0X
oj_4jMX
$MUAN=PAx
LP. |Qj~gMMUU
Y^QMPjlQBMU~U
ExitProcess
FormatMessageW
GetCurrentProcess
GetLastError
GetLocalTime
GetModuleHandleW
GetProcessHeap
HeapAlloc
HeapFree
lstrcmpW
lstrlenW
KERNEL32.dll
BeginPaint
CreateWindowExW
DefWindowProcW
DispatchMessageW
EndPaint
GetMessageW
GetSystemMetrics
GetWindowTextW
MessageBoxW
PostQuitMessage
RegisterClassExW
SetCursor
SetWindowTextW
ShowWindow
TranslateMessage
USER32.dll
TextOutW
GDI32.dll
p@M#[E
!dEYQd.
U+AJAU
PME.BQM
MUgeEUhF(,
kujFXAYm&
heDU5("Mj
QE %0P
\QEjAs#A
M^q$kjj
unARf|UUMs =UAU
1jj)UQ
'VEEUP
PMUAE@
M3-JUE
EEEElJBU
EnjM~rgL
(QUEz3A.
EAsnEM
P&[yEjEM{jM@\EjC
E$%M}_
smKAQU4lPU
yCU6nB@
V;GJ:P
EAjV'U/6
U&mzJj4~U
YEAG*hEA
8|MPSS
UMJ\fyp
xxxyyy
- - - - - - - - - F:- - SH- - - - - - - - - - - - *
. . . . . . . . F:. F:. . ,
- . . . . . . . ,
. 0!0!0!0!0!0!0!0!~t0!WK0!0!dX0!0!0!0!0!0!0!.
0!1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"0!
2#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#2#
4$I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;4$
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGE
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Error: %s
Failed to create secondary thread
The GLFW library is not initialized
There is no current context
Invalid argument for enum parameter
Invalid value for parameter
Out of memory
The requested client API is unavailable
The requested client API version is unavailable
A platform-specific error occurred
The requested format is unavailable
ERROR: UNKNOWN ERROR TOKEN PASSED TO glfwErrorString
Invalid window size
Invalid window hint
Full screen windows cannot be moved
Invalid window attribute
Invalid cursor mode
Invalid input mode
Invalid input mode
Invalid key
Invalid mouse button
Invalid standard cursor
Invalid joystick
Invalid joystick
Invalid joystick
Invalid joystick
Invalid time
glGetIntegerv
glGetString
glClear
glGetStringi
Entry point retrieval is broken
GL_ARB_debug_output
GL_ARB_compatibility
GL_ARB_robustness
GL_EXT_robustness
GL_KHR_context_flush_control
Failed to retrieve extension string %i
Failed to retrieve extension string
OpenGL ES-CM
OpenGL ES-CM
OpenGL ES-CL
OpenGL ES-CL
OpenGL ES
OpenGL ES
Failed to retrieve context version string
%d.%d.%d
Borland C++ - Copyright 2002 Borland
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVbad_exception@std@@
.?AVexception@std@@
.?AVtype_info@@
.?AVbad_cast@std@@
.?AVbad_typeid@std@@
.?AV__non_rtti_object@std@@
I x@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
console_exe
Retrieving module name
PYTHONSCRIPT
Could not locate script resource:
Could not
.?AVtype_info@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVerror_category@std@@
.?AV_Generic_error_H
Hfloat
double
mahalanobis
[ %10f %10f ]
[ %10f %10f ]
det(M) = %f
det(U) = %f
det(V) = %f
det(S) = %f
cyggcc_s-1.dll
__register_frame_info
cyggcj-11.dll
_Jv_RegisterClasses
__deregister_frame_info
closing %s (fd=%d)
%s==> %s <==
write error
error reading %s
%s: cannot seek to offset %s
%s: cannot seek to relative offset %s
%s: cannot seek to end-relative offset %s
standard input
valid_file_spec (f)
/usr/src/coreutils-8.15-1/src/coreutils-8.15/src/tail.c
%s has become inaccessible
%s has been replaced
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVResolverThunk@sandbox@@
.?AVService64ResolverThunk@sandbox@@
.?AVtype_info@@
.?AVbad_exception@std@@
0123456789abcdef
0123456789ABCDEF
%a %b %d %H:%M:%S %Z %Y
Runtime error at 00000000
?q<Ga7B_
|Wz6@Ek
MS Sans Serif
.?AVCComModule@ATL@@
.?AV?$CAtlModuleT@VCComModule@ATL@@@ATL@@
.?AVCAtlModule@ATL@@
.?AU_ATL_MODULE70@ATL@@
.?AVCAtlException@ATL@@
.?AVCRegObject@ATL@@
.?AUIRegistrarBase@@
.?AUIUnknown@@
.?AV_com_error@@
.?AVtype_info@@
new_graph
Agnodeinfo_t
cluster1
@Borland C++ - Copyright 1999 Inprise Corporation
Syntax: adjust filename scale
Unable to open file!
Invalid file format!
Not enough memory!
Done !
borlndmm
hrdir_b.c: LoadLibrary != mmdll borlndmm failed
borlndmm
@Borlndmm@SysGetMem$qqri
@Borlndmm@SysFreeMem$qqrpv
@Borlndmm@SysReallocMem$qqrpvi
<notype>
id->tpName
xxtype.cpp
xxtype.cpp
xxtype.cpp
tp1->tpName
xxtype.cpp
tp2->tpName
xxtype.cpp
IS_STRUC(base->tpMask)
xxtype.cpp
IS_STRUC(derv->tpMask)
xxtype.cpp
derv->tpClass.tpcFlags & CF_HAS_BASES
xxtype.cpp
((unsigned __far *)vtablePtr)[-1] == 0
xxtype.cpp
<notype>
topTypPtr != 0 && IS_STRUC(topTypPtr->tpMask)
xxtype.cpp
tgtTypPtr != 0 && IS_STRUC(tgtTypPtr->tpMask)
xxtype.cpp
srcTypPtr == 0 || IS_STRUC(srcTypPtr->tpMask)
xxtype.cpp
__isSameTypeID(srcTypPtr, tgtTypPtr) == 0
xxtype.cpp
tgtTypPtr != 0 && __isSameTypeID(topTypPtr, tgtTypPtr) == 0
xxtype.cpp
srcTypPtr
xxtype.cpp
((unsigned __far *)vtablePtr)[-1] == 0
xxtype.cpp
xxtype.cpp
Can't adjust class address (no base class entry found)
!"Can't adjust class address (no base class entry found)"
xxtype.cpp
___CPPdebugHook
Stack Overflow!
),(((((),(((
Error 0
Invalid function number
No such file or directory
Path not found
Too many open files
Permission denied
Bad file number
Memory arena trashed
Not enough memory
Invalid memory block address
Invalid environment
Invalid format
Invalid access code
Invalid data
Bad address
No such device
Attempted to remove current directory
Not same device
No more files
Invalid argument
Arg list too big
Exec format error
Cross-device link
Too many open files
No child processes
Inappropriate I/O control operation
Executable file in use
File too large
No space left on device
Illegal seek
Read-only file system
Too many links
Broken pipe
Math argument
Result too large
File already exists
Possible deadlock
Operation not permitted
No such process
Interrupted function call
Input/output error
No such device or address
Resource temporarily unavailable
Block device required
Resource busy
Not a directory
Is a directory
Directory not empty
Unknown error
(null)
0console_exe
Retrieving module name
PYTHONSCRIPT
Could not locate script resource:
Could not load s2-+
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVCAbout@@
.?AVCDialog@acWindow@@
.?AVCWindow@acWindow@@
.?AVcImage@@
.?AVCListView@acWindow@@
.?AVCStatic@acWindow@@
.?AVCStatusBar@acWindow@@
.?AVruntime_error@std@@
.?AVexception@std@@
.?AVfailure@ios_base@std@@
.?AVsystem_error@std@@
.?AVbad_cast@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_iostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV_Facet_base@std@@
.?AVfacet@locale@std@@
.?AUctype_base@std@@
.?AV?$ctype@D@std@@
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AV?$numpunct@D@std@@
.?AVCCharWin@@
.?AVCChooseFont@@
.?AVCExportDlg@@
.?AVCIconImageDlg@@
.?AVCImageMgr@@
.?AVcImageWnd@@
Application was compiled with png.h from libpng-%.20s
Application is running with png.c from libpng-%.20s
Incompatible libpng version in application and library
zlib memory error
zlib version error
Unknown zlib error
1.0.6 or earlier
Application was compiled with png.h from libpng-%.20s
Application is running with png.c from libpng-%.20s
The png struct allocated by the application for reading is too small.
The info struct allocated by application for reading is too small.
Application uses deprecated png_read_init() and should be recompiled.
zlib memory
zlib version
Unknown zlib error
Not a PNG file
PNG file corrupted by ASCII conversion
Missing IHDR before IDAT
Missing PLTE before IDAT
Missing IHDR before IDAT
Missing PLTE before IDAT
Ignoring extra png_read_update_info() call; row buffer not reallocated
Invalid attempt to read row data
Not enough image data
Extra compressed data
Decompression error
Too many IDAT's found
Too many IDAT's found
Image is too high to process with png_read_png()
MNG features are not allowed in a PNG datastream
Writing zero-length unknown chunk
Valid palette required for paletted images
Unable to write international text
No IDATs written into file
Unable to write international text
Application was compiled with png.h from libpng-%.20s
Application is running with png.c from libpng-%.20s
Incompatible libpng version in application and library
1.0.6 or earlier
Application was compiled with png.h from libpng-%.20s
Application is running with png.c from libpng-%.20s
The png struct allocated by the application for writing is too small.
The info struct allocated by the application for writing is too small.
Application uses deprecated png_write_init() and should be recompiled.
png_write_info was never called before png_write_row.
zlib error
Unknown row filter for method 0
Can't add Up filter after starting
Can't add Average filter after starting
Can't add Paeth filter after starting
Unknown custom filter method
Unknown filter heuristic method
Only compression windows <= 32k supported by PNG
Only compression windows >= 256 supported by PNG
Compression window is being reset to 512
Only compression method 8 is supported by PNG
Too many bytes for PNG signature.
Potential overflow in png_zalloc()
Unknown freer parameter in png_data_freer.
%d %s %d %02d:%02d:%02d +0000
libpng version 1.2.29 - May 8, 2008
Copyright (c) 1998-2008 Glenn Randers-Pehrson
Copyright (c) 1996-1997 Andreas Dilger
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
1.2.29
1.2.29
libpng version 1.2.29 - May 8, 2008
Invalid bit depth
Invalid color type
Invalid image width
Invalid image height
Width too large for libpng to process image data.
Ignoring attempt to set all-zero chromaticity values
Ignoring attempt to set negative chromaticity value
Ignoring attempt to set chromaticity value exceeding 21474.83
Ignoring attempt to set all-zero chromaticity values
Ignoring attempt to set negative chromaticity value
Ignoring attempt to set chromaticity value exceeding 21474.83
Limiting gamma to 21474.83
Setting gamma=0
Limiting gamma to 21474.83
Setting negative gamma to zero
Setting gamma=0
Invalid palette size, hIST allocation skipped.
Insufficient memory for hIST chunk data.
Image width or height is zero in IHDR
image size exceeds user limits in IHDR
Invalid image size in IHDR
Width is too large for libpng to process pixels
Invalid bit depth in IHDR
Invalid color type in IHDR
Invalid color type/bit depth combination in IHDR
Unknown interlace method in IHDR
Unknown compression method in IHDR
MNG features are not allowed in a PNG datastream
Unknown filter method in IHDR
Invalid filter method in IHDR
Insufficient memory for pCAL purpose.
Insufficient memory for pCAL units.
Insufficient memory for pCAL params.
Insufficient memory for pCAL parameter.
Invalid palette length
Invalid palette length
Insufficient memory to process iCCP chunk.
Insufficient memory to process iCCP profile.
Insufficient memory to store text
iTXt chunk not supported.
tRNS chunk has out-of-range samples for bit_depth
No memory for sPLT palettes.
Out of memory while processing sPLT chunk
Out of memory while processing sPLT chunk
Out of memory while processing unknown chunk.
Out of memory while processing unknown chunk.
Call to NULL read function
Read Error
It's an error to set both read_data_fn and write_data_fn in the
same structure. Resetting write_data_fn to NULL.
incorrect header check
unknown compression method
invalid window size
unknown compression method
unknown header flags set
header crc mismatch
invalid block type
invalid stored block lengths
too many length or distance symbols
invalid code lengths set
invalid bit length repeat
invalid bit length repeat
invalid literal/lengths set
invalid distances set
invalid literal/length code
invalid distance code
invalid distance too far back
incorrect data check
?33>33>
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVdataflow_exception@iterators@archive@boost@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_iostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AVruntime_error@std@@
.?AVclone_base@exception_detail@boost@@
.?AVplaceholder@any@boost@@
.?AVptree_error@property_tree@boost@@
.?AVptree_bad_data@property_tree@boost@@
.?AVptree_bad_path@property_tree@boost@@
.?AVbad_lexical_cast@boost@@
.?AVbad_cast@std@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AVexception@boost@@
.?AV?$numpunct@D@std@@
.?AVfacet@locale@std@@
.?AU?$error_info_injector@Vbad_lexical_cast@boost@@@exception_detail@boost@@
.?AU?$error_info_injector@Vptree_bad_path@property_tree@boost@@@exception_detail@boost@@
.?AU?$error_info_injector@Vptree_bad_data@property_tree@boost@@@exception_detail@boost@@
.?AV?$clone_impl@U?$error_info_injector@Vbad_lexical_cast@boost@@@exception_detail@boost@@@exception_detail@boost@@
.?AV?$clone_impl@U?$error_info_injector@Vptree_bad_path@property_tree@boost@@@exception_detail@boost@@@exception_detail@boost@@
.?AV?$clone_impl@U?$error_info_injector@Vptree_bad_data@property_tree@boost@@@exception_detail@boost@@@exception_detail@boost@@
.?AVfile_parser_error@property_tree@boost@@
.?AU?$error_info_injector@Vxml_parser_error@xml_parser@property_tree@boost@@@exception_detail@boost@@
.?AVxml_parser_error@xml_parser@property_tree@boost@@
.?AV?$holder@V?$string_path@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$id_translator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@property_tree@boost@@@property_tree@boost@@@any@boost@@
.?AV?$string_path@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$id_translator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@property_tree@boost@@@property_tree@boost@@
.?AV?$holder@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@any@boost@@
.?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_ofstream@DU?$char_traits@D@std@@@std@@
.?AV?$clone_impl@U?$error_info_injector@Vxml_parser_error@xml_parser@property_tree@boost@@@exception_detail@boost@@@exception_detail@boost@@
.$$BY09$$CBD
.$$BY00$$CBD
.$$BY0CK@$$CBD
.?AVparse_error@rapidxml@detail@property_tree@boost@@
.?AV?$basic_ifstream@DU?$char_traits@D@std@@@std@@
.?AVbad_exception@std@@
.?AVlogic_error@std@@
.?AVsp_counted_base@detail@boost@@
.?AVthread_exception@boost@@
.?AVlock_error@boost@@
.?AVthread_resource_error@boost@@
.?AUthread_data_base@detail@boost@@
.?AVvalue_semantic@program_options@boost@@
.?AVtyped_value_base@program_options@boost@@
.?AVabstract_variables_map@program_options@boost@@
.?AV?$sp_counted_impl_p@Udir_itr_imp@detail@filesystem3@boost@@@detail@boost@@
.?AV?$sp_counted_impl_p@Urecur_dir_itr_imp@detail@filesystem3@boost@@@detail@boost@@
.?AVbad_any_cast@boost@@
.?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@
.?AV?$sp_counted_impl_p@V?N@
.?AVtype_info@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
Failed at line %d
Usage: %s <old root> <new root> <file> [<old_oldrootlen>]
Error flushing to %s ?!
Error writing to %s ?!
Could not open fil
.?AVListException@@
.?AVListIndexOutOfRangeException@@
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
K r a m i v o
J k a d s u x i c n i
E : \ D O C U M E ~ 1 \ N I L E S H ~ 1 . S E R \ L O C A L S ~ 1 \ T e m p \ 7 z O 1 C 0 . t m p \ H M R C _ M e s s a g e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ M H g 1 n 4 m X g . e x e
C : \ w w k V M 4 p G . e x e
C : \ 3 S q 4 m d h Y . e x e
C : \ 6 W z V b a Z A . e x e
C : \ M 6 j Q G z h b . e x e
@ @ @ @ @ @
( ( ( ( ( H
@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
% . * d @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @
( n u l l )
( ( ( ( ( H
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ a 0 0 1 a b 7 0 1 d 0 2 e 6 f 1 6 5 2 3 3 2 0 a 9 3 8 0 b 2 e d 7 c c 1 4 7 4 3 6 a 4 5 1 5 8 5 8 8 e a 8 9 1 a a 1 f d b f 9 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ y Q K r z I F B . e x e
C : \ 1 8 4 9 b 8 7 c 7 5 1 7 a f f a c 3 7 4 6 9 3 3 5 9 c a b 8 e 6 b 8 d 8 e 4 8 f 4 5 e 7 8 f 6 d 4 7 9 5 f c 6 f 4 e 4 3 8 d e 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f t c . p e 3 2
C : \ d 0 4 7 1 0 8 3 b c 9 1 6 8 9 2 b 8 4 3 8 0 8 9 d 9 d 4 3 7 6 3 c 0 8 4 3 2 b 1 0 6 c 3 3 4 3 e 5 c 7 d 3 5 d 4 b f 4 f a 4 4 e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f t c . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 1 0 b 9 2 0 d e c 9 e c 4 4 a _ f t c . e x e
C : \ b 2 2 2 5 1 d f 5 1 5 5 7 c 8 b 0 f 8 d c 0 d 8 6 7 8 9 f e c 6 8 3 6 2 3 4 f d 5 3 a 7 a 8 e 1 8 d b b c 3 5 6 9 f d e 6 c b 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ 1 d 9 0 2 3 5 7 0 2 9 d b d 8 9 e 8 c 9 2 7 2 d 4 6 0 a 7 3 4 e d e d 0 5 0 b d 9 7 0 8 8 d 4 4 e 0 7 8 5 5 2 7 a 0 6 8 4 4 9 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ 3 b 3 d d e 2 2 b 2 5 4 e f 0 9 f 1 d 8 d 3 c c e 9 7 9 0 7 3 a 6 b 0 7 f b 0 0 e 1 1 8 8 3 e 0 1 a d 9 8 2 e 7 9 c 8 f d 0 2 1
C : \ d b 2 9 b 0 e 6 2 8 9 c 1 4 a e 4 c 6 f 5 0 6 6 4 3 a 7 d d 7 f 9 a c 9 0 3 6 8 6 1 2 9 9 0 7 3 4 8 9 3 7 5 6 1 8 3 0 7 1 b f e
C : \ 5 d 3 8 3 6 2 3 f 7 a 3 5 5 5 e c 0 e 0 2 f 5 9 c 8 c 7 c 9 b c a 9 a e 3 1 5 a 5 e 3 6 9 2 b 0 2 c 8 f 9 d 2 2 9 7 c 4 0 a 3 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ 2 2 4 d 2 e 6 4 7 b 4 3 9 6 c 0 1 1 8 c 7 1 0 f 7 4 a 8 3 7 9 b 2 2 6 2 9 f 0 1 7 1 7 4 e 0 7 8 f d b a 7 b 7 5 b e 9 c 0 f 7 d
C : \ 8 3 b c 0 f 3 6 b 2 f 2 8 f 1 a 6 4 3 c a 3 c 2 3 8 3 a b 7 9 a 7 9 1 2 1 e 4 2 7 a a 8 e 4 2 2 1 a 5 2 e 0 f 0 7 4 3 f 2 e 9 6
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ l C e B a y V l . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b e b 5 f 9 2 8 a 9 9 0 7 1 d 7 b b 8 0 2 c 0 4 f c 2 e f d c 4 6 2 2 5 c e 9 9 f 2 0 a 8 9 9 7 9 2 a c 5 3 2 b 3 5 4 8 e 3 f 4 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 1 L 8 Y 9 V 7 j . e x e
C : \ 7 7 5 e c 6 9 0 7 8 c 7 0 4 0 5 a 0 3 9 b a 1 3 8 6 b 8 e d 9 c 0 1 5 1 f 7 f 2 0 0 9 4 5 a e 4 2 2 8 e 9 c e 1 b d f 2 f 4 7 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ d c e 0 f d a 9 3 0 7 3 3 3 c 8 3 9 9 6 a 7 5 7 9 3 b d 4 d 2 4 2 0 9 7 b d 7 2 5 e 3 9 0 5 c f e 1 a e e b f 5 1 a 3 4 0 c 6 d
C : \ 8 f 1 e 8 5 8 1 8 2 6 e e 1 9 1 c 9 0 7 b 1 2 5 6 b e 6 7 f 6 3 b 6 4 6 f f d 8 3 0 8 c 4 7 8 0 5 0 2 4 1 9 6 0 2 b a 3 b 9 1 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ 0 9 d e 2 5 c f 7 9 c 2 7 4 5 e d a 0 4 c 0 c 1 9 8 0 b 5 d 2 7 2 d 6 3 e 4 9 a 5 5 f b 1 a 0 7 b d d e d c c e 1 9 a 6 f 2 0 0
C : \ e 9 3 1 d d 1 0 d e 0 0 f b f f 0 f b b 8 0 8 f 9 a 3 3 b 0 4 5 5 7 8 b e a 6 6 5 2 9 9 6 7 c b e 7 9 2 4 2 8 0 6 f 3 2 a 3 3 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ 0 e d 4 c 0 0 7 9 c f 3 6 6 6 5 9 c 0 5 3 c 4 5 e 4 0 c 5 9 f b 6 7 b 0 0 c b 7 0 c 8 4 b 8 2 2 5 7 7 2 1 1 a 3 1 3 0 0 b 4 3 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ T c t u V M O e . e x e
C : \ e 2 3 0 c 6 7 b 6 5 b 7 1 5 3 6 7 6 8 b 8 5 5 7 1 5 0 4 2 f 2 5 6 1 c e 6 e 3 a f 8 4 9 1 4 0 f e d 9 c 1 d a 3 e b 4 f 4 f 5 c
C : \ b 8 c e a 3 0 e 1 c 5 f 3 d 9 c 2 4 d 4 b 9 2 8 1 8 d 5 6 0 a 6 e d 2 a e f d 4 3 3 1 a 4 3 e 2 1 e e 6 c 4 2 7 7 e 3 e 0 b e e
C : \ b 4 4 f 6 9 a 4 e 0 f 4 5 a 3 8 8 1 8 2 f 2 e 4 b 2 d 5 7 b 1 6 2 1 9 f 4 e 4 4 9 5 8 b 8 7 0 a a e 8 1 d c 4 8 9 7 b b 3 b b 6
c : \ t a s k \ 1 C 9 A D 4 A 6 9 1 4 3 1 2 B 8 6 3 B A E D 5 1 5 0 4 A F E 1 E . e x e
C : \ f 4 8 9 c e 8 5 a 0 d a 0 5 c 0 9 3 e 7 7 e 0 b 9 7 b 6 7 9 3 f e b a 0 0 5 2 4 d 4 0 8 8 9 8 4 b d 2 d d 1 3 8 d 2 a 6 5 4 c a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ c 6 7 9 3 7 0 5 7 9 7 f 5 9 5 9 e a 9 b 5 d 3 4 e b 9 7 c 8 f c b 7 7 d 0 6 6 6 2 9 e c 6 9 e 0 8 f 6 4 7 2 5 8 8 a a 0 1 e c a
C : \ 5 4 9 1 f 2 c d e e 7 a 9 5 9 c 4 d 0 e 2 8 f d 7 d d b d 0 7 2 2 2 b 4 7 0 2 9 d 7 9 a 9 4 8 d 6 6 3 5 9 7 5 2 5 e 5 d 8 6 a 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V w D W d 5 r 7 . e x e
C : \ 8 0 0 e e 1 e 8 8 a 5 3 3 f 7 9 8 a 4 1 f 4 e c b 3 0 4 5 c 5 1 f 8 1 a c 6 6 a c 6 5 8 4 6 a d e 2 8 8 0 b f a b 8 6 b 7 2 e 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ K 2 v H I i r D . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 d 3 4 e 3 4 b b 1 1 4 5 0 d 6 c 8 f 1 d a 9 5 c b f e 9 5 a f 5 d 0 1 2 e 3 8 a 8 0 9 5 5 9 5 a 0 2 8 8 6 7 9 e 8 2 b a 7 1 9 . e x e
C : \ a 6 e 7 3 c e d 0 4 5 2 8 0 e b 6 0 b 3 1 f d c c 2 6 d 6 d 0 5 8 e 4 e 3 7 2 e 4 7 d 8 7 f 6 a f b b d 4 0 c e 7 0 4 f f b f e
c : \ t a s k \ A 5 4 0 A 9 F 2 6 3 A 2 3 7 5 3 3 2 2 6 3 4 B C 7 E E 8 D 8 1 1 . e x e
c : \ t a s k \ 4 D A B 6 5 6 E C 2 F 0 5 F 2 0 2 1 3 0 D E 7 3 4 E B A 8 5 1 F . e x e
c : \ t a s k \ 7 D C 6 0 B 9 D D 2 4 F A 4 2 F 1 6 9 B 9 B 1 A 2 9 6 7 6 A 2 2 . e x e
c : \ t a s k \ 4 9 B 8 9 7 C 1 9 B 4 B 5 3 D 2 1 D D 0 4 B 3 0 9 9 3 A F 7 A 1 . e x e
c : \ t a s k \ 6 9 2 8 1 7 0 1 7 6 A 4 7 6 6 A B B 5 2 5 A C D C 4 0 3 9 2 B F . e x e
C : \ 8 3 3 7 7 e 6 a a 5 0 2 c 2 9 d c 0 7 9 1 f 0 8 4 8 a 7 5 5 0 4 3 a d d 8 b c 2 7 d b e 6 c 4 c 8 1 9 0 c e 8 9 6 b d 4 3 9 a f
C : \ f b 4 a 3 a c a 9 2 b 4 0 f 2 1 9 b d 3 c 3 8 7 e e 9 7 c 5 9 2 f c b 2 0 2 8 1 1 2 f c 7 b f 0 6 e e d 7 0 a 1 a e 5 6 7 d 6 1
C : \ b 4 6 8 1 d a 1 c b 8 f 3 a 1 0 b 0 8 a b 4 b 5 8 3 2 d 3 a c 3 0 2 e 6 5 b 1 c 0 5 c 8 0 c f 3 e 3 1 8 7 c 2 8 f 4 c c f 3 a 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f t c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 d d 2 b 1 d b 6 f 8 3 0 4 8 d 1 a e a 6 8 a c d 8 b d 0 f d 5 d 9 3 2 b 0 f 3 1 a c 2 e 1 a 0 4 f 1 5 1 9 c 7 f 3 5 2 6 b a 2 . e x e
C : \ e f 4 d b c f 3 f 2 6 2 8 a c 3 c 7 2 c 0 a f 1 c a f 0 b c b 3 6 4 f 7 1 0 a 6 9 c e e c e 1 b 4 e a 7 e 8 2 0 4 9 7 3 0 0 b f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f t c . p e 3 2
C : \ b 0 4 f b b 9 e 1 c b d 7 d b 4 c 5 c 2 5 5 c 6 f c 9 4 a a 4 4 f 6 1 b e 5 d c f f f 5 6 a 5 9 f 6 4 b e e b a 7 c 4 f 8 b b 2
C : \ e 9 1 3 5 e 8 7 a a 2 9 0 d e b 4 4 f b b 6 8 5 b e 4 9 e d 2 3 6 2 3 b 6 2 a 6 8 d 4 6 c f 7 5 1 c 5 a 4 e b b 2 7 3 d b 5 c d
C : \ a 9 9 c 6 9 6 7 2 2 1 b a a 6 9 8 a d 0 a 0 9 2 e b b 5 f 9 3 b 7 8 f e 9 c c 2 e d f c 4 7 7 2 0 c 9 d 6 2 6 4 4 d 2 d 4 5 b 5
C : \ 5 b 8 9 9 f 1 7 f 6 f 3 1 e 3 a d 6 0 1 1 5 e 9 d 5 2 2 b f 7 9 3 d 6 e 4 f d 6 3 5 6 9 1 6 7 e 9 e c 8 1 5 5 5 c f 7 6 0 4 1 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f t c . p e 3 2
C : \ 0 b c b c 5 6 e a 3 4 c 9 b f 3 4 0 b 0 e 5 8 5 4 3 c 5 5 5 5 9 d 8 f 8 a c 1 c d c 7 5 2 c c d a c 5 7 6 d 1 7 6 e a 2 e 5 9 7
C : \ c 7 4 f 2 e 7 8 5 f 6 3 3 5 d 4 f 6 9 0 1 7 c 2 a a 1 6 c 0 f 2 4 9 e b 9 7 4 6 4 b c d d 9 b 8 b d 5 c a 6 d a 5 b e 1 0 6 2 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f t c . p e 3 2
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.