0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.60
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Trojan-gen | 20191210 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.c | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191213 | 2013.8.14.323 |
| McAfee | Downloader-FUD | 20191213 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0ae91 | 20191213 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 60 个反病毒引擎识别为恶意
(50 out of 60 个事件)
| ALYac | Trojan.GenericKD.1325139 |
| APEX | Malicious |
| AVG | Win32:Trojan-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1325139 |
| AhnLab-V3 | Trojan/Win32.Bublik.R84216 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Generic.D143853 |
| Avast | Win32:Trojan-gen |
| Avira | TR/Agent.ZRFI |
| Baidu | Win32.Trojan-Downloader.Small.c |
| BitDefender | Trojan.GenericKD.1325139 |
| Bkav | W32.DownloadUpatre.Trojan |
| CAT-QuickHeal | Downloader.Upatre.27317 |
| ClamAV | Win.Trojan.Upatre-3341 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.MAUA@5rueuc |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.1553b0 |
| Cylance | Unsafe |
| Cyren | W32/Trojan.QDER-6676 |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.GenericKD.1325139 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.GDT |
| F-Secure | Trojan.TR/Agent.ZRFI |
| FireEye | Generic.mg.8375cc71553b05d8 |
| Fortinet | W32/Agent.ABI!tr |
| GData | Trojan.GenericKD.1325139 |
| Ikarus | Backdoor.Win32.Androm |
| Invincea | heuristic |
| Jiangmin | Trojan/Bublik.gbn |
| K7AntiVirus | Trojan ( 0001140e1 ) |
| K7GW | Trojan ( 0001140e1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=88) |
| McAfee | Downloader-FUD |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.nm |
| MicroWorld-eScan | Trojan.GenericKD.1325139 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.DownLoad3.cjebpc |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM20.1.DA13.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Zbot-GOA |
| Symantec | Trojan.Zbot |
| Tencent | Malware.Win32.Gencirc.10b0ae91 |
| TotalDefense | Win32/Tnega.ATGO |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2012-04-04 22:40:43
PE Imphash
a2bfa209044e11b72a41f731968fdff2
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00002a34 | 0x00002c00 | 6.120370252187977 |
| .data | 0x00004000 | 0x00000d2c | 0x00000e00 | 4.107523237538056 |
| .rsrc | 0x00005000 | 0x00002840 | 0x00002a00 | 5.040049616306608 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x00005618 | 0x00001c10 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MENU | 0x00007240 | 0x000000d8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00007318 | 0x000000e8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00007228 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x00005480 | 0x00000198 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x00005320 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library user32.dll:
• 0x404030 BeginPaint
• 0x404034 DispatchMessageA
• 0x404038 DrawTextA
• 0x40403c EndPaint
• 0x404040 TranslateMessage
• 0x404044 PostQuitMessage
• 0x404048 ShowWindow
• 0x40404c UpdateWindow
• 0x404050 CreateWindowExA
• 0x404054 RegisterClassExA
• 0x404058 DefWindowProcA
• 0x40405c MessageBoxA
• 0x404060 SendMessageA
• 0x404064 DestroyWindow
• 0x404068 LoadIconA
• 0x40406c LoadCursorA
• 0x404070 SetWindowPos
• 0x404074 GetWindowRect
• 0x404078 GetMessageA
• 0x40407c DialogBoxParamA
Library kernel32.dll:
• 0x404008 GetLastError
• 0x40400c lstrcpyA
• 0x404010 GetModuleHandleA
• 0x404014 GetCommandLineA
• 0x404018 GetCurrentDirectoryA
• 0x40401c CloseHandle
• 0x404020 GetCurrentProcessId
• 0x404024 GetCurrentProcess
• 0x404028 CreateFileA
Library gdi32.dll:
• 0x404000 CreateFontIndirectA
L!This program cannot be run in DOS mode.
`.data
@@ 31c
@Lmcnu
EcloP3-l
x@tci<
lWh2-e
+u]UuM
GFu;uu_+
u!M9MEvh
E;Es%N
h%` :@
dTsa*|
j8 ~#e
@hV-ieX
@wcfOak
hJx i@
* h^Rh@
51h%pG
hb u\
Bklheh
hzi*zs
e3Rf F
h*d}r>f:
2lcl<
moEA02x
mE.|1e
ur j`1Zd
@td`'0Xe
FGIu5NA@
FFFF=F@
@;sy;s
FGIu=F@
\Nouh@0/I
Ndju@}
` t0W
FG3@_^]
(onEu
@XDoD G+
@WEASn% EVPP
/c^xd<e
'S'oMu8/
@%Wr$uT)fe
8|nQ"jU
EM+PEM+X+Pj
GV+=F@
QRRhF@
u~BA@
GGGGBBBBIuj j
S,tCCjp!ei
_Oh:iS
EP$9,s'"L
j9e2e"P
H"| Ve
hd@$"e
(.otCE
) aur#
lul vee
eeelt#PrbLen
rpC+"B
l#;; e
#sTiiMfr!rr)
tepV_a
lotader
Consolas
state.ini
static
kilasdg
button
asdlkjalsdj ai8
DialogBoxParamA
SetWindowPos
GetWindowRect
LoadCursorA
LoadIconA
DestroyWindow
SendMessageA
MessageBoxA
DefWindowProcA
RegisterClassExA
CreateWindowExA
TranslateMessage
BeginPaint
DispatchMessageA
DrawTextA
EndPaint
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
user32.dll
GetCurrentProcess
GetCurrentProcessId
CloseHandle
GetCurrentDirectoryA
GetCommandLineA
GetModuleHandleA
lstrcpyA
GetLastError
CreateFileA
kernel32.dll
CreateFontIndirectA
gdi32.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
xxxyyy
- - - - - - - - - F:- - SH- - - - - - - - - - - - *
. . . . . . . . F:. F:yq. . ,
- . . . . . . . ,
. 0!0!0!0!0!0!0!0!~t0!yq1"0!0!dX0!0!0!0!0!0!0!.
0!1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"0!
2#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#2#
4$I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;4$
"""""""
"""#"""
"""DB""
"""BB""
""$BD""
""$"$""
""$"$""
"""""""
"""""""
"""""""
#33""""
"""""""
DDDDDDD
F"RRR%d
FVfffRd
F&DDD%d
DDFfdDD
DDDDDDD
""""""""""!
""""""
""""!!
""""" @"""""""2""""""$D""""""$$""""""D$B"""""B"B"""""B"B"""""B"B""""""""""
"""""""""""""""""""
22"""#
3""""#332""""""""""""
I D R _ V E R S I O N 1
V S _ V E R S I O N _ I N F O
F i l e I n f o
F F F F 0 4 E 3
F i l e V e r s i o n
2 . 0 . 1 . 7
P r o d u c t V e r s i o n
2 . 0 . 1 . 0
C o m p a n y N a m e
S a n n y L t d .
P r o d u c t N a m e
L o o k F o r
V F i l e I n f o
T r a n s l a t i o n
& A b o u t
A b o u t
M S S a n s S e r i f
C : \ U s e r s \ h o s s a m \ A p p D a t a \ L o c a l \ T e m p \ R a r $ E X a 0 . 6 3 9 \ V A T _ 0 8 1 0 2 0 1 3 . e x e
C : \ O w U l 3 K 7 y . e x e
C : \ 7 d S A l N 7 y . e x e
C : \ l d Z o 3 6 m Q . e x e
C : \ _ 8 V Y h a p r . e x e
C : \ l F j V S R k A . e x e
C : \ H S r i s g R C . e x e
C : \ q 4 s l o 0 f L . e x e
C : \ z Q T u H I Y g . e x e
C : \ B l L p 6 6 U V . e x e
C : \ a c 7 1 b 0 3 1 0 6 a 4 b f 8 b 4 4 b 9 7 1 d 4 f 2 6 a 1 0 0 c c 3 6 4 9 a 3 8 d 1 9 f c c e 0 7 7 5 7 e e 2 1 2 0 8 2 b 5 e 2
C : \ i i T F J b W P . e x e
C : \ j b 0 q C U 6 n . e x e
C : \ P u h K 9 Y T 2 . e x e
C : \ O X z a 7 a q C . e x e
C : \ o 3 q w G e J l . e x e
C : \ y o N B G m K P . e x e
C : \ c 3 2 b f a 9 2 e 8 2 3 3 8 e 2 d 1 9 e 9 4 3 0 2 9 6 9 6 e c 3 a 3 6 7 3 0 7 c 5 2 9 9 0 2 5 3 8 9 5 a 7 7 c 4 8 2 0 8 9 b 2 c
C : \ X S E l V o 5 N . e x e
C : \ 1 R 1 d O d H I . e x e
C : \ d z v W U n 6 b . e x e
C : \ 6 C a A D a z d . e x e
C : \ q Z r r w 4 s O . e x e
C : \ o J c n N w o E . e x e
C : \ 2 6 3 3 1 d 7 b e 8 4 c b 3 e 3 7 a 7 2 3 5 e 9 d 4 3 2 4 a 8 0 a 3 4 3 f 7 6 0 6 3 c b 4 8 9 e 2 e d 0 1 1 e 6 9 2 d c e 8 f 9
C : \ b c 7 1 0 d c 4 a 1 4 0 3 f a 1 1 8 4 9 0 0 f 2 1 9 4 1 5 b 2 a 8 6 6 d b d 9 3 c 3 7 6 1 4 e b c a 5 0 9 3 e a 5 c a 0 7 b e 5
C : \ 1 7 0 1 e 1 0 0 2 6 3 0 3 8 e c e 3 e 7 7 c 2 a e d 3 7 0 8 3 a f 2 8 4 2 e 6 a 5 9 5 f f 6 8 7 6 3 b 9 4 b 2 0 8 d 8 e 9 b 7 c
C : \ 7 5 a 2 b 0 5 9 5 3 5 6 5 d 4 b a 6 9 f 9 f 4 7 6 4 0 4 6 b 7 3 e b b b f 8 c 4 b f 1 6 2 3 f 6 4 5 5 4 f f 3 5 8 9 2 5 a d 3 2
C : \ N N U I Y n l K . e x e
C : \ 1 p j n m 6 z B . e x e
C : \ r C 7 H h 4 j Z . e x e
C : \ S E I L 8 J d j . e x e
C : \ a 9 C Y N 4 U W . e x e
C : \ d V J H e I u _ . e x e
C : \ Y N C D a N Y 0 . e x e
C : \ u s R r q K T t . e x e
C : \ Z Q 1 a K e u 5 . e x e
C : \ X i E 2 P r 9 3 . e x e
C : \ A L I r 8 0 I g . e x e
C : \ 0 e 0 2 0 8 e 2 7 8 2 9 a f 1 6 f 2 d 6 7 9 6 1 6 8 3 b 5 8 b 5 2 5 0 9 c a d c 7 e f 5 1 e d d 0 7 4 b 4 5 1 5 9 5 7 7 7 2 0 f
C : \ 1 f d 7 f a 2 9 0 4 c 5 d e 2 4 f 1 0 2 3 f 9 4 e 3 a 5 0 8 f 6 0 b c 8 a c 5 7 5 3 5 3 0 a c e 1 5 1 1 3 9 c 7 f 5 e 9 c 7 c b
C : \ k i D I Q Q E K . e x e
C : \ b h 2 k W R Z D . e x e
C : \ 2 o f b v X z M . e x e
C : \ Z t l p 1 6 D J . e x e
C : \ 9 w Z E t V 3 S . e x e
C : \ Z D B f f s 3 V . e x e
C : \ _ G P l i G J U . e x e
C : \ e a d b 8 8 8 f 3 e a e 4 c f e 2 3 3 c e 8 4 1 7 b c c 8 0 8 4 4 8 a 9 1 1 2 7 f 3 7 1 2 2 8 0 3 a 8 b f 6 7 7 d 5 4 7 a c 5 d
C : \ 5 3 9 4 1 8 b 3 2 2 1 4 9 7 0 8 4 8 f 4 7 e a b 3 2 f d 2 f d 6 c 1 e 3 8 1 e 4 6 7 1 4 2 8 b 2 f c a 2 0 3 1 8 b 7 0 a 0 e 2 4
C : \ d 2 0 0 f f f 9 6 3 4 8 d 7 b 9 3 6 e 2 3 b 7 9 d 8 a 6 d a d 1 b b e 4 7 b b 5 5 4 e 2 7 8 2 3 e e 7 8 5 e d c 4 b 6 7 2 3 e f
C : \ 8 2 e 6 e 7 c 1 7 e 0 1 c 5 f f f 9 c 5 9 0 5 1 b 8 d 3 b 9 f a 9 a 8 b 0 1 5 d c f 7 8 6 2 e 4 6 5 f f 2 2 3 d e 7 6 0 2 8 3 0
C : \ Q 0 _ c m 8 1 9 . e x e
C : \ L 1 Z j R y t k . e x e
C : \ n 4 r e S W I Q . e x e
C : \ 8 c 3 7 c d 6 5 f 0 f 0 5 b c 7 a 9 4 7 f c e 4 1 3 e a 2 b 4 4 8 d 0 6 9 9 d f e 5 8 e b d 5 9 4 0 a 7 8 3 6 7 8 1 9 5 3 2 b 6
C : \ 6 9 0 4 0 c f 8 9 7 2 a 6 3 3 1 c 2 0 8 5 1 4 3 0 9 d 6 3 2 b 3 c 2 a f 7 5 3 e b 7 2 8 6 c 2 c a 6 7 d f 1 e 2 b a 9 8 c 9 8 b
C : \ 4 5 f 1 8 5 8 8 c 4 1 b 1 a c 5 c 9 e 2 c f 9 6 2 4 8 4 a 7 e 7 4 8 f 4 c e f 7 0 5 c a e 9 b 1 e 6 5 c a 0 2 1 8 6 1 7 c 8 9 6
C : \ m 9 r T 1 P 4 i . e x e
C : \ p l d b a v K Y . e x e
C : \ W G I 8 k K X e . e x e
C : \ C F g q _ V J J . e x e
C : \ c o F X H y e J . e x e
C : \ 8 8 d S 2 8 W 6 . e x e
C : \ U Z U L p T X t . e x e
C : \ 3 N L Q M C t a . e x e
C : \ q V z X e p d U . e x e
C : \ L l x S h 0 R v . e x e
C : \ b M u w C j o S . e x e
C : \ s V h J Q x L T . e x e
C : \ z z _ R l X H E . e x e
C : \ 2 d d W g e i 5 . e x e
C : \ 1 d S i U J h T . e x e
C : \ _ k T r u N o 8 . e x e
C : \ l v P X 5 a P u . e x e
C : \ Z t K R q 1 1 X . e x e
C : \ y a 8 r w T L x . e x e
C : \ W u H l I 9 C M . e x e
C : \ 7 c 4 3 b c f 2 4 e d a 2 7 5 7 c d 2 8 5 0 1 8 2 6 8 3 b b 8 1 f 2 b 8 c 0 e a 0 e d 7 d 4 8 b 1 b 8 4 a 9 0 f 1 d a 1 3 8 d 9
C : \ e 3 6 5 9 6 f 3 6 9 c 5 c 0 9 3 3 9 e a a 3 8 c 1 2 d d 0 d 6 2 6 7 1 1 3 e a 5 9 7 0 2 8 b 0 a 9 0 4 9 4 6 a 6 e 2 1 3 4 7 4 8
C : \ a 8 7 0 f e a 4 8 8 b 4 2 6 f b 9 d 7 8 1 f 0 9 a 9 0 e d 4 d b c 9 5 b 9 d 5 2 b 5 d 5 b a 1 d 6 8 d 7 4 6 8 0 a a a c f c c f
C : \ d 7 6 e 0 b 6 3 1 f 0 9 7 d 1 2 6 3 9 a 7 0 4 5 8 7 0 6 7 4 5 0 f 0 a 0 a a f 1 8 b 7 0 b e 0 7 8 3 8 0 5 e 4 8 4 7 b f b 8 a a
C : \ T w v c d H M Y . e x e
C : \ y w a P X O v d . e x e
C : \ 5 t r q c k Z x . e x e
C : \ 1 6 d f 0 9 0 1 a 0 9 5 3 7 4 9 9 0 e 9 e 1 f 1 f 6 c d 0 2 2 5 8 2 f c 1 3 3 5 a 4 8 a c e 3 c a 2 d c b 4 9 d 6 c 3 4 f 2 1 7
C : \ 0 5 a d 4 4 1 e 2 7 d 1 8 b 3 f 6 0 5 2 c b 4 7 4 5 9 9 f 4 8 a b b 0 5 5 3 7 b b a 8 6 9 b 7 5 5 2 5 f 5 3 f 6 d 0 4 1 1 e e d
C : \ 6 1 5 9 4 b 7 b 3 0 7 5 2 2 c 4 1 8 2 3 a c 9 e 2 3 6 c 5 2 5 1 1 e 6 6 6 0 b 2 0 c 2 7 2 0 3 c f d 1 e c 5 a 3 8 9 e 4 5 9 9 8
C : \ 6 b a a f a 3 e 7 0 1 6 a 8 b 9 f e d f 9 d 8 8 e 5 7 0 b c e 8 7 8 8 3 9 b b 0 d d 0 2 7 c 8 a d 8 d 5 b f b 8 4 4 2 1 2 3 6 7
C : \ a p R 0 n T n z . e x e
C : \ V I D 6 5 9 8 1 9 4 6 9 . e x e
c : \ a n a l y s e \ 1 5 5 7 1 2 0 7 1 4 . 8 9 3 9 4 1 2 _ e c 6 7 d 7 b 3 - e d 7 9 - 4 a 9 b - a c 0 a - c 0 5 3 7 f 2 1 2 2 4 6
C : \ a 6 d a e 4 6 9 a 6 2 7 2 9 c 0 f 7 7 5 d d 8 8 a 7 0 b 0 9 1 1 8 1 d b 6 1 7 0 a 3 e 9 4 f b 6 c c 5 0 1 c 6 0 a 8 f 4 4 c b c
C : \ A r 3 G j q h V . e x e
C : \ 1 e 1 5 7 3 a 6 6 3 4 3 c 7 f 3 6 f 4 7 4 8 e 6 1 c e a 1 1 d 1 5 a 8 4 8 2 d d 0 4 d 2 6 8 d 5 0 4 e 5 7 0 6 b 6 0 d 6 7 c 4 8
C : \ N H e 5 d s 5 i . e x e
C : \ 9 c c d 1 1 0 b e 8 2 d d 3 9 4 0 b 2 e 5 4 b d 8 1 9 7 c 7 7 8 7 f 0 f 6 5 0 b 5 7 c 3 e 5 c 4 8 5 3 0 f 8 2 9 b d f 1 0 5 2 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ M q 3 F 6 e M 6 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ b 6 0 c e 3 3 c 0 0 e f c a b 1 b 0 3 7 7 2 9 f 0 e f 6 e 0 6 8 1 7 2 c b c 6 2 b e d a 9 5 4 c a a e 2 5 2 c a e d f 8 a 6 a e
C : \ e h I H u P Q B . e x e
C : \ U s e r s \ J o e C a g e \ A p p D a t a \ L o c a l \ T e m p \ 1 a 1 8 5 a c b 0 1 f 8 d e 7 e 5 1 d 9 9 c 9 5 3 2 5 d d c 4 5 c f a 4 6 7 c d 8 3 e 5 b 3 2 a e 0 5 5 1 c d 0 a 8 e 7 3 1 1 5 . e x e
C : \ 6 0 1 c f 4 a 3 2 6 b d 4 b 8 9 e 2 1 d 6 0 c 8 3 2 f 3 1 3 1 e 8 9 8 6 b c 3 6 d 7 5 c a f 3 0 9 1 b d 1 0 2 f d 2 9 7 9 6 d 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ 8 a 0 8 d f a a b f 0 d 0 b 8 6 2 c c 8 2 7 e a c e d 1 8 b a b 5 e 8 f b 1 2 b b c 3 2 3 6 2 e b 2 f 5 d 2 e c a c 7 5 6 0 8 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ n k 5 b 4 8 r 5 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 9 9 5 f 8 7 e e f 0 7 c 9 3 0 7 f 2 5 4 c e d a 7 4 2 d 5 c 1 . e x e
C : \ 5 4 0 8 c 0 a 2 1 1 7 b c 5 4 3 c 8 7 9 2 2 c 5 1 2 e 6 b 0 4 f 1 9 4 6 b 5 e b b b c a 5 1 6 8 a 6 a 6 4 0 d c 5 a a e 3 6 d 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ 1 2 3 f a 1 c b 1 9 5 9 0 b 7 4 1 2 6 5 0 d 0 1 0 b f 7 a 9 7 5 3 f e 7 c 6 8 3 e 1 5 3 5 a 5 f f c 0 3 d 7 3 5 5 d 0 d 6 d 0 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ b 9 e 1 d 3 6 4 2 d d 0 e 8 e 4 d 9 9 f 7 d b 7 3 4 a 0 3 f c f 4 d 2 a e 4 1 8 c 9 9 d 4 6 a b 1 5 b 5 8 7 2 4 d d a 1 0 3 0 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ J 8 k f C q 2 B . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a f a b e 6 7 d b f d 2 e 4 0 4 b d 8 b 5 5 e 3 4 f f 6 5 5 8 4 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e c e 4 3 c 8 2 1 f 9 4 0 a 9 8 _ g e w o s . e x e
C : \ 6 b 7 b 6 0 f 0 b 7 a c 2 4 6 0 a 2 0 a 6 c d 6 0 f f 2 9 3 c 8 9 d 5 9 3 3 b 9 3 5 8 c 5 7 5 6 7 2 3 3 0 4 0 9 9 1 7 0 8 d d 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ b 1 1 8 d 5 7 7 7 0 c 6 c 7 7 5 d 2 4 6 8 c a e 6 7 f b e b d 6 2 3 a 2 5 f 7 7 b 4 3 7 3 4 0 8 b 2 f 2 c 6 4 e 6 c 2 9 1 4 2 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ 3 7 d 6 b 9 5 d d b 5 2 1 e b b 6 d 8 5 0 9 9 c 8 e 2 f e 7 5 0 a 5 8 3 1 4 3 e 0 5 5 f 8 3 8 3 b 6 e 2 6 f 7 f f c b d 1 b b 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ 8 2 b f f 3 1 4 6 1 b e f 0 f 7 f c 3 3 7 e 9 d d 2 f 6 c 2 c b 7 3 9 c 5 8 3 7 4 3 7 1 4 4 7 0 7 4 4 1 5 9 4 7 1 c d 3 8 a 5 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ 1 e a b 2 1 a 1 6 d 0 d 5 5 0 c 0 7 2 4 d d e 6 9 b b 0 9 8 b 6 b 5 3 e 4 8 5 e 1 e d 3 a 1 5 a 9 8 c 5 7 a 6 c 0 e a b 5 5 5 7
C : \ 0 d 0 7 9 4 e d d 0 8 f d 5 3 8 4 2 f c f 1 2 5 6 c 5 c e c b 5 8 1 7 f 2 b f c c 5 0 c 4 c 7 8 5 0 5 7 5 2 9 a 0 b e d d 7 7 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ a 0 b d 1 0 8 9 9 b 3 0 c 5 b d 5 6 b 3 6 9 4 1 3 1 9 4 5 4 8 9 7 1 5 9 3 3 6 8 0 a b 1 0 b 3 2 b 9 2 7 8 a 3 3 f 5 3 3 8 7 2 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 6 b 3 9 2 a a 8 2 a 9 8 2 e 5 _ g e w o s . e x e
C : \ 3 d b 3 3 9 4 7 3 c 1 1 9 e 2 8 8 3 7 a e 3 6 5 f 4 b d f 0 9 6 6 e 0 9 1 5 0 f 9 0 0 f c 5 a 8 6 9 8 5 3 a d 3 c 2 0 7 e 7 c b
C : \ f 5 e f 5 6 0 4 5 0 a 5 f 8 3 7 5 e b 3 9 b 2 f 1 0 b a 7 a 9 c e d d b 3 8 a 4 3 e 5 2 3 f e c 7 4 d 4 8 3 b 3 d c b f 3 a 8 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 4 5 a 0 6 5 3 c 4 b 9 4 1 8 8 _ g e w o s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ 8 4 c 2 a 6 6 8 6 9 e 6 b 4 4 e f 2 b d 2 0 f 7 1 3 c 0 1 b f e 2 3 c d 2 e 3 0 0 b 1 a 2 1 e 4 6 e 4 f 8 3 a 9 8 b 5 5 5 3 0 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ Y I d g a n b h . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 3 1 3 b 8 7 b 5 3 d e 8 0 9 6 _ g e w o s . e x e
C : \ 7 5 f 4 2 e 8 2 0 6 0 3 6 d 0 5 2 7 5 5 c 8 4 4 2 2 0 d 2 2 f 7 9 1 a c 1 7 a 0 7 2 f f 4 5 a 1 5 3 1 1 c b 8 0 2 7 f 3 6 f c 9
C : \ x o I 6 v U 2 C . e x e
C : \ 8 9 5 3 2 b c 3 1 1 4 0 7 6 5 6 6 2 6 6 a 3 4 f 4 3 2 5 2 c 2 5 e 7 3 7 7 8 e c c b 8 6 6 e b 0 7 b 1 9 b a 3 6 6 7 9 3 a 6 1 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ 5 f e 0 5 e 9 e b e b b f c c 8 f 6 5 8 f 3 f a 5 b 1 2 b b 9 a a 0 b e a a 7 2 1 f 8 6 6 2 f 7 0 b d 6 a 6 6 f e 5 a d 4 a 5 0
C : \ O c T H u 4 x 6 . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 7 f 1 f 8 d 4 7 f 9 7 8 6 4 b 0 7 2 b 9 2 c e 6 7 a f a 2 f a c e 6 1 4 1 c b b 4 8 e 6 7 f 1 7 2 6 8 f a d 4 2 c b 6 4 d 4 c 4 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ g e w o s . p e 3 2
C : \ 6 8 e d 5 8 c 5 5 f 2 2 a a 5 4 4 2 3 6 a 9 5 f 6 f 9 f 8 9 d 5 c 4 b 6 2 5 f 3 e 6 9 1 a 9 9 0 c f a 3 8 2 b 6 6 6 6 e 1 0 d 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ 2 8 7 4 9 f 9 4 7 7 2 4 2 a 3 f f e a 1 0 9 5 d a c a a 7 e 2 e a 2 9 b 1 5 8 f c 0 1 d 7 0 b a 3 8 9 7 8 9 3 5 f d 8 8 1 6 e 4
C : \ 0 5 b b c 9 f 0 0 8 2 6 e 6 6 1 e 2 2 b 5 c b d d 7 8 4 e 3 f d b 1 2 c 5 0 d d a c 9 a a 0 3 d 7 0 2 0 f f 2 b a 4 0 1 3 e 5 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ 0 0 7 4 a e d b d 0 3 8 2 8 0 6 8 3 3 a 0 d 8 c a 1 b 4 d f 7 8 0 b 6 d d 8 b b 0 1 6 9 f 7 f 3 d 4 d 3 0 e a 7 3 8 f 1 0 6 3 9
C : \ 3 2 c d b a c 5 7 c 1 5 3 9 5 a 5 6 f 0 6 7 3 3 3 2 5 e 9 a 0 7 5 1 a b e 9 b a 4 8 2 f 2 5 4 f 7 1 c 6 2 f b f d 6 d 2 6 2 7 e
C : \ 2 f e 9 5 5 d 9 3 c b 9 c 7 2 5 9 6 7 6 6 b 5 6 e e 6 c 6 b 1 b 9 e 0 4 0 5 a a b 3 4 5 f d c 0 1 2 b f e 6 e 8 6 6 1 e 0 a 0 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ g e w o s . e x e
C : \ 9 e 3 1 3 b 2 5 2 4 3 9 4 6 7 f f 8 7 8 8 c d f 6 a 2 0 e 3 f 8 c 8 c 0 7 a d 8 4 7 f 7 5 0 4 f 8 7 2 6 f 3 2 2 f a 0 0 f 9 4 b
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.