2.9
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.65
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\ieupdater.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\ieupdater.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\ieupdater.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
检查适配器地址以检测虚拟网络接口
(50 out of 216 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x0000112c', 'size_of_data': '0x00001200', 'entropy': 6.912713000117345} | entropy | 6.912713000117345 | description | 发现高熵的节 | |||||||||
| entropy | 0.391304347826087 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(8 个事件)
| host | 114.114.114.114 | |||
| host | 34.107.221.82 | |||
| host | 34.117.188.166 | |||
| host | 34.160.144.191 | |||
| host | 35.244.181.201 | |||
| host | 34.107.243.93 | |||
| host | 34.149.100.209 | |||
| host | 8.8.8.8 | |||
生成一些 ICMP 流量
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(2 个事件)
| dead_host | 124.225.79.126:80 |
| dead_host | 45.67.36.197:443 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-12-27 01:21:51
PE Imphash
9698971d14755c3d1778addc4e590d2d
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0000112c | 0x00001200 | 6.912713000117345 |
| .rdata | 0x00003000 | 0x000004c6 | 0x00000600 | 4.732219564332985 |
| .data | 0x00004000 | 0x000001d0 | 0x00000200 | 4.057521595649805 |
| .rsrc | 0x00005000 | 0x00001248 | 0x00001400 | 4.761947851859842 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00005278 | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00006138 | 0x0000010c | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00006120 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x00005130 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x403060 RegisterClassExW
• 0x403064 CreateWindowExW
• 0x403068 GetMessageW
• 0x40306c TranslateMessage
• 0x403070 DispatchMessageW
• 0x403074 DefWindowProcW
• 0x403078 PostQuitMessage
• 0x40307c ShowWindow
• 0x403080 UpdateWindow
• 0x403084 PostMessageA
• 0x403088 SetWindowTextW
Library KERNEL32.dll:
• 0x403008 GetStartupInfoA
• 0x40300c GetModuleHandleA
• 0x403010 GetModuleHandleW
• 0x403014 CloseHandle
• 0x403018 CreateFileW
• 0x40301c WriteFile
• 0x403020 ReadFile
Library GDI32.dll:
• 0x403000 SetBkColor
Library MSVCRT.dll:
• 0x403028 __getmainargs
• 0x40302c _controlfp
• 0x403030 _except_handler3
• 0x403034 __set_app_type
• 0x403038 __p__fmode
• 0x40303c __p__commode
• 0x403040 _adjust_fdiv
• 0x403044 __setusermatherr
• 0x403048 _exit
• 0x40304c _XcptFilter
• 0x403050 exit
• 0x403054 _acmdln
• 0x403058 _initterm
L!This program cannot be run in DOS mode.
`.rdata
@.data
0Phh*Eh
uP 3u E
uPHV|*L
@@E* h*
@ hEuh*0
*uEPu0uh
u3@E3@h *00PPE
h0EuP@@0P
*E0U\3E0
t(=l0@
MQ3PPPUR
03PPhh*
[uSEAVWAf9
KhIM3E
GGEGGEM;r
FG3@_^]
=-#I3O
904-3:F)m
>-33O"
$*' <8|D8v
'-;# "
>-3.K(m
u0;<{2
-*5HZa
? 98W4
{P@Ue_K
S*D:W4&9
n^PHd|
A#F**\
$B@^P"<
*LAS4&-3UQgK*
HJV|(&n
oz4&5O
>>l*X%O
)V|(<4 ,
X)\}T>hO
HT|"4&E
0hX\P"5#N
T|"4&E
X^P`o?)i
Z^P@oI)
a53UZ+R
*L7=%#
% 9M3$
<,oLAs#
M+`5 sB|{
\PA=zo
8kH<,($
X^~m5I)9x\B6;Uk
)V|(<4 ,
{Pt*(@(s
PHsuLL
+{#ms|Z)
95'*9|C!+
%3SN*a
Iu[[_[+S3P 0hhP hE
*P@*E3
@@ 0*E*0
0**u0
UURVWU Yu
EUjh1@
hSVWe3
EEP5A@
EPEPEP
0u>"u:Fu
<"u>"u
> vFuj
YY3%00@
VM\=O
GYYNJ^
SV UFIM/
[.\`!RC
J?AY:79ID
$R&?AFF<a6
>3\+.B
=L ;(?
.7,N]S
SetWindowTextW
PostMessageA
RegisterClassExW
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
ReadFile
WriteFile
CreateFileW
CloseHandle
GetModuleHandleW
KERNEL32.dll
SetBkColor
GDI32.dll
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetModuleHandleA
GetStartupInfoA
|Cs_KmXEuI^
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>(
A((((((((((((((((((((((((((((((((
$$$sM$$$$
'$$$$$
8E#$$$
'$$$$$$#
'$$$$$$$#?cesM%###ddd[$
'$#####$$$CIkll|l#
'$#########C
'$########<$$
kkks#N
'$##########
%%%#%%%%#$
'$#########$?
#$$$$$$$$$
'$###########
#<$##$$$$$$$
'$##########<<$#####$$$$$$
'###########<#
#$########$$$$
'###########<#M<$##########$$(
'######%####<MM<###########$$$(
'###%#%%#%#%<?M<#############$(
'##%%%%%%%%0CC##############$(
'#%%%%%%%%%%@C
##%###########$(
'#%%%%%%%%%%@C#%############$(
'#%%%%%%%%%%@C0@#%##########$(
%0000000000@C0@%###########$(
0@0##########(
K33333333333333443333L
##0%0000#
vDDDDDDDD//////////////////////0#
w11111111OP11POOOPPPOP11111111O
LLLLL\A
x8*****88E8*88EEE188E8********1\qo3iiiKoj
_8*****8}R88}r8}R8*******8{Lq3iggiV
`555555|~
5~R|5555555|{3gaaaaWS
*,,,,,,,C
hIb,,,,,,,,3ia
5,,,,,,,p99
,,,,,,,~Xggiq00Y
b999999
FF999999XW
I::::::
FF::::::i
F&&&&&&
&&&&&&g
F&&&&&&&&GGG&&GGG&&&GGG&&&&&&&&g
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&i##J
=========2222222222222222222=Kq@Y
X3444444444444444343Lq
+@H;;;;;;;;;;;H0HH0HH
.+++++++++++++++)+
L!This program cannot be run in DOS mode.
i2h:2h:2h:2i:gh::1h::3h:)%:"h:)%:Ph:)%:
h::3h::*h::3h::3h:Rich2h:
`.data
@.reloc
otools\inc\nlg\private\inc\msfsa\faarray_cont_t.h
otools\inc\nlg\private\inc\msfsa\falextools_t.h
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
bad exception
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
Unknown exception
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
nlg\lib\msfsa\faallocator.cpp
nlg\lib\msfsa\farsdfa_pack_triv.cpp
otools\inc\nlg\private\inc\msfsa\faarray_cont_2xresize_t.h
nlg\lib\msfsa\famultimap_pack.cpp
Internal error.
Object cannot be initialized.
Limit size has been exceeded.
Out of memory.
Object is not ready.
]ut5p?
W3+t#Hu7Vu
^3[UQE
V3WM0u
UVW39~
<|uCt7
t79V$t2h
M 3UE9J
MA3;~\U
E;}q}M
PE @PE
MPE+@PE
G;}|}]}$
F;}^U9]
z;~\;}T;]
Yt]U]U]
EVW3EP
n o v e l l e
n o m a d i c a l
u m b r a g e
s t a t i c
n e w y e a r !
b u t t o n
M i c r o s o f t S a n s S e r i f
C : \ U s e r s \ m i c h e l l e \ A p p D a t a \ L o c a l \ T e m p \ T e m p 1 _ T a x p a y m e n t . z i p \ T a x p a y m e n t . e x e
C : \ f 5 b 2 6 2 f 9 6 4 d d e d 0 a c 8 e f 2 0 6 c c e 1 7 7 f c 9 3 c 6 2 f 1 7 e 3 c b 4 4 1 7 c 0 4 b 7 1 5 d 1 6 9 a 8 5 7 e c
C : \ a 6 2 3 4 2 d d b 7 b 7 1 f 4 f 6 a e 1 1 4 d 9 b 9 f 6 9 1 8 5 e 7 4 a d 3 3 0 7 0 4 d 3 b b 9 3 d 1 a 1 e 8 4 a 5 0 9 e 6 0 c
C : \ f 9 e 9 9 d c f d 6 0 8 c e 9 1 5 4 0 e 0 0 c 7 c 7 0 2 0 3 a 8 4 7 5 b 8 a 7 1 5 2 e 9 9 6 7 6 8 f 3 2 a 7 b 9 8 a 5 f 3 9 3 b
C : \ 2 3 f 4 3 7 e 7 6 b 0 5 6 d a 5 d 0 2 d e 1 e f a 7 7 2 7 5 1 e 7 2 1 8 6 b e d 6 b 8 4 c 3 5 5 a d 8 f 8 6 6 2 9 5 c 0 2 5 c 6
C : \ S E g q C u J 0 . e x e
C : \ B D Y g D M X U . e x e
C : \ r 3 _ F 3 A s 1 . e x e
C : \ N L j E m L g Z . e x e
C : \ b e f 3 2 1 d 8 c c 4 c 1 1 a 7 a d 9 4 4 b 1 3 e 5 d e 7 5 e e f e 1 1 8 f f 4 b 5 2 a a 9 f d 6 c 2 2 7 a 0 4 7 9 2 8 8 9 7 1
C : \ 8 6 3 e 9 9 5 c 1 4 f e 1 b e a 4 8 d 4 a 6 b 9 5 9 0 8 6 e 2 6 1 e f c 1 b d e b 5 1 8 b a c d 8 2 7 d 0 7 7 2 4 4 b 9 7 6 0 0
C : \ c H 6 v B f s O . e x e
C : \ c G g J G s I d . e x e
C : \ C F 7 v o s Y n . e x e
C : \ 4 r a 2 L B W I . e x e
C : \ Z n M Z o 0 L c . e x e
C : \ M 7 T t A j 9 u . e x e
C : \ d u 3 p F t 4 8 . e x e
C : \ 8 C 8 8 Z 1 q h . e x e
C : \ T j l o L g q v . e x e
C : \ 4 q c M B W U u . e x e
C : \ c e k L X y l h . e x e
C : \ R 3 B u 2 K o b . e x e
C : \ 1 m B y N n T o . e x e
C : \ V 9 f 8 h _ Z d . e x e
C : \ y 7 z V 6 a o _ . e x e
C : \ 2 6 w l 8 N P P . e x e
C : \ R G S E l x a n . e x e
C : \ O t t z 3 U c q . e x e
C : \ F N 8 f 7 S Y M . e x e
C : \ 2 1 v I E N Q S . e x e
C : \ h d 6 j m Y 5 O . e x e
C : \ R S u W _ S g B . e x e
C : \ Q T b W 2 e V P . e x e
C : \ 0 b 9 2 1 c 6 a 9 f 7 7 8 d c b c f 0 7 9 a 3 7 f 4 7 1 9 e d 8 e 4 8 7 0 8 7 e 4 f d 5 7 9 e f 0 9 9 b 1 4 2 1 8 4 2 3 5 f 2 9
C : \ 0 4 6 f d 0 0 1 5 9 f d a f d 3 4 c 8 9 d 7 8 0 4 0 f a b d c 3 9 8 4 4 7 7 f f f 6 2 6 4 b 7 6 6 6 f d e 6 9 c 3 7 e d 9 1 e a
C : \ 8 1 c e 2 8 5 5 0 a 1 2 8 1 e 0 1 e 1 8 c b 2 8 f 5 1 5 2 1 6 3 8 e e 6 a e 3 4 f 2 6 5 0 7 8 1 b 5 c b 0 c e b 7 c 8 6 f b c 9
C : \ v x I Z 5 a 5 D . e x e
C : \ k t e G z Z V y . e x e
C : \ S s 3 y L q l h . e x e
C : \ H O Z m m M z m . e x e
C : \ D 0 b x m j m y . e x e
C : \ k f K 6 p J 3 q . e x e
C : \ L o z n y i z C . e x e
C : \ M N h E l o a T . e x e
C : \ P J e e 8 4 S O . e x e
C : \ k a O x 3 u G P . e x e
C : \ 1 d f 3 9 d e 9 1 3 a 0 8 c d 2 3 d f 8 8 b b b f 1 3 e 7 6 0 7 7 3 2 a 0 b f c a 7 9 a 7 1 c 1 1 1 2 8 a a e a 9 4 5 1 a d 9 c
C : \ 1 2 3 7 8 2 9 d 9 b 4 c f 6 2 9 7 e 1 d e b a 4 4 d 3 1 d 8 2 6 9 6 5 7 a 7 3 d 1 8 0 2 5 a 9 d f 7 6 5 7 c 5 3 2 3 3 0 1 e 5 4
C : \ 2 f 2 9 c c 8 8 1 a f 3 0 c 9 6 d f 0 d d 4 8 1 5 b a c 8 8 4 3 7 d 1 6 8 c 8 8 9 4 7 9 d 7 6 0 0 a 6 1 6 2 2 e 3 4 9 3 8 5 f 9
C : \ H r Z D G 8 R 1 . e x e
C : \ e B 3 h U 0 D V . e x e
C : \ 0 0 h I g 8 K e . e x e
C : \ I m u t u m k C . e x e
C : \ J N L 2 f t Y 1 . e x e
C : \ T k _ E g q x E . e x e
C : \ 8 c b 2 a 7 f 6 8 b 5 a 1 a 3 d 7 4 6 d 2 3 7 4 c 2 2 9 e f f 9 9 f b 1 c 8 7 a 5 7 8 4 4 2 d f f b 8 e f b 3 d 0 2 9 7 2 b e 5
C : \ v B V r y Q 2 F . e x e
C : \ 5 c 3 4 1 1 b 3 8 9 5 f 7 8 1 e c 0 6 3 4 6 4 f f 4 b d 7 4 2 a 0 b c a f a e c 5 c 8 8 3 1 6 4 d f 6 8 c 7 c 2 0 8 c 3 4 f f 0
C : \ A o k C O 6 c l . e x e
C : \ 6 7 p t s v t Z . e x e
C : \ p _ W B i z u 3 . e x e
C : \ 5 0 7 9 f 9 b 5 7 1 9 7 f 2 9 3 c 3 3 0 7 7 9 c 5 f 8 e 1 7 6 a 5 1 3 5 3 3 c b 9 f 9 3 c 4 6 e c 1 7 b 3 f 2 3 9 9 2 4 d b 9 f
C : \ c d 2 3 e 6 4 0 9 a 1 d 7 b 8 9 8 d 7 0 6 e 7 4 b 3 2 e a 5 9 5 1 6 3 d c d 3 8 f e d a 5 7 7 4 c 1 9 d 2 0 3 9 a 5 f b d c e a
C : \ w q v 6 P F W R . e x e
C : \ t 1 k T W i s 9 . e x e
C : \ c f c 4 d 7 8 7 f 3 5 b 0 f e 7 a 4 b e 5 8 4 0 d d d 0 a a 2 4 3 3 6 1 2 e a 1 9 4 3 7 4 3 b 0 2 8 4 8 d 9 f 7 2 1 c 7 b 9 e a
C : \ b 7 a 3 a 2 d 6 a d f 8 b 6 e 9 e 9 1 b 4 6 d c 3 5 2 b 0 b 2 7 f c 8 c 6 b 2 b a 6 a 6 8 a 6 c 1 1 3 f 3 c 9 2 4 d 3 4 e e f f
C : \ 6 6 e d b 6 1 f d 2 a 3 8 7 6 d 1 f 9 5 7 d 7 8 b 2 0 5 8 5 d a 0 c e f 3 4 c 0 f 0 4 7 c b 3 f 6 f 8 a 1 5 6 2 c 1 c 1 7 8 a 5
C : \ 4 0 7 6 6 c d e c b c b 5 6 9 2 8 5 2 c 9 a 5 0 4 c 4 9 4 f 4 4 9 b 6 e 9 0 b 2 1 e 2 6 6 7 b 0 2 0 0 4 1 4 7 4 3 6 b 1 5 b 5 c
C : \ 0 b b e 3 7 e 9 f 0 6 7 6 7 7 0 e 3 b 9 4 b c c c f 7 2 3 d e 2 5 a 1 d d 9 d 5 3 d c e b b e 3 d 2 d 7 4 2 4 7 0 0 9 c e 4 c 1
C : \ 9 a X G s K 5 m . e x e
C : \ e b 6 b a 8 0 6 4 1 b a 0 c 1 8 0 6 6 8 8 7 3 d d d 9 8 1 e b 1 e a 8 1 0 d 2 e 2 8 f d 2 f 3 b 5 d 4 8 6 a 2 3 5 5 6 4 a 8 c 3
C : \ v 9 k n q Z 6 c . e x e
C : \ 7 d 8 4 0 8 b 0 8 3 e d 3 f 0 c a b 6 6 0 e 1 5 3 f 9 d 0 f 3 0 8 f d 8 9 0 4 8 b 4 7 e 1 d 3 4 3 5 5 3 c e b 2 0 a d 2 2 7 6 0
C : \ 5 X L y u e m R . e x e
C : \ l j X e 3 v g W . e x e
C : \ Y A 1 h w j h N . e x e
C : \ h u V 7 Y i X 2 . e x e
C : \ g y V W B Y D F . e x e
C : \ H 9 M N H P _ K . e x e
C : \ d b 7 2 4 b a c c c f 1 c d e e 4 e f f 2 9 1 9 7 3 b 2 b 6 f 0 c a 8 8 f f e 6 b 8 2 2 2 b 1 a 6 d 6 2 1 c 0 9 d 5 5 1 e 3 7 1
R E S O U R C E _ F A T O K E N I Z E R
K E R N E L 3 2 . D L L
s m s c o r e e . d l l
n r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
W U S E R 3 2 . D L L
( ( ( ( ( H
C O N O U T $
C : \ 7 c 1 6 c 7 2 e 7 0 0 7 1 5 6 c 5 2 5 2 b 2 0 6 2 b 2 3 8 0 2 f 6 4 e d 9 2 5 f 1 d e d d e e 0 9 2 c d a 8 7 c b e 9 1 0 8 c 3
C : \ 4 1 c e b c c 6 f 8 3 6 d 6 b c e 1 c 8 f 6 f f 8 d f 4 8 f 2 2 9 b 3 1 b d d c 0 1 0 4 6 5 7 3 2 9 d 1 9 8 0 d 4 f 2 e 0 4 e 2
C : \ 8 2 c b 5 d e 7 8 2 8 3 7 c e 4 1 2 4 f b f f 6 3 e c a 5 7 3 5 a f d f e 0 1 a 9 3 2 e e 3 5 3 1 5 2 7 a 7 f 6 3 0 a 7 c d 8 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i e u p d a t e r . e x e
C : \ d 4 3 5 3 e b 0 2 a b c f 6 8 3 6 2 2 4 e 2 7 0 9 e 0 6 a 2 7 1 5 3 6 e 9 1 1 a 0 c d 9 0 b 3 3 6 9 4 f f 3 0 4 1 f 5 4 d 5 9 0
C : \ e e 6 8 7 b 9 0 b 0 6 8 d c 9 f c b a e 2 0 d c 9 1 9 b 5 4 f c 2 e b 5 f 2 0 9 6 e e 5 4 c 2 a 0 f 6 e c 1 2 8 1 6 e b 4 8 9 b
C : \ b 3 8 2 c 6 0 7 9 4 4 f d 5 f b 9 b 5 b 8 8 c f b 0 0 5 5 4 c f 6 3 9 b 4 9 5 4 9 2 c d 3 f 9 b a 4 5 c 2 7 8 0 1 6 f a e 7 0 8
C : \ 4 7 d 6 6 0 1 7 c 8 1 7 7 3 9 f 7 c 2 d a 1 b 1 8 d c e 6 f 5 4 f 8 b 8 0 7 2 2 8 b 5 e f b b 0 4 e c c 3 3 c 5 6 0 f 5 3 3 3 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i e u p d a t e r . e x e
C : \ 7 b 0 5 c f 9 7 6 5 0 b d 6 9 c d a d 8 6 2 6 8 b 6 c 7 4 6 3 b 9 7 7 1 c 5 b 9 3 0 3 a c a 0 2 c 9 2 1 4 5 0 e 8 9 5 e b 4 8 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i e u p d a t e r . e x e
C : \ b b e 2 7 0 9 e f 0 8 b 3 a d 4 d 6 8 2 3 b 9 0 8 b e 5 c b a a 7 6 2 8 8 8 7 c 0 9 b c 0 2 7 6 f 0 e d 4 2 6 f 4 8 8 f 2 0 4 d
C : \ 6 4 0 0 a 7 b 6 2 2 9 6 e 7 b 9 3 a d a d b 8 0 9 2 e 7 e b 7 9 8 5 5 f d d b 0 3 5 5 b 5 4 c 8 b 2 2 1 3 f d c f 9 a 4 a 0 d e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i e u p d a t e r . e x e
Process Tree
-
01cfe04054776c8ae6675363146fc8bd5a7709e6f1c3f807bb18ff4a36760985.exe (1932)
"C:\Users\Administrator\AppData\Local\Temp\01cfe04054776c8ae6675363146fc8bd5a7709e6f1c3f807bb18ff4a36760985.exe"
- ieupdater.exe (2660) "C:\Users\ADMINI~1\AppData\Local\Temp\ieupdater.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 34.107.221.82 |
| 34.117.188.166 |
| 34.160.144.191 |
| 35.244.181.201 |
| 34.107.243.93 |
| 34.149.100.209 |
| 101.53.148.4 |
| 124.225.79.126 |
| 8.8.8.8 |
| 45.67.36.197 |
DNS
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 34.117.188.166 | 443 | 192.168.56.101 | 49184 |
| 34.160.144.191 | 443 | 192.168.56.101 | 49185 |
| 35.244.181.201 | 443 | 192.168.56.101 | 49180 |
| 34.107.243.93 | 443 | 192.168.56.101 | 49192 |
| 34.149.100.209 | 443 | 192.168.56.101 | 49198 |
| 192.168.56.101 | 49166 | 101.53.148.4 vinayakweb.com | 443 |
| 192.168.56.101 | 49167 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49168 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49169 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49170 | 101.53.148.4 vinayakweb.com | 443 |
| 192.168.56.101 | 49171 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49172 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49173 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49174 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49175 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49176 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49178 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49179 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49180 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49182 | 101.53.148.4 vinayakweb.com | 443 |
| 192.168.56.101 | 49183 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49184 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49185 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49186 | 101.53.148.4 vinayakweb.com | 443 |
| 192.168.56.101 | 49187 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49188 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49189 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49190 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49191 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49192 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49194 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49195 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49196 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49198 | 101.53.148.4 vinayakweb.com | 443 |
| 192.168.56.101 | 49199 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49200 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49201 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49202 | 101.53.148.4 vinayakweb.com | 443 |
| 192.168.56.101 | 49203 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49204 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49205 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49206 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49207 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49208 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49210 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49211 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49212 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49214 | 101.53.148.4 vinayakweb.com | 443 |
| 192.168.56.101 | 49215 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49216 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49217 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49218 | 101.53.148.4 vinayakweb.com | 443 |
| 192.168.56.101 | 49219 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49220 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49221 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49222 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49223 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49224 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49226 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49227 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49228 | 45.67.36.197 tractari-gagyi.com | 443 |
| 192.168.56.101 | 49230 | 101.53.148.4 vinayakweb.com | 443 |
| 192.168.56.101 | 49231 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49232 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49233 | 124.225.79.126 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49234 | 101.53.148.4 vinayakweb.com | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.101 | 8.8.8.8 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | ae64c7681022cc12_ieupdater.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\ieupdater.exe |
| Size | 48.8KB |
| Processes | 1932 (01cfe04054776c8ae6675363146fc8bd5a7709e6f1c3f807bb18ff4a36760985.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 0cfa8ad0210f44815a07127c9dde1b94 |
| SHA1 | 9ec987f0c7977a7848e15d3a0370501534088a0b |
| SHA256 | ae64c7681022cc12e24160440566fa550c4f3dfc980e6042608c2fde16fa5ad0 |
| CRC32 | CE1B2106 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | cbd26ccf98676b81_94308059b57b3142e455b38a6eb92015 |
|---|---|
| Filepath | C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 |
| Size | 342.0B |
| Processes | 2660 (ieupdater.exe) |
| Type | data |
| MD5 | bc3dc9addc56b43cfec431925667b485 |
| SHA1 | 5874b3f519b017f56196ba916c4dc75250a9006f |
| SHA256 | cbd26ccf98676b8113073442f983ea5b2570be6022267fa0ba54b23a26b16e96 |
| CRC32 | 053002D3 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.