0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.75
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20200126 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200126 | 2013.8.14.323 |
| McAfee | None | 20200126 | 6.0.6.653 |
| Tencent | Trojan-spy.Win32.Zbot.sipca | 20200126 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 56 个反病毒引擎识别为恶意
(50 out of 56 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Downloader.R110839 |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | TR/Crypt.ZPACK.Gen2 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34084.dmZ@a8mwqFii |
| CAT-QuickHeal | Trojanspy.Zbot.16979 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Waski.BAEA@5p2zlv |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.6c3fe6 |
| Cylance | Unsafe |
| Cyren | W32/S-781168a9!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-781168a9!Eldorado |
| F-Secure | Trojan.TR/Crypt.ZPACK.Gen2 |
| FireEye | Generic.mg.96d811c6c3fe68aa |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | TrojanSpy.Zbot.ehyz |
| K7AntiVirus | Trojan ( 0049929f1 ) |
| K7GW | Trojan ( 0049929f1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=86) |
| Malwarebytes | Trojan.Upatre |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.Yarwi.cxctqu |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM07.1.D1A5.Malware.Gen |
| Rising | Downloader.Waski!8.184 (TFE:dGZlOgV9Yfm7jrqPxA) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Zbot-PT |
| Tencent | Trojan-spy.Win32.Zbot.sipca |
| Trapmine | suspicious.low.ml.score |
| TrendMicro | TROJ_CUTWAIL.SM3 |
| TrendMicro-HouseCall | TROJ_CUTWAIL.SM3 |
| VBA32 | TrojanSpy.Zbot |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-04-13 18:53:24
PE Imphash
bd2d0fb6652da7d0284fd7bf88229c4c
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000024cc | 0x00002600 | 6.289742311526304 |
| .data | 0x00004000 | 0x0000095e | 0x00000a00 | 4.441102386749842 |
| .rsrc | 0x00005000 | 0x000004f8 | 0x00000600 | 3.619929129733943 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_MENU | 0x00005208 | 0x000002ea | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000050a0 | 0x00000165 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x404050 DeferWindowPos
• 0x404054 DestroyIcon
• 0x404058 CreatePopupMenu
• 0x40405c DestroyAcceleratorTable
• 0x404060 UpdateWindow
• 0x404064 ShowWindow
• 0x404068 PostQuitMessage
• 0x40406c DefWindowProcW
• 0x404070 SendMessageW
• 0x404074 LoadIconW
• 0x404078 LoadCursorW
• 0x40407c DispatchMessageW
• 0x404080 GetMessageW
• 0x404084 CreateWindowExW
• 0x404088 RegisterClassExW
• 0x40408c DestroyCursor
• 0x404090 PostMessageW
• 0x404094 DestroyCaret
• 0x404098 CreateMenu
Library KERNEL32.dll:
• 0x404000 GetModuleHandleA
• 0x404004 HeapAlloc
• 0x404008 GetProcessHeap
• 0x40400c GetStartupInfoA
• 0x404010 HeapFree
Library MSVCRT.dll:
• 0x404018 _controlfp
• 0x40401c _except_handler3
• 0x404020 __set_app_type
• 0x404024 __p__fmode
• 0x404028 __p__commode
• 0x40402c _adjust_fdiv
• 0x404030 __setusermatherr
• 0x404034 _initterm
• 0x404038 __getmainargs
• 0x40403c _acmdln
• 0x404040 exit
• 0x404044 _XcptFilter
• 0x404048 _exit
L!This program cannot be run in DOS mode.
Rich1I
`.data
ykP@d '
uv<$N1'#A
)4&@7p=r+I8(YZ
G%qhf,$
"$:Jc(4e
[a3/EV-
"}%+uz
HB:5P:AJ
4kc:6^
>Ll4/A6
~f]A%hp
C IuQV8s(*BR
:9Uuy4DV
qpK~lS
SRa}@{zB
0jP$IaD
qkz]HOzT'Fn|Y$JfA
KgKUPOzTsX&}
Ji JNl4+AO
uQuLl]
l4+>C$A{
^*gL7-
J>t]Jx+nP
Jy$@L"!
6r6wK=a
J?|@;9X:ZQ?]Jr
tP_qR2
us=ku}
n$+A$w[
f7+l<7A_
}@t3&
$O>)hf
vv"N,31n;@A DG}N
DVX0v@{
!J;'Ze;tq:
$A6Bbu
i*?)n,Aw.J~4O+TX
b1 A1{
Zep"XB
PVh)D@
PVh)D@
PVhOD@
VSVWj#h
fZuS)AVWAf9
GGEGGEM;r
CA:uUV3W}
FG3@_^]
QTYIu_[3
HWWPSWWh
@@@@C@
@44@`@@A4L<
@3A@@@%@B`%#C@Q@`@A@4%5
@h@@@B@@@@@2A)
@@|@%BA@`@,
`B@a5@@`D@4@
@@B@JD@B{
@A`B@@@M@@%@@4@(0B
4@~G@A`4%@B@Ii@b!
@%B`@@IH@pA@4@`
B@@@O@@@4
A@@@@nI
B@@P@@q`@@@@@A@A`(@@b@A@@%@@8HUPF@}@@@B@@
jUB@.%4@B`@
(@@B@`@4
_@/4o@B
%4A@DAD,@)BA%@@4
B@@@,@20@(A@@`%4Bp
@%@@`@%-8@`A%@B@
%D@`@@A4
A@@@%@B`Ct!@3J@`@A@4%<4P%J@@@B@@@E@!
@@@4B&$ @$%@
@A`@)NA
2@%BA@``.G@
`BEn@4@
@@B--@
`!!@@%@@4@
@t@@@`A
C``bA`4%@B@qK/
@%B`@6#@
}ApA@4@`
A@H-@A4
B@@@ip3`@@@@@A
.5@A@@%@
@D!B@@@@B@@`,pzT7%4@B`@
ADzC@B@`@4-@@I@B
%4A@sU
/#BA%@@4
/0Z@`B4
@%#/@`A
A@@`%4Bem,@%@@`$
Cp4,@`A%@B@@C@`@@A4@&
`A@@@%@B`>J@/@`@A@4%0@@@@B@@@A
>@3@@@4B!3
8s/%@C@%BA@`=
@A`B@)4
@@%@@4@
As@@@`A
4-@@@RA`4%@B@@m@
@%B`@@!
B@s@@@4
A@3%@a5P|A4
B@@!4$`@@@@@A8(`s-@A@@%@!@@@%%0@@@B@@C
%4@B`@
es(2@H@B@`@4a
`s30BA%@@4
@p@@:@`B4
B@@@.%@`hA@@`%4B
A@%@@`@t4s5B(@`A%@B@O
U@Sb@`@@A4.Ta@rA@@@%@B`}@@
@`@A@4%
33%=@@@B@@@Ar.3@@@@4B
@@,%0%@
@A`@Lr-#@<@%BA@`@h@
`B8//T@4@
A(Ar`2DH
@@BA49
@A`B@*Ir,4$
@@%@@4@0"@@@`A
4)@ICA`4%@B@r-8,4*@
@%B`@@(%
B@@@r@@@4
A@3A3=h@
B@@3Y@{`@@@@@A@@Ar!@e@A@@%@aAx|@@@B@@@A=(%4@B`@
@B@`@4Akh
%4A@$R
%BA%@@4
,P@r@,i@`B4
@%5`@KF$!`A
B@@@G,KA@@`%4Baq.@
@%@@`U@@`A%@B@
!-8L@`@@A4Bq@
A@@@%@B`@`@4@@`@A@4%@%3$
@@@B@@@0qA,@@@4B@UaUF%@
@A`%5!d@%BA@`q@$@
@A`B@Lq@%
@@%@@4@
(@@@`A
iA`4%@B@
0q@B)@
@%B`@45FA@4@`
<q@@@4
A@@@0@EA4
B@@6@,@S`@@@@@A
qD,5@A@@%@4`-I@@@B@@$@
%4@B`@
@qNn-@B@`@4
D{?@BqBA%@@4
@O@`B4
<4@`@q`A
@EA@@`%4B@
-{`U@%@@`
@@`A%@B@
E@`@@A4{
/C=@cA@@@%@B`pk@@@`@A@4%@@@@B@@@b@#@@@4B
P pB%@%@
@@,n@%BA@`N(@p@
`BK)@L^@4@
@@B35g
@A`B@pm$@=@@%@@4@B
!@@@`A
4'5@ pbA`4%@B@%@R
@%B`@@
m5@`@pA@4@`
@cpE@@@4
A@@@30U@pA4
B@@@@@5`@@@@@AL@@A@@%@X2@@@B@@]Bp%4@B`@
C@B@`@43A%:@B
%4A@Ap@@@PBA%@@4
'@@.@`B4
A@@`%4Bd/4@@%@@`@=p&@
C@`A%@B@
b@`@@A4.2(P`@pA@@@%@B`F
@8l-~@`@A@4%E!H@@@B@@@CU@p@@@4BiG@T%@
@A`@q`@%BA@`0k8@
@A`B@P@@5@@@%@@4@`
@@5@@@`A
@BbA`4%@B@`Ey
@%B`@qoh+A@4@`
BB*L@@@4
A@@$@P
B@@\bb./`@@@@@A@@`%@O@A@@%@h
@@@B@@/@`AH@A@C%4@B`@
+lK@B@`@4`
%4A@A@`DBA%@@4
B@@@@A@B=A@@`%4BO
%D@`A%@B@
@`@@A4C
(8<A@@@%@B`H@`@A@4%
@C5@@@B@@@*
@@|@%BA@`@
@@B@@2hhE
@A`B@x@@
U@@%@@4@A
A`4%@B@@
@%B`@t
@~A@4@`
BI)@`@
k`@@@@@Am0@@@A@@%@`I@
@@@B@@rE
@@o%4@B`@
9@(@@B@`@4T|g2r
%4A@pJ
%A`@GBA%@@4
B@@@U`EA@@`%4BB
L@%@@`
d,C@@3@`A%@B@
@`@@A4@#g%g#A@@@%@B`
@`@A@4%a*
|5BoX@@@B@@@HB#-@s@@@4B(5x%@
@A`%33@%BA@`k8@
`B%@55o@4@
@@B|,1@E
@A`B@@B,%,@
@@%@@4@
@@@@`A
`@oA`4%@B@(C)(j`@
@%B`@@
CA@4@`
B@@UA<@@@4
B@@hb0@
`@@@@@A<
|B4o@A@@%@U+A@4@s@@@B@@B
%4@B`@
@B@`@4g@@
%4A@xA
BA%@@4
@@OA@@`%4B
@%@@`@AB@L
@`A%@B@
,BHy@`@@A4@44A@@@%@B`/xH2
@`@A@4%#@@@@B@@@Ao@@@4B&%@<%@
@A`A@%BA@`|4.bB!@
@@Bb)/
@A`B@@}
@@%@@4@%2
@@@@`A
430McFLA`4%@B@,3@@5AB!@
@%B`@7|@BLA@4@`
B@&Cg@@@@@4
A@2bs2bA4
B@@uTL}@@`@@@@@AUdx3N@A@@%@
@@@B@@3].@U%4@B`@
{%@B@`@4%b5
%4A@#r0
PBA%@@4
@A@`B4
B@@@5)A@@`%4B
%b DE@%@@`5
.@`A%@B@Fd@`@@A4K`
A@@@%@B`b
%@@L@`@A@4%@2
g@@@B@@@Hd/@.@@@4B`LJ4@
@%BA@`M!
`BM29b@4@
@A`B@GKBB@@%@@4@$)4@@@`A
4@KA`4%@B@U/.#
@%B`@6-)%`A@4@`
B(L@@@4
A@`-2@PA4
B@@5d`@@@@@A
$)L@A@@%@O
m@@@B@@
%4I%4@B`@
h`2@B@`@4. K@B
%4A@@s.)%GBA%@@4
@%)T2,`A
B@@@c`D@`@2A@@`%4B
R@%@@`@.G@`A%@B@5@@U@`@@A4d54
@@A@@@%@B`
2b@`@A@4%Idc5@`}@@@B@@@@x@@@4B=`%@K%@
@"@%BA@`6$@@
`BAt`,
ARh4`@i
@A`B@,
B@.@@%@@4@%C@@@@@`A
4*@.6A`4%@B@@c
B@@A@`.%@@`@@@@@ARL-/
@c@A@@%@
h!)@d@@@B@@
A2%4@B`@
G\@ @B@`@40'@F@D@B
%4A@R/DBA%@@4
@c*I2@U@`B4
B3@/@c<=)0,@`C
3@A@=@a%
,A,F@@B%),
cK@2a6%i5
E)4@II2)<@{
N%E@@@@hIec@E@O_@Tc8@N@B
@|00@O1@`-ec
@@@@@AB@@
#@@cp`2T9
@HX3{4B@U2@)
@tn2hOc
5CIR\@#@@G@(%@B@ N@
hSVWe3
EEP5E@
EPEPEP
0u>"u:Fu
<"u>"u
> vFuj
@3dEcL|3i2
`h@`,$h\A@`2L@
U0H4Te_
+~d x|$x
@%UVk}PtmgYGk
Z?$ |$o
|$,<49H
d h|$"<d3H,
d h|$/'<0Hl
=$ a<$I
L=$ <$
v<$ p<$
<$H<|_Hd_
|d T|$H<_Hhd_
UVk}Pesd_$Q
:@*@`)/5
NF3-@@,EE5_@bE-`p@s
@DA@$(p@v%.
CreateMenu
CreatePopupMenu
PostMessageW
DeferWindowPos
DestroyIcon
DestroyAcceleratorTable
DestroyCaret
DestroyCursor
RegisterClassExW
CreateWindowExW
GetMessageW
DispatchMessageW
LoadCursorW
LoadIconW
SendMessageW
DefWindowProcW
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
HeapFree
GetModuleHandleA
GetProcessHeap
HeapAlloc
KERNEL32.dll
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetStartupInfoA
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
L!This program cannot be run in DOS mode.
i2h:2h:2h:2i:gh::1h::3h:)%:"h:)%:Ph:)%:
h::3h::*h::3h::3h:Rich2h:
`.data
@.reloc
otools\inc\nlg\private\inc\msfsa\faarray_cont_t.h
otools\inc\nlg\private\inc\msfsa\falextools_t.h
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
bad exception
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
Unknown exception
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
nlg\lib\msfsa\faallocator.cpp
nlg\lib\msfsa\farsdfa_pack_triv.cpp
otools\inc\nlg\private\inc\msfsa\faarray_cont_2xresize_t.h
nlg\lib\msfsa\famultimap_pack.cpp
Internal error.
Object cannot be initialized.
Limit size has been exceeded.
Out of memory.
Object is not ready.
]ut5p?
W3+t#Hu7Vu
^3[UQE
V3WM0u
UVW39~
<|uCt7
t79V$t2h
M 3UE9J
MA3;~\U
E;}q}M
PE @PE
MPE+@PE
G;}|}]}$
F;}^U9]
z;~\;}T;]
Yt]U]U]
EVW3EP
p i s k e r
r o d d a r
q i s t e n
d o b o t e
l u t u r y
s i n t a s
x o v d i n a
d e w j t s
T r o o t s
n e t t o r e s
w o v o r e h o r s e
b u t t o n
s t a t i c
l i s t b o x
C t r l + Z
C t r l + X
C t r l + C
& P a s t e
C t r l + V
& T o o l b a r s a n d D o c k i n g W i n d o w s
< p l a c e h o l d e r >
& S t a t u s B a r
& A p p l i c a t i o n L o o k
W i n d o w s & 2 0 0 0
O f f i c e & X P
& W i n d o w s X P
O f f i c e 2 0 0 & 3
V i s u a l S t u d i o 2 0 0 & 5
V i s u a l S t u d i o 2 0 0 & 8
O f f i c e 2 0 0 & 7
& B l u e S t y l e
B & l a c k S t y l e
& S i l v e r S t y l e
& A q u a S t y l e
& A b o u t m f c 1 . . .
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ H h X X 9 T x s 0 . e x e
C : \ 8 c 4 8 5 a 5 9 0 9 0 7 7 a e 8 d d 2 c 4 5 b 4 6 8 6 b 5 9 3 c 4 b 7 2 8 b 2 a 1 6 6 a 9 2 3 2 3 2 3 0 5 b f 8 f f c 7 c 5 d 1
C : \ 7 0 4 d a 2 d 4 d 3 e 3 7 d 7 3 5 d 1 9 4 8 9 6 f d b 0 0 7 b 0 f 0 7 c 7 4 9 f 2 7 b 4 a e 3 f 7 f 8 0 1 e 3 2 d 9 c 9 5 2 7 3
C : \ 9 4 f 1 a c 0 b 6 c 8 3 d d 6 a 6 3 2 d 8 1 2 b d 7 a 7 f a 2 1 c 9 2 b b 3 0 6 a 7 1 a d 1 4 7 e 5 0 f b 6 9 9 3 9 a 8 6 a f 1
C : \ l 5 7 Y 3 S V B . e x e
C : \ w a V K U b D M . e x e
C : \ z 8 r n 2 D U e . e x e
C : \ n p c U u p a 8 . e x e
C : \ M g _ 6 H z 8 _ . e x e
C : \ Y R u L o p n A . e x e
C : \ B H y s o K b Y . e x e
C : \ O a R t n T A n . e x e
C : \ u 7 q O v F E C . e x e
C : \ R X B x W j s G . e x e
C : \ n H _ O R b _ 5 . e x e
C : \ R W B M w v v h . e x e
C : \ o G 4 R L r a d . e x e
C : \ n 8 6 4 P q o 1 . e x e
C : \ L I Z V a J G q . e x e
C : \ h m P 5 d s P t . e x e
C : \ T p v y U X y B . e x e
C : \ z W a 8 g u o X . e x e
C : \ P j X k q Q u k . e x e
C : \ r 2 W 5 j a a 1 . e x e
C : \ a U 3 3 v v T M . e x e
C : \ 2 p e J W Q y L . e x e
C : \ y h K V 3 F 0 Y . e x e
C : \ c B 4 K s O P e . e x e
C : \ P R H f W Z S O . e x e
C : \ M j v J _ Z j M . e x e
C : \ 0 P O d l K L x . e x e
C : \ c d D 6 3 j _ M . e x e
C : \ a T w y Z v q x . e x e
C : \ X 4 i a e K H 4 . e x e
C : \ 9 z x j o A 9 u . e x e
C : \ 7 3 6 2 5 2 9 f 6 2 1 c 5 1 0 6 e 0 a 5 0 c 0 b 4 4 6 c e 8 2 5 4 7 b 0 e a d 0 8 2 b 7 a e 7 a b 3 5 d c f 0 f 1 b 2 8 3 9 8 7
C : \ e c 3 a 7 2 0 0 e 8 7 e d 9 d c 3 f c 3 2 8 d a 3 8 a 1 c 1 f a 7 e 5 b 5 b d c a 7 d f b e c 2 7 1 f b 8 9 d d 0 0 3 8 f a 6 4
C : \ G I N A j Q g c . e x e
C : \ 7 f d a d 8 4 a 3 0 e 8 8 5 e b e e 2 1 d c 1 0 5 8 f 4 9 e 0 2 e 7 a 0 1 9 a c a f 4 a f f a c 4 d 6 6 6 d f 3 4 1 7 0 d c 3 f
C : \ o j l 8 U z 7 6 . e x e
C : \ K X E M J v 5 7 . e x e
C : \ F E 3 j b l r C . e x e
C : \ M 7 t _ K p a k . e x e
C : \ j Z _ N U w X P . e x e
c : \ g d w 8 x e \ p b z g r c . e x e
C : \ 5 c f c b f 9 a 0 a 8 e 5 b 9 8 6 b 9 d b 3 e 7 2 b f 2 1 6 c 9 e c f c 4 3 5 a d d 1 f 3 3 0 f 3 8 f d 9 0 c 7 0 8 6 b d c 8 e
C : \ o 3 d y P 5 X C . e x e
C : \ M T b q a 8 4 I . e x e
C : \ a 8 e f c 5 3 c 2 0 e a 8 6 0 6 2 b c 3 b b 7 9 c 8 c d 6 4 1 5 1 6 4 3 2 c f 9 1 9 3 5 d 4 b 3 b e 7 2 b 0 8 b 6 a c 7 5 4 b 6
C : \ A Q 9 n n H l V . e x e
C : \ 7 3 d 5 9 9 a c 9 8 6 a 6 d 4 8 d 8 6 4 a 9 0 0 2 2 1 3 3 3 b 1 8 2 d 7 f a a 9 8 c 3 7 4 4 1 b 8 2 6 a f 3 7 e c 2 9 5 e e 5 e
C : \ e 1 7 c 9 0 5 b 3 4 1 5 c e 2 2 4 0 b 7 6 7 1 3 d b e 7 3 1 1 3 3 f f a 3 f f 9 f 2 9 d e 2 4 1 5 1 6 1 5 f c 9 4 a f 4 8 1 e e
C : \ 3 b 4 4 5 9 6 1 a a 0 4 9 4 8 0 7 b 7 1 b c 7 b f b 0 8 1 c f b 1 1 5 8 7 4 1 c e f 8 0 1 b a e 1 8 d 9 a 2 2 7 b f b c c 1 3 4
C : \ N f A s Z G 5 o . e x e
C : \ c b 6 a 8 c 0 4 3 7 5 c 9 0 b e b 2 0 d 4 2 7 a 2 b 8 a 8 e d 3 f 3 3 a b 1 3 1 6 5 d 5 c 6 7 7 6 d 4 3 b 6 1 d b 0 4 2 6 4 6 a
C : \ 3 c d f e 6 3 9 5 4 c d f e 8 9 8 a 2 8 1 9 7 d 3 7 e 2 c d f e 0 a 3 1 c 9 e 4 1 d f 1 9 d 6 e b 5 0 4 e 0 3 a 5 6 0 b 2 5 b c
C : \ r X r a n 5 0 9 . e x e
C : \ c s 7 E H N E I . e x e
C : \ U s e r s \ A d m i n i s t r a t o r \ A p p D a t a \ L o c a l \ T e m p \ c u c k o o - d 8 d 0 9 8 c 6 d 2 3 7 6 4 8 6 f f 2 b d a b 6 4 d 2 a f 5 5 b 5 5 9 e 7 8 9 f 4 7 d 9 6 f 9 b 4 8 6 3 2 1 c 5 0 7 a 5 9 8 0 0 . e x e
C : \ b b 6 4 c a 4 1 b 3 8 d c 4 d d 0 7 d 7 6 4 e 3 a 1 3 f 4 c d 3 a 1 b 2 4 c 4 4 7 3 e 8 b f 6 1 4 6 0 a 6 1 8 6 c 8 e 6 d e 1 e
C : \ 9 3 e 5 9 f c b f b f b b b 2 2 4 6 9 b 0 4 b 1 0 c 4 7 5 1 2 1 0 8 f a d e 4 0 6 a 7 8 d b 6 4 3 e 9 f d 3 6 5 8 5 8 d 7 b 9 0
C : \ 1 8 c 4 a f b 5 e 5 a 6 7 b 5 b c a 2 a 2 a 9 3 d e 6 3 a 2 0 3 5 b 8 6 f 7 2 7 4 5 8 a b b 4 8 d 1 a a 5 f 6 c b 5 6 3 9 d a 9
R E S O U R C E _ F A T O K E N I Z E R
K E R N E L 3 2 . D L L
s m s c o r e e . d l l
n r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
W U S E R 3 2 . D L L
( ( ( ( ( H
C O N O U T $
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 e 8 5 9 f c 2 4 1 0 4 b 7 5 9 3 7 e 4 0 3 0 4 e c 4 0 1 e e d c 8 0 d 7 b 4 1 e 8 4 d 2 b 2 5 2 6 1 b d a 1 1 b 8 0 f 1 f 8 5 . e x e
C : \ 8 8 d 7 4 7 4 b 7 9 e b 6 8 a 7 a d d 4 9 6 4 3 1 0 0 4 a 1 b 1 a 2 c 1 a c 6 d e e 3 9 0 2 e a e b 7 3 d 5 c 8 3 a 3 1 0 8 1 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ l a s m a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 7 d 9 6 8 1 2 3 b 3 3 a 7 6 0 _ l a s m a . e x e
C : \ 3 7 7 f 1 c 6 4 9 5 0 a 2 1 6 e 7 d 1 b 6 0 f 6 4 2 a 5 2 a a d 4 f 2 8 9 a 4 c 7 c 6 2 5 a 3 a 7 5 f 0 0 c 4 d f 5 1 6 d 7 1 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ l a s m a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ l a s m a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 7 5 7 c f d 7 4 b 9 5 0 4 6 4 _ l a s m a . e x e
C : \ 4 7 3 d 8 8 e 3 c d d 5 e c 3 0 7 6 b 8 b 4 2 c 8 8 9 9 5 5 8 a 9 6 7 5 a c 5 f a 4 4 6 e a 3 e d 7 1 1 0 5 4 d 9 3 b 5 9 c 4 a
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ l a s m a . p e 3 2
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.