0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.56
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Crypt-QGT [Trj] | 20200423 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200424 | 2013.8.14.323 |
| McAfee | Downloader-FSH!9FC70D69E84A | 20200424 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b8f251 | 20200424 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意
(50 out of 59 个事件)
| ALYac | Trojan.GenericKD.1438803 |
| APEX | Malicious |
| AVG | Win32:Crypt-QGT [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1438803 |
| AhnLab-V3 | HEUR/Fakon.apf.X1353 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Generic.D15F453 |
| Avast | Win32:Crypt-QGT [Trj] |
| Avira | TR/Dldr.Upatre.1 |
| BitDefender | Trojan.GenericKD.1438803 |
| BitDefenderTheta | AI:Packer.19D9120F21 |
| Bkav | W32.AIDetectVM.malware2 |
| CAT-QuickHeal | TrojanPWS.Zbot.Gen |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.b@5e4we9 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.9e84ae |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| Cyren | W32/Trojan.YQED-1486 |
| DrWeb | Trojan.DownLoader10.59247 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.GenericKD.1438803 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.GRJ |
| F-Secure | Trojan.TR/Dldr.Upatre.1 |
| FireEye | Generic.mg.9fc70d69e84aea0f |
| Fortinet | W32/Krptik.AIX!tr |
| GData | Trojan.GenericKD.1438803 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Bublik.guu |
| K7AntiVirus | Trojan-Downloader ( 0048f6391 ) |
| K7GW | Trojan-Downloader ( 0048f6391 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=83) |
| Malwarebytes | Trojan.Upatre.Generic |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FSH!9FC70D69E84A |
| MicroWorld-eScan | Trojan.GenericKD.1438803 |
| NANO-Antivirus | Trojan.Win32.Bublik.cqlhrb |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM07.1.C61B.Malware.Gen |
| Rising | Malware.Heuristic!ET#84% (RDMK:cmRtazrzYcSlbXN2jPVPgs9WLNlZ) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Zbot-OE |
| Symantec | SMG.Heur!gen |
| Tencent | Malware.Win32.Gencirc.10b8f251 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-12-05 06:02:36
PE Imphash
e021f0eaee5b572801189e8fe129c124
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000edc | 0x00001000 | 6.063466403760832 |
| .rdata | 0x00002000 | 0x00000fa6 | 0x00001000 | 6.576124974521824 |
| .data | 0x00003000 | 0x00000808 | 0x00000800 | 5.994314616147633 |
| .rsrc | 0x00004000 | 0x00001104 | 0x00001200 | 4.948198926141509 |
| .reloc | 0x00006000 | 0x000000f8 | 0x00000200 | 2.880499220392888 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000040ec | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00004f94 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x00004fa8 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library MSVCRT.dll:
• 0x402024 __p__fmode
• 0x402028 __set_app_type
• 0x40202c _except_handler3
• 0x402030 _controlfp
• 0x402034 __p__commode
• 0x402038 _adjust_fdiv
• 0x40203c __setusermatherr
• 0x402040 _initterm
• 0x402044 __wgetmainargs
• 0x402048 _wcmdln
• 0x40204c exit
• 0x402050 _exit
• 0x402054 _XcptFilter
Library KERNEL32.dll:
• 0x402008 GetStartupInfoW
• 0x40200c GetModuleHandleW
• 0x402010 VirtualAlloc
• 0x402014 HeapFree
• 0x402018 GetSystemPowerStatus
• 0x40201c ExitProcess
Library USER32.dll:
• 0x40205c DefWindowProcW
• 0x402060 DispatchMessageW
• 0x402064 DrawTextW
• 0x402068 GetClientRect
• 0x40206c GetMessageW
• 0x402070 PostQuitMessage
• 0x402074 RegisterClassExW
• 0x402078 SystemParametersInfoW
• 0x40207c TranslateMessage
• 0x402080 GetSystemMetrics
• 0x402084 CreateWindowExW
• 0x402088 CharLowerW
Library GDI32.dll:
• 0x402000 Rectangle
L!This program cannot be run in DOS mode.
~vRich~v
`.rdata
@.data
@.reloc
WZ#M37I
3U-p7@
MEU-MEU
EEdWZM
`pWYa3
upx[P]
EEd^VYU
UEMwSZ
SSQQQQh
UEEiWY
EEdVZU
UEMWZ#
UEMUEM
Ujhp,@
hSVWe3
EEP57@
EPEPEP
uf>"uE
YY3%, @
aaW&dI
eFa?#V[aaaa
GetCurre
cto(ryW
eleHani`
lstrcm
212?2K2Y
2^2f2o2
SiAEEA
UUuEt>U
;rr-ur
HpXhk^E
u=|EVYU
\QA3#;
RHVZZ+
;u+J;uu]
uttutt
Utt>|ESZU
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
ExitProcess
GetSystemPowerStatus
HeapFree
VirtualAlloc
GetModuleHandleW
GetStartupInfoW
KERNEL32.dll
CharLowerW
CreateWindowExW
DefWindowProcW
DispatchMessageW
DrawTextW
GetClientRect
GetMessageW
PostQuitMessage
RegisterClassExW
SystemParametersInfoW
TranslateMessage
GetSystemMetrics
USER32.dll
Rectangle
GDI32.dll
KERN`EL32.
tt(pQup
tOptio
Mwt>|;
X`u-EUXnlMj-E
uM=|EEEM
T$M[*h&K\
3MPPWMM
c<-t+#5ME
QRE5QE
Ji]JJJ`yx
6}}}}}|f00}}}}}}}}}}|G11|}}}}}}}}}}}}}508w}}}}}}}}}}}}}}38Gj}}}}}}}}}}}}}}}38jg}}}}}}}}}}}}}}}4FfG}}}}}}}}}}}}}}}}}9:9h}}}{q{{q{{q{{{{{{bEK{{{{}{{nnnnnnnnnnnnnnnnnnnnnq{}}}}}}}}
l{}{{{{{{{
w{{l{ppppppq
q{qpnlUUUUln
pqnlTRQQQRTX
pplRQNMMMORV
pnTQML
nlRRQRTpp
!!!!!!!!%d!%iz!!
!!!!!!!
""""""""D"~=""A"""""""
lUQ{W"##############################"lUQ{k#5555555555555555555555555555555nURn5<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<5llnplllllllllllllllllnllqpn{p{}{{{{{{{{{{{{{}{{}{{qqo{{{{{{{{{{{{{{{{}{}{{{m
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
0#0F0[0k0W11
2a2222a3y33374
6$6)6/646>6Q6a6f6
;M;[;<<<<<
=!=(=3=:=@=K=P=Z=g=y=~====
>!>A>H>N>r>x>~>>>>>>>>>>>>>>>>
r
X u b a m i
F o w a x u v a l
C : \ U s e r s \ d e l t a m \ A P P D A T A \ L O C A L \ T E M P \ w z 9 d 9 6 \ I n v o i c e _ 0 5 1 2 2 0 1 3 . e x e
C : \ 4 I b C 2 n P v . e x e
C : \ f 0 X f J k z t . e x e
C : \ 2 t a g V F w D . e x e
C : \ J S c F 4 W x r . e x e
C : \ 2 e I D 2 b R 5 . e x e
C : \ v p K y 1 1 t C . e x e
C : \ q 1 a W n j 7 X . e x e
C : \ j C c 9 f 2 j j . e x e
C : \ 7 m W c S T n 4 . e x e
C : \ K b 1 d Q i V H . e x e
C : \ v 6 u t a V R Y . e x e
C : \ b 9 9 a 9 9 1 4 6 0 f d 3 3 b 1 5 b 0 9 9 b b d d d 6 e 7 e 7 3 4 b d d 1 0 3 8 5 2 d 0 9 a 6 9 1 c b a d b 5 1 4 b c 1 8 f 0 4
C : \ e 3 9 3 0 7 0 7 b 9 4 e f 3 0 e 7 0 c 0 2 3 9 7 b 7 f 3 0 3 7 0 d e 8 d 7 a e 0 e 2 1 8 2 c 2 2 6 8 2 c c 3 b d e 5 c 9 c b d 2
C : \ 5 9 6 4 b 3 b 7 0 6 d e 0 8 f 0 8 0 c 6 c f e a 6 7 a d 3 e 2 e 3 7 a f 5 d b 8 4 d 7 8 f 2 4 9 3 0 a 9 2 9 f 2 d 2 3 7 9 c f b
C : \ j _ 7 m J 7 d h . e x e
C : \ F R p 4 Y i U J . e x e
C : \ L w v 1 V X f d . e x e
C : \ R 5 J I z T i g . e x e
C : \ y 8 Z f G W y D . e x e
C : \ m O H r 7 V O 6 . e x e
C : \ j 3 W s I N Q z . e x e
C : \ 5 U G X l g M Q . e x e
C : \ H T Q _ 5 p g z . e x e
C : \ 1 M 8 2 n 9 2 m . e x e
C : \ S 9 G L x I 1 X . e x e
C : \ n i 8 7 J 0 e r . e x e
C : \ 1 t k P d K S B . e x e
C : \ n S 9 g n x G a . e x e
C : \ D 2 S L H A E K . e x e
C : \ P n s f b Y v q . e x e
C : \ H i p O F Q r p . e x e
C : \ 7 I Y O c R j n . e x e
C : \ b N k w 6 0 p K . e x e
C : \ 2 Z g l o g y R . e x e
C : \ d 5 2 4 5 e e b 8 4 c b 4 0 4 d 1 8 d 4 6 0 d 4 f d 1 0 9 e 8 c e d b 3 8 5 d a a e 2 1 7 e 5 a 1 8 2 7 9 f 2 7 1 2 e 3 2 2 a 5
C : \ G 3 t s 9 n p n . e x e
C : \ H E g d Z _ Q L . e x e
C : \ K u m u O 4 S Y . e x e
C : \ y b 8 I u 7 U z . e x e
C : \ S L 3 3 N a i I . e x e
C : \ d 3 6 7 b 6 f 3 c c 1 c e 7 1 9 0 e a 8 5 b b f 0 8 c 4 6 a 9 f 9 f c 6 3 1 5 e a f 6 3 4 6 a 2 8 3 4 b e f c d 4 5 b b 6 3 2 8
C : \ a 7 9 8 7 7 4 5 7 8 9 5 b 0 2 0 b 3 9 1 7 2 9 9 4 0 2 3 5 a 3 4 2 9 5 7 8 7 1 5 a e 0 f 7 d 5 9 b 9 d f 2 f 9 9 f e 8 e 8 8 f 9
C : \ 1 d f 8 4 7 7 2 3 6 4 6 c d 0 d 5 6 c 3 5 2 d a 6 b 2 a 2 6 f 1 9 d a c b 8 7 6 e 2 1 3 6 e 5 6 0 9 4 9 4 9 0 5 7 9 b e 8 5 8 4
C : \ e 9 c f 5 c 6 b 7 e f c 6 5 2 4 b c 3 6 0 e 3 b f b d a f 3 7 b 4 8 9 3 4 6 d 5 d 8 e 9 2 b c 9 3 a 5 0 6 d 5 c 5 5 5 c 4 5 1 5
C : \ S 8 G 0 K I l H . e x e
C : \ N y O m E t T 6 . e x e
C : \ W I w o U B Q I . e x e
C : \ l 2 3 j P 1 P 5 . e x e
C : \ 9 s C f w N 8 T . e x e
C : \ v 0 Z w 8 a c x . e x e
C : \ A Y 8 x 4 D R 2 . e x e
C : \ 8 U s H h E 5 6 . e x e
C : \ k p Y X w E 3 T . e x e
C : \ d y Z U 4 A P S . e x e
C : \ B T 0 n 4 C f 8 . e x e
C : \ M C x z z v 5 h . e x e
C : \ 7 C D h b f H M . e x e
C : \ C d z V F w N 4 . e x e
C : \ t i E I q n a E . e x e
C : \ n H i Y a 6 o b . e x e
C : \ W t r L O t 3 f . e x e
C : \ u t F V f T h M . e x e
C : \ k q V N e J j K . e x e
C : \ g B S J A P i R . e x e
C : \ r M x i o w e N . e x e
C : \ 9 L 7 Z d 2 n Z . e x e
C : \ W p T m E 1 H L . e x e
C : \ W m r h z d M f . e x e
C : \ C a o y a 8 u V . e x e
C : \ M s k 5 4 U q i . e x e
C : \ 5 q 9 n 2 5 j 9 . e x e
C : \ 6 _ O q P M R t . e x e
C : \ P X D 1 u s Q b . e x e
C : \ g W O G B X I P . e x e
C : \ k _ 6 9 E y 6 S . e x e
C : \ C N M g t x d G . e x e
C : \ n S Q u c s 2 z . e x e
C : \ I b b b r L F j . e x e
C : \ I x 6 y K 2 Z Z . e x e
C : \ V M N J 4 G z z . e x e
C : \ 5 9 j z X R X l . e x e
C : \ p F 1 X n J _ u . e x e
C : \ n 8 M Z M K R G . e x e
C : \ J Q w z N v K w . e x e
C : \ 9 P c t k L v 0 . e x e
C : \ p n t v 7 R V P . e x e
C : \ 3 0 x i 7 V i O . e x e
C : \ N R w J R o 1 z . e x e
C : \ g 6 Q i i u p q . e x e
C : \ V 6 f p _ V Q d . e x e
C : \ M 7 g y _ 6 t Y . e x e
C : \ v U E a g U y 9 . e x e
C : \ R w K F j 3 Y C . e x e
C : \ O 1 W P r J I 6 . e x e
C : \ n I 8 q q 4 l 4 . e x e
C : \ E _ V 7 S A y u . e x e
C : \ r 9 3 u H O Q l . e x e
C : \ B C o B u s c t . e x e
C : \ l E x f K 6 j A . e x e
C : \ T g L N p D 2 H . e x e
C : \ U g q r m W 6 A . e x e
C : \ h m b i f d v L . e x e
C : \ j O P e _ d f E . e x e
C : \ X t i 5 P f G v . e x e
C : \ f F f R f i K G . e x e
C : \ k 4 S K M E 8 4 . e x e
C : \ h J V I h S 8 y . e x e
C : \ h v S r 8 L H C . e x e
C : \ y t 2 2 c z h V . e x e
C : \ D 1 1 _ Q x J S . e x e
C : \ K l a A k w G 8 . e x e
C : \ R k 8 R X C v k . e x e
C : \ X u O J B S a C . e x e
C : \ Z D Z u w P R g . e x e
C : \ b e l t _ T 9 Z . e x e
C : \ 0 v j X y l k h . e x e
C : \ c 6 R z D r 7 2 . e x e
C : \ U 3 F Q e r D B . e x e
C : \ P 4 c 4 M a m m . e x e
C : \ E a 9 l r R 1 l . e x e
C : \ Q G r W N X K j . e x e
C : \ u 4 T Z I m Z R . e x e
C : \ m y b I b P J N . e x e
C : \ 6 h 6 w J z 5 d . e x e
C : \ c a B M q 1 Z l . e x e
C : \ q s m 9 X q L T . e x e
C : \ i F 1 C G p B 8 . e x e
C : \ j t G L n r S r . e x e
C : \ s Y Q Z X m 5 e . e x e
C : \ n q W m w 1 x M . e x e
C : \ Y q U H j H i n . e x e
C : \ a I V D D 9 L O . e x e
C : \ p x Z w 2 Z d y . e x e
C : \ G 5 y h b X 1 V . e x e
C : \ e W 2 W k E b _ . e x e
C : \ s H e b O w J C . e x e
C : \ c N X 0 _ 5 N J . e x e
C : \ F u d K Q s 9 o . e x e
C : \ J x R C p U u s . e x e
C : \ N Q a m Z J q X . e x e
C : \ d c c 1 5 d 4 2 9 4 0 a 8 2 4 2 1 f d f b 4 1 c 5 8 2 e b c 9 5 f f 5 8 8 d 1 a a f c e 6 8 1 7 2 9 b f 4 6 2 3 a b e 6 9 2 5 a
C : \ 0 2 c b 4 0 0 d 8 9 b 7 f b d 9 c e 0 c 2 1 5 5 f f a d 6 8 4 5 1 1 d 1 1 8 f f a e 0 2 f 8 d 3 9 3 6 c 9 4 a d b 2 3 d 2 9 d d
C : \ 2 f R 9 _ 4 n Z . e x e
C : \ 9 W 6 S h 6 u 6 . e x e
C : \ 7 O h V g 8 r V . e x e
C : \ b q K P j 3 N z . e x e
C : \ D s 8 o Y V L E . e x e
C : \ 3 6 e f 5 b f 0 c 8 5 b 2 f 9 1 8 3 e 6 f a 1 2 0 6 f 8 2 4 7 0 0 5 1 f a 0 9 3 c d f 3 d 8 8 6 1 f 1 a b 3 0 3 e 3 a 9 6 e 0 b
C : \ N m k N 1 E 4 g . e x e
C : \ 6 8 8 3 f 0 4 d 3 1 4 1 d 0 b 4 0 c 3 9 b e c 7 8 6 7 1 3 4 6 2 c 7 a c 3 a 1 4 a f f 8 3 6 5 e f c 7 9 b 3 9 f f d 0 e 8 9 e a
C : \ d 1 d 8 3 3 f 2 3 a 3 b 9 4 a 0 a d 2 1 b 0 c 5 c f b d 9 c b 0 4 5 1 9 4 0 9 f 9 0 a d c e f 6 2 f c 5 1 c d 3 3 e 9 2 9 3 f 4
C : \ B g X t k k U H . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 8 8 6 7 e 9 9 c 1 5 1 7 6 d f 7 d 2 6 f 5 5 7 d d 2 8 8 5 7 8 f 1 0 7 3 0 7 1 0 6 1 b e e 7 5 5 3 5 f 5 c e 5 b 6 8 5 b c c b 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ f 5 5 a 8 1 a c f 0 b 0 4 2 8 f 2 2 c 6 0 d 2 a c d 4 a e 0 f 6 0 0 5 f c 3 b 0 3 b 7 a 2 4 f 6 e d 2 9 3 1 c 2 5 c f 2 0 6 b 4
C : \ 9 5 b 9 7 d a 2 e 1 1 4 5 7 3 f f a 8 b 8 2 c 6 5 7 2 8 e 4 5 a 7 9 3 9 8 0 5 a 1 2 8 6 6 6 7 b 6 5 b 5 1 3 f 3 8 6 a f 4 a 4 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ U E D x F U 7 L d R . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 8 5 8 f 6 a e d b 2 9 7 e 8 3 6 7 a e e 6 a 2 9 3 8 e 2 1 1 3 . v i r u s . e x e
C : \ 6 f 1 d b d 4 1 d 2 5 5 c 1 6 9 a 8 f 5 7 0 3 a e 9 b 6 5 7 2 f 9 c 9 b c 2 3 2 e 0 a 3 8 4 4 1 1 0 5 2 c 1 7 2 8 6 9 2 f 5 0 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d s . e x e
C : \ 0 3 1 e 4 d d 5 6 b e 5 9 e f 5 8 7 d b c 0 9 b b 9 6 8 4 d d 4 0 7 5 8 7 5 f 7 1 7 d f 3 0 b 5 0 7 c d f a b 8 0 c 2 2 7 f d f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 1 4 3 9 6 c f b b c 5 c a 4 f _ p d f u p d s . e x e
C : \ 4 6 5 f 3 6 9 5 8 a 6 4 b b b a b 6 1 0 8 6 d 2 2 9 f e 4 e 9 8 2 d c 8 c 9 0 4 7 d 2 c 6 f 7 d 9 9 3 3 3 f b 4 6 b 0 3 a 1 5 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d s . p e 3 2
C : \ 4 b 6 9 b 6 a 7 d c 0 4 2 d 3 8 d b 9 5 5 6 b b d 6 b 8 1 c c b f 1 c 1 1 6 6 8 c c d 7 f 9 a 0 9 c 5 0 9 5 c b 4 5 a 5 4 9 2 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d s . e x e
C : \ 2 f 3 f 0 3 2 5 0 0 6 e 4 4 0 f 8 a 4 e d 0 7 1 e 6 9 d c b 8 8 1 c 1 3 4 9 8 c 9 8 b 4 8 b 9 1 2 c 4 5 2 8 e 6 2 0 6 5 d 5 d 5
C : \ 6 1 3 8 8 5 8 4 c c 0 d 5 1 9 c 6 7 d 1 d b f a c 3 2 e e b 2 0 9 9 c 6 b e 0 a 3 3 a 5 6 c 8 8 3 c 0 8 4 e f c 8 e 0 6 0 e c b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d s . e x e
C : \ e 6 6 7 8 7 a 0 4 1 6 b f 5 8 5 9 3 5 3 4 7 b f 0 4 b 2 a 4 6 b 3 5 c 0 b 9 7 8 8 e 0 a 1 7 2 f c c a d 3 a 1 9 6 8 2 6 a 7 d d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d s . e x e
C : \ M Q P r a Q n n . e x e
C : \ 8 b 5 6 8 0 7 d 7 e 6 9 4 1 1 e e 5 2 6 c 4 e 3 f 8 5 b b 8 d 0 b d 6 8 e 6 c e f 8 c b 5 f 4 a a c 5 4 4 2 c 8 6 0 4 2 2 8 1 d
C : \ 0 2 7 7 b 9 5 c 5 4 8 7 b 9 9 c 6 9 1 2 b d 0 c 5 4 a 0 f c 9 5 c b 8 9 2 a b f a 1 a a 7 1 9 0 a c c f 9 e 9 6 5 5 e 1 4 e 4 e
C : \ d 4 d b 8 c 8 f c 7 e 2 e f f e 3 3 a b 9 f 3 e f 6 c f 0 c 2 3 d 7 b 1 5 6 a 5 2 5 c e 8 0 1 a b 9 7 4 6 6 5 b f 3 2 4 9 7 b b
C : \ b 1 4 f 6 c 1 0 0 4 b 8 c 3 7 e e c 1 4 d 5 b f 5 2 4 0 1 0 6 6 7 a c d 5 5 d a 4 d 5 f c 7 8 a 8 4 4 7 7 7 c 4 4 c 9 e b d 8 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d s . p e 3 2
C : \ 5 e 4 4 9 b 3 6 f 2 a e a a f b 4 d 5 7 9 1 f c c f e b 6 e f 6 5 0 3 b 7 e e e 1 a a 0 9 5 3 9 4 d b f 2 7 5 e 5 c e c 7 e 8 d
C : \ f 2 5 6 6 8 a c 6 2 3 d 1 9 1 f f 8 a 9 6 4 e 4 2 1 9 3 4 1 8 8 0 a b 7 6 9 5 a 7 f 0 b 6 e 2 2 5 9 7 d a 3 7 7 1 c 6 5 4 8 c 8
C : \ 5 3 6 0 f b b 3 5 0 b 8 c 2 b b 5 d 5 a 8 3 a d 1 d c d 7 2 f 1 9 7 e e 9 c b e 3 f f 4 8 1 f 6 d b 6 3 a 8 a 8 7 d c 0 a 8 9 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d s . e x e
C : \ b c c 2 c 3 2 c d e 1 c c b 1 2 c f 8 c 2 9 2 2 7 c 4 0 0 c 7 6 5 d 6 d 8 1 f d c 6 8 9 8 0 7 d c 0 4 b 4 0 6 7 e a 0 c a d e 5
C : \ a 7 d 2 0 b 0 9 4 1 f 3 f 1 1 8 8 7 3 1 1 b 6 d 4 3 0 7 1 d f 6 e c 1 3 f 9 9 9 6 6 f a 4 c 7 3 6 b a a f 3 e 6 2 5 c 3 c 3 7 2
C : \ 2 a 8 b c 9 4 a 9 2 6 9 4 c e e e 5 2 6 5 1 7 1 9 f 2 d 5 8 e 9 3 d 2 c d a 5 6 8 9 7 c 7 b 7 d 8 1 2 8 e c 2 9 2 5 0 b e 6 4 6
C : \ 1 5 1 c 2 c c f 1 0 7 b 0 6 b d 4 7 6 b e a 9 e a 1 0 f 2 d e c c 0 3 d 8 9 4 2 e 4 e 3 f a c b b 8 7 7 5 d 3 1 9 b 9 2 f f 4 6
C : \ 0 a 1 6 4 a a 5 5 3 9 9 6 6 a b 8 d 4 b 6 9 d 2 0 b e 8 1 a 2 c b d 5 e 6 f 7 e c 6 f c 2 9 d e 5 b c b 0 b 0 8 b 0 0 7 3 a c 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d s . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 3 f c 1 b 6 e c 5 b 9 6 2 5 3 5 f a 2 6 0 3 c a f d e 6 3 7 d 1 2 f b c a a c 2 7 f c b e c 5 a 8 d 0 4 3 a 2 3 2 5 c 3 b b 9 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a e e d a 8 3 7 7 7 b c 5 0 7 7 b b d 9 2 8 1 6 7 4 a e 5 4 2 a a b 5 3 f 6 6 2 7 8 0 8 9 4 7 c 4 d 1 6 b 2 1 9 c 4 e e e 3 8 7 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e b 1 8 e a a 5 5 f f a 4 5 a a 3 5 a 6 b d a 4 b 2 2 6 e 3 9 c f 4 4 0 3 f b f a c d 5 6 e 0 2 e c 8 2 7 4 e 3 e b 3 1 a 8 9 c . e x e
C : \ 1 d 6 9 a 7 6 f 7 7 8 0 3 1 8 d 6 b 4 d 5 4 4 2 a e e c 0 f 9 3 0 2 5 6 e f f d 9 1 6 3 e f 5 1 b 4 d 5 a a f 9 f e 4 9 1 e 7 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d s . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 0 8 9 0 5 6 7 1 8 1 4 9 0 2 0 9 7 1 c 1 a b d 6 6 8 1 2 b f b 5 c e 4 b 2 1 5 5 4 0 8 d b 1 8 7 c d 2 3 f b d 1 1 3 0 4 1 3 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 6 a 4 0 9 d 6 2 7 6 d b 6 6 e d c e 4 a a d 9 f 0 0 5 3 a 8 2 5 7 b 4 6 9 b e 8 4 5 a c 9 3 b 1 e c 8 5 e a 9 d d 7 4 e 9 e 6 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 4 8 8 4 6 b a 1 5 e 9 c e 6 2 6 1 f 8 5 2 8 9 f 1 3 7 1 e d f c 1 7 6 d 4 8 d 4 d 1 6 d 9 a e 0 0 6 6 7 4 f 1 3 0 a 7 9 7 6 f . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 c 6 0 6 8 6 e 9 9 7 5 f 7 5 8 8 f 5 4 a b e e e 5 7 7 e 2 7 d f c b 3 9 c 2 9 0 8 7 8 1 9 3 0 e 2 8 0 e e c b d f 0 c c 4 1 e . e x e
C : \ 6 3 1 f d 3 9 a 1 6 4 8 e 5 5 c 1 e 3 9 7 9 3 4 2 a 0 a c 5 b 0 7 e 3 3 0 0 6 b 9 5 e 1 3 6 4 6 a 4 2 e c 1 e 3 2 d 8 1 9 8 b a
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d s . p e 3 2
C : \ d b 5 b 2 c 4 0 a 2 5 a f 0 2 1 d 8 2 7 e 0 0 1 2 d 5 1 8 0 a c c 0 c 1 b 1 c 0 a b 3 1 6 1 4 b e 1 a 2 1 c 5 4 b a a 5 3 7 c 8
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.