1.2
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.55
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200128 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200128 | 2013.8.14.323 |
| McAfee | Artemis!A47112F84866 | 20200128 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b079e8 | 20200128 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | |
| section | petite |
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '', 'virtual_address': '0x00001000', 'virtual_size': '0x00004000', 'size_of_data': '0x00001e00', 'entropy': 7.825799192115816} | entropy | 7.825799192115816 | description | 发现高熵的节 | |||||||||
| entropy | 0.5161290322580645 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 56 个反病毒引擎识别为恶意
(50 out of 56 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Upatre.R268541 |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Malware-gen |
| Avira | TR/Crypt.XPACK.Gen |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34084.bm2@ai5vGwj |
| CAT-QuickHeal | Trojan.AgentCS.S8577448 |
| Comodo | TrojWare.Win32.Kryptik.BOJW@542mkz |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.848664 |
| Cylance | Unsafe |
| Cyren | W32/S-107e7686!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | a variant of Win32/Packed.Petite.H |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-107e7686!Eldorado |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| FireEye | Generic.mg.a47112f848664b77 |
| Fortinet | W32/Zbot.AAB!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan.Crypt |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.dboit |
| K7AntiVirus | Trojan ( 00547f521 ) |
| K7GW | Trojan ( 00547f521 ) |
| Kaspersky | Trojan.Win32.Agent.ibas |
| MAX | malware (ai score=82) |
| Malwarebytes | Backdoor.Bot |
| McAfee | Artemis!A47112F84866 |
| McAfee-GW-Edition | BehavesLike.Win32.Downloader.nm |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.Zbot.cmktgr |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.DCDB.Malware.Gen |
| Rising | Downloader.Upatre!8.B5 (TFE:dGZlOgVb3KHCOYXKUQ) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Ransom-BY |
| Symantec | ML.Attribute.HighConfidence |
| TACHYON | Trojan/W32.Agent.32042.C |
| Tencent | Malware.Win32.Gencirc.10b079e8 |
| Trapmine | malicious.high.ml.score |
| VBA32 | TrojanSpy.Zbot |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2004-10-13 11:27:30
PE Imphash
95ef78b179d4c8765c4981b14524f738
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| 0x00001000 | 0x00004000 | 0x00001e00 | 7.825799192115816 | |
| .rsrc | 0x00005000 | 0x00002000 | 0x00001a00 | 5.734585160635031 |
| petite | 0x00007000 | 0x00000220 | 0x00000220 | 3.821712655769346 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00005178 | 0x00000ea8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x000064e0 | 0x000000e8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x000064cc | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x000061b4 | 0x00000318 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x00006020 | 0x00000193 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library kernel32.dll:
• 0x40718c ExitProcess
• 0x407190 GetModuleHandleA
• 0x407194 GetProcAddress
• 0x407198 VirtualProtect
• 0x40719c VirtualAlloc
• 0x4071a0 VirtualFree
• 0x4071a4 LoadLibraryA
Library GDI32.dll:
• 0x4071ac DeleteDC
Library Winmm.dll:
• 0x4071b4 mciSendStringA
Library Msacm32.dll:
• 0x4071bc acmStreamOpen
Library IMM32.dll:
• 0x4071c4 ImmGetContext
Library OLE32.dll:
• 0x4071cc CoInitialize
L!This program cannot be run in DOS mode.
`.rsrc
@petite
@Pkjji
6Z2m4c
DP`%qZ#
@cWcr{+
Y)p,{&JrZ2
7!QbVu
ca2eh<
=re9"N
y}B'ikc
I2&9{u8
fh71QA3
vXah>$
'MBP%SJ
2 l7]Q
YH{y|s>ss
1sBo"ml
^ZQ)RWQMQJrHMiG
A\Ca8.<=
6/4/5~4,5*-
wwis@!f
x{>}}}p#rKs
hlQgY`fR
^?XU^-\~T
P.6/ .p!
""Pd.~i||p|uH
q[lin1k
>.Z\Y^YUR
KjKhD@Ty
:;-OJ<{5
"W$ @x&k
;UDD1Hv
su\pHTB@{D;
m o4iP
bf'bcMX
WJGM}A0ZG8
Gt8(ZT'#!
V2Sx}q v
H27\<t!)%,
ypvtcue
k6HyGc`sg<PX<]\YCP?RC.cQIlO
DpCDR9x?8b;t
_c /.bY
U|s~sor!
_+[[STUS
N`H5FH96
.\;)&U\^$wB
iJG>]7
T~y/w>u#u@o
8d__lY^
*QU._SK
@"B>28
_Ndu.Dd y_%y._MkcPP
TxLqlqtrHh#=
tef[4X*ASPjWTP
I ORBAWn_
T!+$]\N
gqA`/!D
i++56d%612(2
Z(c?=Q>
~(^ac"E
ZJ/<f|f7a^rNEV
"3RN O<RQ
5VP@y
Nn0hcy~ED
3ul~=y,UP%n
PD$Z$c"e
#gb,Q3
49du^RC
]*.:*eb :!
r!|cOj5
bhf|b.j
>uP89G
X}rxr|
D+}[V7B9dQBU
bZ 87*S4
*UM(zSi!k9"o
SsA?h<
Y\N:)6
zQ$pPW
*RcQECbdU{F8
9 !m\'_-AmL3`1Ippf/
Od|; ng*
W@f,#E^RB
= mO4>
r}pzu+_N,CW
Z]_bXl?
YY-W#r"]}dF~
/@_t"7
fAhueXVs
8>==i471d*u,Z
.$.# ;"&O
Tv$nQhHja
f`2I[Zm
RIuIOyOEFBG@G=i9:
D({22u5Y.\D
)+!6%%
a-BJs~|)yh(XD
GLt>m0ki
ol9e`|W]^uMV
*GUD;U
=2R72E0/
|ts""o:
]sY3]\6JRQHN+%
8HO)yK:
864zVP4))r,
U=qKh4k
gcYvJ|)Y3U
~RIHJfEGKg?*
Un872s
[XH" L$7
40%tX_Q\hTBD
DYlyWs{jdl_qNaOgsK34M$"
8kUJLfC\(7
OTh`Hr&
vcd_# kM4MK
Viw^,.^h1
zU>BBLQ
@j<MJM+
w[ECmT<
1NVb\.
b[f*5 HsxA
a 4.W".
E@c[1N#xn
DMj@>g
:}~yF/
UX1!&Y
T/>0@;W
pom-n*nc-]KW
R;%8p4+?
"d/%n&i
qG `=>
UNH KBN+
z^`vqmst
;OIK%80
U#"!3 L/%e
I5X&*Z*@Ll~
:y3aRmV
hn Kj@h
V48^XXXX]
#######
###;KK>
26;2+##########
#########
#####+bEXL
+######+
#####3
######3#
PD[>J22Ib|tLx63
#######3#>>
vDDP>2
########3+ug
DW[[FvV####
########3#J~~3#5gJIk#
3333333333+g +zT
##++++######
3333333333#J%Tz+33#3333######
33333333333+
#33############
33333333333@II#333###########
33333333333@+333333#########
33333333@?a
+233333#3#######
33@j+23333333#######
j@33333333#######
+jj23333333333####
+I@3333333333##
2+@2333333333#
al233333333
$$$2333
C&SCCCSCS&&&&
&&&&$$
7:::::::****************ss****@$$$$$
788888881;111n;;;11p;11111111;
))))))
o,,,,,,,L6,6Lr66rq6,,,,,,,E
)f/HHHH/
8(((((,Lx|>>Eq6,(,((,EM&/-999N/
K((((((XmV#R?DlV((((((EMC/N9<<<<<
,444444X|JJVT
DRmXF4444F4VMC-9<UUU
(444444X3?
DPIDP#F04440tM
4000000y2WIWRIuRI
0000050
5y{kkJ0? D~`f9f
0%%%%%%_
3^%%%%%y`f\f#
%%%%%%%%^_a%G_a%%G=%%%%%%^`f\f#
%%%%%%%%%BB%%%BB%GG%BB%GGGGG%G`f
G.......'''''''''''''''''''''.
-----------------d-)/
&&&&$$$&
$$$$$$$
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
"85$-(-(
KWfY33(l
FgAF9:)8Vn9qU7
.0-$O!
Yx}|}ts
n9%n``
JHJyGG
96;J4.1
*,)/$#V@A
E~Da.AAk\
.wnCDDO7
W(""$5Q
ZX!&y|
">.mTo`Vca&]
LNqAE@S@GA*#"<
+4}*/.Ue#-!
$b (p\
utXMms!*e
YZ]{8S: g8RIK9M_
( "B<\0JE1
+,C"_#&6
t^Et&H-
kXw@vVWV
V ONHN e GF
C}98yJ16ED?1
:+U';%
MessageBoxA
wsprintfA
ExitProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
DeleteDC
mciSendStringA
acmStreamOpen
ImmGetContext
CoInitialize
user32.dll
kernel32.dll
GDI32.dll
Winmm.dll
Msacm32.dll
IMM32.dll
OLE32.dll
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 5
C o m m e n t s
C o m p a n y N a m e
M S F T C o r p
F i l e D e s c r s i p t i o n
c a l c . e x e
F i l e V e r s i o n
2 . 1 . 1 . 2
I n t e r n a l N a m e
c a l c . e x e
L e g a l C o p y r i g h t
C o p y r i g h t ( C ) 2 0 1 1
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
c a l c . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
P r o d u c t V e r s i o n
3 . 1 . 1 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
l C : \ f 6 7 4 b e a e e 2 8 6 2 8 4 4 1 d 6 f 1 c 6 8 c 2 2 8 5 4 3 d 0 f 8 6 b a 7 c e 2 4 5 0 f e a a 3 b e 0 e 3 d 2 1 4 2 b f 2 a
C : \ U s e r s \ L i s a \ D e s k t o p \ Z k D 6 K y q 8 . e x e
C : \ f 8 6 0 6 a 3 d 1 d 1 2 f 8 7 b 7 9 9 3 9 8 6 d 8 7 c a 7 1 c e f 5 7 3 d 4 f c e d 2 b c d 2 d 0 7 2 4 a 6 a 9 1 3 6 f 5 5 7 2
C : \ U s e r s \ L i s a \ D e s k t o p \ U c n N n a 7 D . e x e
C : \ 2 3 a c 7 b b 2 8 8 1 5 e d 0 f 0 0 2 5 4 9 0 9 d 9 1 f a b 4 1 c 3 9 7 f c c b 6 8 2 6 8 a 3 c 0 b 6 d f 9 1 6 a 3 0 9 a c 9 5
C : \ U s e r s \ L i s a \ D e s k t o p \ t C 6 8 R 3 e Q . e x e
C : \ d 2 d 6 5 f 0 c b 7 6 3 8 8 e 8 3 a 8 6 8 c b b d 5 a 6 f 8 f c 9 1 7 0 1 f 6 6 9 0 7 e a 5 b 6 c 6 f 8 7 a 2 9 7 6 5 1 9 a 1 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ S b D q N z d 7 . e x e
C : \ 6 6 f 5 5 7 6 f d e 2 3 9 2 2 e d 6 4 9 9 6 7 5 3 c f c 5 8 1 0 c 6 1 6 b a c d 9 4 9 9 5 6 d e 4 2 5 0 a 7 a 2 e 8 8 3 a f 4 9
C : \ 1 3 0 d e b 7 f c 1 e e 0 f 0 2 f a b 8 a 4 f a 3 2 a a 7 5 7 f a 3 f e 0 6 3 d 5 d c 2 2 c c a 4 e f 7 b 4 6 a a 3 7 4 6 a f a
C : \ U s e r s \ L i s a \ D e s k t o p \ I e n G 8 3 k D . e x e
C : \ 1 d 4 9 c 6 3 d 9 0 a 2 7 8 4 5 e 0 d 2 8 3 4 1 9 8 4 2 c 7 2 1 3 0 6 f 1 c 3 1 d 7 5 9 a f a 0 8 3 2 7 6 3 a 5 6 d 8 b 4 5 d 7
C : \ 8 c 5 5 9 b 2 8 3 4 4 8 c b 7 6 b f e f 8 4 4 c f a 3 0 c 5 1 4 3 2 1 c 0 2 b c d 7 b 3 a c 3 1 0 a 3 c 9 c a e 4 2 c 1 e b c f
C : \ d 1 3 4 c 0 3 8 e a d 3 3 7 b d b 7 3 e 9 4 7 9 d 6 9 0 1 4 1 2 b 6 9 b 1 0 e e b 9 b 3 0 6 5 9 4 e c a d 7 a 7 f 1 c 2 f 6 c 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ N p q O m r c O . e x e
C : \ 8 8 d 9 9 4 f 0 a d f 9 d a 9 6 e 8 c 8 1 7 b b c 8 a 4 0 b 8 a 6 8 9 1 b 0 6 a 8 8 b 8 a 6 b 9 b d 1 e f 1 c c 4 5 7 d 6 1 9 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ K m H 5 g 7 2 a . e x e
C : \ 0 G N b M w I c . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ A H u D R l y L . e x e
C : \ 1 P z 9 8 y g 9 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ s p s q s f u c . e x e
C : \ _ T Z A s _ g H . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ q b L 9 X L Z v . e x e
C : \ 3 0 e 1 e 7 2 7 f 7 4 4 3 1 8 4 5 4 3 8 1 8 6 b d a a 4 a d d 8 6 b 8 5 a d b c b b 4 b 2 3 b b a 4 9 b 5 3 4 c 6 1 e 1 f b 6 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ v S P 3 h Q X N . e x e
C : \ m N M D D 0 K O . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ m U N 3 S E V Q . e x e
C : \ 1 2 b 5 6 9 1 6 4 9 d e 7 2 2 9 4 c 3 c 5 5 4 f f 7 c e 3 a 8 2 9 a 6 7 6 7 d 3 1 7 5 c 6 3 2 7 2 d f 1 3 7 4 c 2 d 6 2 1 7 a 0
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ 4 2 i s f 1 4 B . e x e
C : \ 5 7 8 f 5 4 3 5 6 f 7 1 c 2 4 d 2 2 d 7 7 1 e 4 e 0 2 c 3 6 a 8 8 e f 6 8 a e d 2 0 5 1 d 0 a 1 3 f 3 5 b 1 4 b 6 2 9 a 6 a 3 b
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ O G m n 6 U a X . e x e
C : \ 0 9 2 a 4 7 0 5 2 c f 0 6 0 d 7 f e 7 7 4 7 6 e 9 6 e 0 8 9 4 a 7 f c b c b f 3 0 f b 1 6 7 f 1 9 f f a b 0 9 e b 4 3 d 1 5 8 c
C : \ s O E Z I 2 G W . e x e
C : \ 2 5 c 6 e 0 d d 2 9 b 7 3 1 d 5 0 4 a 3 5 b f 7 5 e b 0 c 1 8 6 1 e f b 0 b 0 d b b e 0 b 5 2 8 d 8 d 7 7 f f 1 e 8 3 d 4 c 9 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q T I U A d y u . e x e
C : \ p B j 2 s v J W . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 7 u I e C I w z . e x e
C : \ l q 5 O p G A y . e x e
C : \ 0 3 0 5 6 9 e 1 f 0 8 4 b 6 9 3 c a c a 0 c c d f 2 5 8 2 0 1 a 4 f a 6 7 d 7 7 6 2 9 4 4 8 d a d 0 9 2 4 5 4 5 1 3 2 9 5 d b d
C : \ 4 1 9 3 0 3 2 2 f 0 a 1 1 8 3 c c 9 0 0 1 9 5 6 8 6 8 8 f 2 b b c 5 e b 1 b 6 1 6 1 2 5 a 2 a 2 9 4 c b c 8 a 5 0 7 f c 7 0 1 c
C : \ n G n O W U O E . e x e
C : \ 0 f 4 d 8 7 2 3 a 4 6 0 8 d 0 d e 1 1 4 7 0 6 7 c 5 4 b 6 5 0 1 3 9 0 3 2 c d 3 b 6 9 1 1 6 8 f 5 3 e 5 1 9 8 1 f 2 e 0 a 3 f b
C : \ e f 4 e d 0 d 7 0 c e 1 4 f 0 4 b 8 d 2 8 6 9 3 2 c 0 6 8 0 2 d 4 7 1 f a a b c 2 c d b 8 1 6 f 5 d a f 5 6 f 9 b a 8 6 1 4 3 4
C : \ 5 5 6 f f f 9 4 4 b d 1 f 8 f 5 7 f 7 4 5 6 d d 7 9 9 8 c 0 4 3 d 5 4 5 7 8 a e e c e f 2 c 1 a c 2 f f 8 8 a 0 1 8 4 2 2 1 c f
C : \ a b 0 4 7 7 9 e 5 0 d 4 8 3 2 b f 5 1 7 5 d 8 0 c e 3 4 e 9 f 1 c b f 1 e 0 f f 1 7 7 3 a 2 3 2 9 5 8 8 2 f 2 b 2 c 3 7 b 1 9 4
C : \ U s e r s \ L i s a \ D e s k t o p \ 9 A n e 7 G j L . e x e
C : \ f c 8 0 6 5 e 6 9 b 1 5 1 4 6 e 5 6 a 8 e 8 e 4 d 8 d 3 e 7 b 8 6 7 c 4 7 1 b a c 4 2 2 4 b e 1 6 c 3 5 d a 4 c d 2 b 4 e 7 b d
C : \ 8 e 5 e 1 6 5 1 7 d 1 0 b 0 b 2 2 8 5 c a a 2 a 1 9 7 f c a 7 2 4 b a 6 9 f 5 c 6 8 8 c 3 1 8 c a 2 f 3 0 6 7 5 8 2 c e f 2 f a
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 1 7 9 d 3 e 7 d 4 d 9 2 2 5 9 4 f 7 f 0 9 c 6 1 7 f c 9 9 d b 9 e 7 f 6 d 6 6 a a 2 1 d 0 8 b f 3 0 0 e d 1 b 3 6 8 f b 8 1 9 d . e x e
C : \ L c R J V 7 P 4 . e x e
C : \ e 5 4 1 0 4 e c f a 3 2 0 2 6 f 5 a 8 4 4 0 e a 4 3 f 0 e 3 9 2 a 5 7 7 2 8 4 c 7 a 9 e a 4 5 3 6 8 2 d 1 6 f f 2 2 7 7 d e 5 a
C : \ c f 2 f a c 8 3 6 4 f 4 e c d b 5 f 5 3 3 8 0 8 e 6 3 4 7 a 8 9 5 5 f c c b 8 a 8 2 5 2 8 3 6 a 7 0 0 f f 9 7 e 4 6 a c a 5 9 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ W 5 A J L G 4 l . e x e
C : \ u L j U 3 9 6 s . e x e
C : \ e 0 6 1 1 d f 3 7 e d 1 a 2 0 b b a 9 4 0 4 9 e 8 7 c d 5 a a d 3 5 7 3 8 2 0 8 b c a 6 d 4 9 5 3 e a 1 7 f 2 1 8 e 7 f a 6 4 a
C : \ 8 c 0 6 7 a c a 8 5 8 e 0 3 3 8 7 6 e b 1 6 1 9 3 5 2 d 3 a 1 a c a 7 2 b 4 e e c 0 d b f e d 7 1 c 2 0 6 1 c b 3 9 3 5 f 4 2 6
C : \ U s e r s \ L i s a \ D e s k t o p \ J V 8 n T z c G . e x e
C : \ f V t q W m 2 L . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ j k k J R F i W . e x e
C : \ 2 I I z 9 X j m . e x e
C : \ 9 e c a 2 6 c e 4 0 d 0 b d 2 b c d c b f 5 3 5 3 6 3 f 8 5 3 7 7 3 0 7 5 f f 5 6 0 9 8 3 b 8 e 2 1 3 2 4 8 8 d b 8 2 4 e 0 f d
C : \ f f 2 0 c b 3 b 2 f 9 b a f d c e 5 a 2 3 7 b 0 e 3 b e c e 0 0 8 3 0 8 f 2 4 a 2 0 0 c 7 6 f 2 5 e d f 7 0 0 6 4 5 5 8 c 3 7 e
C : \ b 7 6 3 e a 0 2 2 c 8 f c c 4 9 9 b 8 6 6 f 8 5 6 9 a 6 f c 3 f 3 f 7 e 6 9 3 0 b c 1 0 e c 8 3 9 a 4 8 9 6 3 3 8 f 4 2 a d b 3
C : \ U s e r s \ L i s a \ D e s k t o p \ o 9 3 Y 2 F 3 s . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ e d a f 0 c 3 f f 4 0 9 9 1 c 7 1 e d a 0 5 f e 3 a 3 2 4 b 0 2 6 6 2 1 a a c a 5 d f 1 8 7 f f 3 5 7 0 2 3 c 7 6 8 2 a 7 6 2 8 . e x e
C : \ M 6 M 7 1 C w 5 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ z N D s f n x Y . e x e
C : \ u E 0 D m 0 Y x . e x e
C : \ d e e 7 c a 2 d 4 d 7 6 1 0 9 b 4 d 1 1 f b d 4 0 5 a f 0 4 5 b c a 3 0 7 7 e 0 f 1 c 6 f b c 2 4 e a 6 5 8 f a f d e c 2 6 a 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ w H F J K 5 p Y . e x e
C : \ 9 N 6 N W C j v . e x e
C : \ c f c f 3 c a 3 3 4 a 5 e d 5 d 1 e 3 a c b a 7 1 a 6 4 d d 0 1 6 a 6 d d 9 9 e d 4 c a 2 8 2 3 c e e f f 2 2 4 3 0 a f 1 a f 5
C : \ f 5 5 0 3 e c 1 c 5 e 8 4 1 a b c 7 c c 7 3 f 6 e 3 3 f 5 c 6 b 3 d 6 4 1 0 9 c e 5 2 9 e 8 6 9 b 1 b 0 7 c 9 8 5 6 8 2 d 8 6 3
C : \ a 7 c 5 e 4 1 1 9 6 8 b 1 b f 8 f e f b f 1 2 6 7 1 0 b c 7 6 6 e e 2 1 9 e 0 a b c 5 c 4 3 5 d d 4 3 a d 6 2 1 8 0 8 d 0 3 2 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ N 6 G k 6 t e h . e x e
C : \ c 0 F m h U 9 M . e x e
C : \ 9 e 5 9 d 3 d a 9 5 3 1 5 f 7 6 5 7 f a 5 1 e 6 b b 9 9 b 6 0 e 4 5 f b 9 4 2 6 7 6 c a 4 6 7 6 b 1 3 8 c b c 2 a 5 1 1 a 0 5 d
C : \ 3 7 e 5 0 3 7 3 9 5 d 7 e 4 3 7 4 b 4 7 d 1 5 d 3 1 7 7 e d f c 2 f d 2 a f 2 4 d f 4 6 4 5 0 d d c 8 d 2 4 3 4 8 0 9 0 f 6 0 4
C : \ U s e r s \ L i s a \ D e s k t o p \ r j h B P E g q . e x e
C : \ 8 2 2 2 2 b 5 d 3 4 5 5 a a 7 f b e f b 8 e 7 4 0 9 4 1 7 9 b 7 b f 8 9 5 2 a 5 d 2 2 6 e 9 9 b e 5 5 8 a 2 e 9 0 0 d 9 a 6 f 1
C : \ b 1 d 8 3 f b 9 3 a e c d f e 7 3 5 d d c b 0 5 c 5 f 0 4 c 9 7 6 2 b 5 4 f 5 b 7 d 2 3 5 d a b 5 7 8 e 8 0 b 6 f 1 e 7 4 e 7 b
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ P b g U G m k M . e x e
C : \ e 8 e 2 a 6 6 d 1 7 d c c 8 c 2 7 c b 4 d 0 2 9 a 2 e 1 2 6 a d 3 7 4 3 9 1 8 d 5 0 0 c 5 3 b 5 0 1 f 9 4 4 1 7 5 c 7 3 c 6 9 9
C : \ 7 a 4 b a 4 f 0 0 c 2 f 3 8 0 2 0 f 3 c 4 1 8 4 f 9 c b d 9 4 3 a c 2 1 4 f 9 c c d d 8 e 1 1 5 1 7 6 3 2 2 0 6 b f c 0 a 4 8 3
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 5 8 c f c 4 e 9 a 3 b 1 8 4 1 f 5 1 8 0 3 b 7 3 d f b 9 b 6 7 f 9 4 4 7 f 9 c 7 0 8 4 6 c a 4 f d d f f c d e 3 f b 3 a 0 6 4 2 . e x e
C : \ 9 0 8 3 e d c 0 b 7 0 c 6 b 9 c 0 4 b a f 6 7 6 5 e 1 6 5 7 d f 4 b b 2 f 5 5 f 9 d f 9 b 7 a 0 1 7 f 1 f 1 d 9 e d 9 0 2 b d e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 5 e a D p M F r . e x e
C : \ S V 7 i C c t 6 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ M V 4 M 7 9 A 1 . e x e
C : \ f 2 0 6 5 b 6 5 2 0 2 e 3 3 8 a 6 3 0 a 9 b f 8 b 6 c 2 3 d b 0 5 7 7 7 3 e f e 6 8 e e 3 f f e 7 0 c a c e b 4 c 6 f b 9 c 8 4
C : \ S O S Z R g j S . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ O Q M f B j 5 f . e x e
C : \ _ i E A G l q T . e x e
C : \ 0 5 9 1 3 a 0 1 1 4 d b b f 3 0 7 3 7 1 e 1 4 f 0 d 0 1 f a b 4 9 0 b 6 9 d a 4 5 7 f 6 d 9 8 3 7 d 1 8 6 6 2 4 3 3 a 6 2 c b e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ v J v i q G Y t . e x e
C : \ 3 9 0 b 6 5 4 2 6 c 1 7 1 5 3 3 2 8 9 1 1 e a c c e 1 5 7 d d 1 f 2 0 c a 9 9 b 2 c 6 5 0 a 2 a 1 c 5 6 8 1 f 4 a d 1 4 d c b b
C : \ U s e r s \ L i s a \ D e s k t o p \ 0 4 c 5 M V o X . e x e
C : \ 5 6 c 6 e e 2 9 4 d 2 d a 5 f 6 c 6 c a 2 f f f 2 8 0 5 e 5 4 a c 9 f 0 0 b 8 9 2 5 8 8 2 9 0 8 d b f 1 3 8 c 4 5 c 0 c 5 5 b 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l 7 8 P b Y V P . e x e
C : \ 5 b 1 d c 5 8 e 4 2 f 8 b b 1 9 8 c 6 a c 7 5 6 e 9 b 9 e d 5 0 f 7 8 1 6 7 2 f 5 4 5 5 0 4 2 3 c c 8 3 a a 1 e 9 1 7 9 1 7 c a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l j f D s 4 G F . e x e
C : \ b b 1 8 5 5 c 2 a 9 0 5 5 a f 1 a 1 0 1 2 d 5 0 b c e 0 f b 6 c 0 e c 3 e 3 f 2 0 1 2 e e 1 f e 0 7 1 b f c 7 0 6 f 4 e d b 8 8
C : \ a 1 8 d f 5 0 9 d 1 5 4 9 b f 4 e 6 8 f a 1 5 d 3 2 d 9 c f 9 d 8 c 4 3 c 9 c 2 b 8 2 c 1 7 b 9 b 9 c 1 6 9 7 6 2 c e c 3 b c 6
C : \ V c Q i O U u z . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ 0 t u W S Q 6 V . e x e
C : \ 7 1 c e a 9 9 8 c b e 1 2 1 a 3 b 5 2 6 8 a 0 0 4 a 5 4 f 6 e f d 6 1 0 d 5 c 5 a c 3 f 7 6 3 8 0 e 0 3 9 b 5 5 9 e e 5 5 4 6 8
C : \ b 2 8 d c 4 6 1 5 2 2 3 2 1 8 e 2 d 3 d 6 1 a 9 3 b b 1 6 c 7 b 6 d 4 1 8 f 8 6 8 1 f 8 e c 3 9 9 9 6 1 1 7 6 6 b f c 3 e 8 2 e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ b 0 0 1 7 a 0 2 1 1 9 4 a d 1 f e 6 8 9 c 7 4 f 7 2 6 5 a 7 d 7 5 c a 1 3 7 1 6 4 b 2 5 7 e 1 3 1 c b 4 c 2 9 8 9 1 7 3 2 8 3 7
C : \ 9 b 9 4 7 e 3 3 3 b 0 9 6 3 f e d 4 d 0 d 1 8 2 d 9 1 b e 3 5 0 1 1 e f 8 6 4 b e 7 5 1 d b 6 6 e c 9 2 0 8 a d 1 4 9 3 4 f 5 f
C : \ B m I v m i D L . e x e
C : \ d 5 f 7 6 5 6 2 f f f 3 c c b a f 9 8 a c 5 2 e d 9 9 c f 9 f 1 7 d 0 a 7 c b 0 8 f 2 f 5 7 5 5 8 f e 4 d c 0 d 4 5 f 2 1 d 0 8
C : \ C e z r d J 4 B . e x e
C : \ 6 1 e c 9 a 5 1 4 b 3 c 2 c 1 6 1 b 9 9 4 f 1 f f 7 4 a 1 a 8 b 8 4 3 c a 0 9 9 8 8 f 9 d d 1 1 3 1 7 7 d 3 e d e 7 9 3 9 8 2 b
C : \ 2 f a d 1 c c 7 9 a 8 0 c c e 2 a 9 2 2 f 1 5 a 8 3 a 9 d d e 8 e b 8 6 d d 9 5 3 b a 0 b 4 5 e 6 b 3 2 7 1 f 7 2 5 7 e c 0 6 3
C : \ 8 2 6 9 4 0 7 5 b 6 a 4 8 c f 4 3 b a 0 4 7 a 9 f c a f 1 e d 5 f f 8 0 f 2 e c e e 5 0 c f 5 6 6 7 7 d 4 2 c 9 d c 6 4 3 7 8 f
C : \ 7 d f 7 9 6 2 1 4 5 a b d a 4 c 1 4 4 6 d 4 2 4 7 f 1 b b 7 1 2 d 5 d b e 7 1 3 1 f 7 7 3 d b 7 9 6 e 1 6 1 1 d 4 6 5 5 f 4 b 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ L i s a \ D e s k t o p \ d v w B I q w m . e x e
c : \ V I D 6 8 3 4 7 6 3 9 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ C t t 6 Z L N 8 . e x e
C : \ 9 f a a b 8 8 8 5 6 a 6 2 d 1 3 e 6 6 b 2 6 4 4 e 2 6 9 c f 9 5 6 9 d a e d 2 3 0 0 e 1 5 d e 9 2 0 4 a 0 c a e 7 7 8 5 d 8 d 6
C : \ U s e r s \ L i s a \ D e s k t o p \ V u A j h k d 5 . e x e
C : \ y Y s j 1 2 4 c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ g A X O 6 g e 8 . e x e
C : \ 9 8 0 d 1 a 7 d 2 4 5 1 6 2 4 5 3 f 9 5 d 1 9 2 2 6 4 2 f 2 f a a b 4 3 7 a 4 e 7 a 1 c c b 7 4 6 e d 7 3 e 3 4 c a 7 8 5 6 1 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 9 1 8 b f 1 2 0 9 6 c 8 c 9 5 9 3 c a e e 2 a 3 a 5 5 7 c f 1 7 b 4 e c 8 b a 2 e 4 1 9 1 7 f f f 3 b 1 4 d 0 3 0 9 b 8 0 a e c
C : \ 8 5 c 2 a 5 6 6 3 7 0 c d 6 0 7 5 d 8 0 4 6 1 4 c 9 3 7 d 4 6 3 d 6 3 d 4 0 4 8 4 8 d f b 8 9 f 1 4 3 9 a c b 4 e 0 9 1 e f d d
C : \ 7 7 8 a 7 7 3 3 e e a 9 8 2 2 d d 2 d 0 e e c 1 9 2 c 7 6 6 b 1 0 e f 7 b 5 7 c 5 9 3 5 e 5 2 5 d 7 3 d 5 4 b 1 8 d 5 7 2 6 4 d
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 8 0 9 5 6 b e f 1 5 a 3 8 1 7 b f 2 7 c 4 7 0 9 3 5 7 1 4 b 9 5 1 d e 7 c 8 2 b 5 8 2 2 9 a 2 8 4 1 c 4 b 4 e 8 a 3 5 c e 7 1 c . e x e
C : \ 9 6 f 8 e a 6 7 1 1 4 f b 5 4 9 2 3 3 4 f 4 c 4 b 9 a 8 5 8 7 4 a f f 5 a b 3 4 c c 0 0 f 2 b 6 a 9 2 9 b 9 f d 9 3 9 1 3 d 7 7
C : \ U s e r s \ L i s a \ D e s k t o p \ x f H Y 6 I W R . e x e
C : \ 4 _ w H 5 M 3 v . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ R 6 X i p A d M . e x e
C : \ 3 6 7 3 5 0 b 5 4 1 2 5 9 1 8 7 e d 2 2 8 0 f c e f 3 8 8 e b 6 9 0 a 5 8 0 9 2 0 5 8 9 3 3 1 2 5 1 b 8 6 a 6 b f e 1 d 2 8 d b
C : \ 7 9 3 d 0 b 2 c 7 2 8 1 3 a 7 2 a e 3 2 a 4 9 c 2 e 9 6 4 5 6 d 1 e 1 b c 0 5 7 d 5 a 6 e 2 7 e 8 c 2 a 9 5 9 4 e e 7 0 0 b 5 e
C : \ r 7 p X K k Z J . e x e
C : \ 5 9 6 d e 8 c e 2 7 4 5 f b f 4 6 9 0 c 5 6 9 5 d 0 b 2 d 3 7 b b 3 a 7 e f e 7 c 9 a 3 5 a a c a a 3 f a 0 6 4 8 a b f b a f f
C : \ U s e r s \ L i s a \ D e s k t o p \ C 1 0 f I e n i . e x e
C : \ U s e r s \ A D M I N I ~ 1 \ A p p D a t a \ L o c a l \ T e m p \ 3 4 e 9 c 2 1 6 7 a 6 4 0 d 6 b 5 7 d 0 1 9 3 c 0 7 2 5 e e c 7 e 9 1 5 c d f a . e x e
C : \ U s e r s \ A D M I N I ~ 1 \ A p p D a t a \ L o c a l \ T e m p \ 6 f 0 1 7 2 d 3 b a 1 8 5 0 8 9 3 f c b 0 f 9 8 9 c 0 8 5 6 7 a a 3 6 d 0 9 d f . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 7 e 7 8 4 3 6 f b 0 8 4 9 7 3 b 9 d 8 9 2 1 4 9 f 8 4 6 7 0 e 6 6 9 3 f d 0 d e d 9 a 1 d 0 5 3 8 9 6 2 d 3 b 2 e d 3 0 d 5 c 7
C : \ B 2 l 6 j b 2 n . e x e
C : \ b 0 7 8 6 d a f 7 e e 8 8 b 3 a 3 6 c 7 e 6 e 9 9 f 3 b 2 8 b 3 d 7 0 2 c 5 f b f 7 6 f 6 2 6 9 8 2 b 0 4 c 8 4 c 5 d 8 9 1 1 1
C : \ 9 9 e d 5 8 e 6 e 6 2 8 0 e f a a 7 c b 4 f 1 c 5 2 8 5 a 6 c f b 4 2 e 8 e 1 d b a a c 7 d 5 4 a a d c 7 2 f 6 e 5 1 c 4 8 e 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 2 S y A n r Z v . e x e
C : \ p m 4 c s w M M . e x e
C : \ 4 6 f 1 a 1 f 1 7 e 5 9 5 8 4 b b 9 1 7 5 7 8 8 0 b 2 1 5 d e 5 8 5 1 e 9 e 5 7 9 e 5 3 d e 3 2 3 0 2 1 6 9 c 6 a 8 1 4 1 2 6 6
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ O Q h K E 1 W p N Q . e x e
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.