1.4
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.68
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20200422 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200423 | 2013.8.14.323 |
| McAfee | GenericRXHG-AT!A68044EAAF39 | 20200423 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07938 | 20200423 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': 'UPX1', 'virtual_address': '0x00008000', 'virtual_size': '0x00002000', 'size_of_data': '0x00001400', 'entropy': 7.379982354986008} | entropy | 7.379982354986008 | description | 发现高熵的节 | |||||||||
| entropy | 0.20408163265306123 | description | 此PE文件的整体熵值较高 | |||||||||||
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意
(50 out of 61 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/RL.Upatre.R257655 |
| Antiy-AVL | Trojan/Win32.AGeneric |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | TR/Yarwi.AD.113 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34106.cqY@aOqTuLdi |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | Trojan.GenericRI.S9344804 |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.aaf398 |
| Cylance | Unsafe |
| Cyren | W32/Upatre.IY.gen!Eldorado |
| DrWeb | Trojan.DownLoader9.53364 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Upatre.IY.gen!Eldorado |
| F-Secure | Trojan.TR/Yarwi.AD.113 |
| FireEye | Generic.mg.a68044eaaf398b8d |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan-Spy.Agent |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.azsev |
| K7AntiVirus | Trojan-Downloader ( 0048f6391 ) |
| K7GW | Trojan-Downloader ( 005609571 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=84) |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | GenericRXHG-AT!A68044EAAF39 |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.pm |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.Waski.cwabgb |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.C09D.Malware.Gen |
| Rising | Downloader.Waski!8.184 (TFE:dGZlOgI2YoXD2PsFow) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Downloader |
| Sangfor | Malware |
| SentinelOne | DFI - Suspicious PE |
| Sophos | Troj/Upatre-AN |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2003-10-16 10:32:51
PE Imphash
2a57cf8eff524c5b829a21fbcb23a1c1
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00007000 | 0x00002200 | 4.714061822873019 |
| UPX1 | 0x00008000 | 0x00002000 | 0x00001400 | 7.379982354986008 |
| .rsrc | 0x0000a000 | 0x00003000 | 0x00002a00 | 4.574436101544379 |
| .imports | 0x0000d000 | 0x00001000 | 0x00000200 | 4.2326200882812985 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000a0ec | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000c698 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x0000c6b0 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.DLL:
• 0x402000 GetProcessHeap
• 0x402004 GetModuleHandleA
• 0x402008 CloseHandle
• 0x40200c GetVersionExA
• 0x402010 ExitProcess
Library USER32.dll:
• 0x402018 GetWindowTextW
• 0x40201c SetCapture
• 0x402020 GetActiveWindow
• 0x402024 IsChild
• 0x402028 SendMessageA
• 0x40202c MessageBoxA
• 0x402030 TrackPopupMenu
• 0x402034 CreateWindowExA
• 0x402038 TranslateMessage
• 0x40203c DispatchMessageA
• 0x402040 GetMessageA
• 0x402044 PostQuitMessage
• 0x402048 ShowWindow
• 0x40204c FlashWindowEx
• 0x402050 GetKeyState
• 0x402054 TranslateAcceleratorA
• 0x402058 RegisterClassA
• 0x40205c DefWindowProcA
• 0x402060 GetDlgItemTextA
L!This program cannot be run in DOS mode.
.imports
GKj 0$
PIuTE0
3PPPUR
t+58 @
MQ3PPPUR
3 jjuu
u$@Ph@
P0 E$g
uSAWVAf9
GEGEGMG;r
ET@UV3W}
FG3@_^]
E3T$$3
0VWSSu
X+PQ&YIuKXG[O_^
uHjhTR
SUl$(3VWD$
PL$4j%D$4PL$
bad allocation
x10Y( 9
i?$](j
D9 ?(nWv
KIP;?CU:9%4
_KIP;?CU:=%4
/gK!74
us*5=U:U
^&u+yf5
>\jI>,L
4]2RMEm6
PPV\I';
>4jK#L\Q
>(/:C\
sr)1Y)
#}y<\OL{
)N/4m~d
b:`7gOo
s?/W:qVs
"r=yO/W
`w{G;l^jK.F
}W}vvO'
d1I;?#85?
8]2f674<\
<\b:n g9|jKPCN
<\I':,u^u
tdiminutiveness
.XR}v:Ou)f
'GBDA-=QSq
lantitude
tofkol
wookernof
button
aaaaaaaaaa
ccccccccccccccccc
static
5A)82O1
GetProcessHeap
GetModuleHandleA
CloseHandle
GetVersionExA
ExitProcess
GetWindowTextW
SetCapture
GetActiveWindow
IsChild
SendMessageA
MessageBoxA
TrackPopupMenu
CreateWindowExA
TranslateMessage
DispatchMessageA
GetMessageA
PostQuitMessage
ShowWindow
FlashWindowEx
GetKeyState
TranslateAcceleratorA
RegisterClassA
DefWindowProcA
GetDlgItemTextA
`.rdata
@.data
@.reloc
jp`vl >
hTh(m0
,I:;D+
AWVAf9
|ZQIjY\0`lk
ET@VfW}
FG_^]u0
: EhhVh
t&'vZ^!
qh7WSS
+PYKXG[O1
g-T4x08j$j/A+
A8u7!h
(_64@j%g-_4
bad allocationnBslP
6wE6?c
sWtTYi9
n3Q ca
9oeMt%}d eo-Uy!ue t7;t
e7eMflPG{lScL6
MsMd]b
x;0Y( 9
i?$](?
K2IP;?CU:9%4
;/gK!74&
us*5=OU
_'Zwyd
2=yOpk
~Ml^&u+;f5
I>,LcD%`
#pA(p]2j79
PV\I';
msr)1Y)
[LgNXcSy
ra6OOL{;L_ S
slIHo{g
)N/4m~d
b:Ke+`7
g?/W:qVs
\v9K/w+y`/
r=yO/W
{G;l^._F
}W}vvO'
XUDXXD
d1S+#k85?
< c/ W
I':Ou^
diminuvenes)O.
.XR}v:Ou)f
5Y!,,d22L&&d
lantud/
tofkowookern
5A)82O1
GetProcessHeapModuleHand
Wiek/owTex
SC[tu3
r@Ac6!o
IsChild%
BofTrackPopup
`7wnuIatA nsl
6gDisp
LstQu/ShJaFIsh]8KeySt^
torORegp
APELYC
B&O`.rd^a
@im.&'
7%gOFB
XPTPSWXaD$j
|||}}}
/ / / / / / / / =./ / / / / i\/ / / / / / / +
0 0 0 0 0 0 0 0 0 H=0 0 [N0 0 0 0 0 0 0 0 0 0 0 0 -
/ 1!1!1!1!1!1!1!1!I=1!I=1!1!/ / 0!1!1!1!1!1!1!1!/
1!3"3"3"3"3"3"3"3"{3"]R3"3"j_3"3"3"3"3"3"3"1!
3"4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#3"
5$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$5$
6%OCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOC6%6%6%
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>
KERNEL32.DLL
USER32.dll
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
IsChild
KERNEL32.DLL
GetProcessHeap
GetModuleHandleA
CloseHandle
GetVersionExA
ExitProcess
USER32.dll
GetWindowTextW
SetCapture
GetActiveWindow
IsChild
SendMessageA
MessageBoxA
TrackPopupMenu
CreateWindowExA
TranslateMessage
DispatchMessageA
GetMessageA
PostQuitMessage
ShowWindow
FlashWindowEx
GetKeyState
TranslateAcceleratorA
RegisterClassA
DefWindowProcA
GetDlgItemTextA
L h t t p : / / n o t e p a d - p l u s - p l u s . o r g /
h t t p : / / n o t e p a d - p l u s - p l u s . o r g / c o n t r i b u t o r s
T h i s p r o g r a m i s f r e e s o f t w a r e ; y o u c a n r e d i s t r i b u t e i t a n d / o r m o d i f y i t u n d e r t h e t e r m s o f t h e G N U G e n e r a l P u b l i c L i c e n s e a s p u b l i s h e d b y t h e F r e e S o f t w a r e F o u n d a t i o n ;
e n e r a l P u b l i c L i c e n s e a l o n g w i t h
C : \ U s e r s \ E l l e n \ A p p D a t a \ L o c a l \ T e m p \ T e m p 1 _ C B E _ F o r m . z i p \ C B E _ F o r m . s c r
C : \ J K n o 0 h e g . e x e
C : \ W K c M w Y T m . e x e
C : \ M y E P V k 4 Q . e x e
C : \ P M k G R e y R . e x e
C : \ p R 7 R V J A i . e x e
C : \ P c f 1 g Y W 6 . e x e
C : \ 1 P d s J m L k . e x e
C : \ 8 7 4 Z c C S 9 . e x e
C : \ C B Y g C 3 1 l . e x e
C : \ R n R F V Z b 5 . e x e
C : \ j 1 T G U 4 b N . e x e
C : \ u v X j R 3 W N . e x e
C : \ 8 K p b g m t K . e x e
C : \ L 1 w V b x J F . e x e
C : \ E 2 S e h T L u . e x e
C : \ q a D d b E N r . e x e
C : \ b d i N 9 g K I . e x e
C : \ f Q c U 1 s X S . e x e
C : \ v a n z c d P S . e x e
C : \ n B R 3 F D A w . e x e
C : \ x X l e e x b H . e x e
C : \ R e 0 B i Q _ u . e x e
C : \ u E a 6 B 0 0 a . e x e
C : \ 4 J D H x g 3 g . e x e
C : \ Y 3 M a d r 8 E . e x e
C : \ S K O s _ i K 1 . e x e
C : \ N H E P L W K l . e x e
C : \ e G Z 2 q A m S . e x e
C : \ H b 2 x 3 _ 0 q . e x e
C : \ Q _ D A o r G N . e x e
C : \ B d 4 c A I R O . e x e
C : \ H k g 7 P P x Q . e x e
C : \ 6 R O l t y R 5 . e x e
C : \ 8 j N p v B D 8 . e x e
C : \ w o f H 7 D 6 7 . e x e
C : \ X S K Q R y 4 i . e x e
C : \ e e H y M T r 1 . e x e
C : \ U u 3 4 g B a E . e x e
C : \ f _ F f U 7 w t . e x e
C : \ k a F 5 y Y b R . e x e
C : \ 5 s 6 z h w 7 g . e x e
C : \ G N B 2 G D 0 M . e x e
C : \ R Z F c y A 6 s . e x e
C : \ D f _ n m T C g . e x e
C : \ 2 X p p Y 6 L R . e x e
C : \ 4 5 R D 9 6 I 9 . e x e
C : \ c 1 f 3 6 5 d 8 6 8 0 d 5 1 2 c 1 c 0 c 3 1 c 2 8 0 a f 7 6 1 b 8 f e 1 0 9 c e b 5 e c c 7 3 6 0 b f 5 0 8 2 e e 0 3 3 f 7 d 6
C : \ 4 6 0 4 f e d 0 f 8 3 c 1 6 f d 5 0 4 1 e 3 1 7 8 6 3 6 d 9 4 9 d 2 2 9 0 8 7 e c 4 9 f 8 0 0 1 e 0 1 7 9 a 5 1 e 4 d b 3 0 0 8
C : \ e 4 4 9 d 7 3 c c 4 b 1 c 8 2 4 2 3 5 a b 1 2 4 a 0 5 5 2 3 0 7 a b c c 2 b c 3 5 d 2 e d 8 0 1 7 c 3 9 b c 2 e 2 e 3 0 f 7 4 1
C : \ A s c S X F k I . e x e
C : \ E a Q s M h l N . e x e
C : \ Y X q c J A K T . e x e
C : \ M X x S Z I i j . e x e
C : \ L C K o h l U a . e x e
C : \ b o E J I n 9 v . e x e
C : \ k 6 4 x C u x 0 . e x e
C : \ N v g W y 7 i 8 . e x e
C : \ D 1 Q 0 G k c 4 . e x e
C : \ 4 0 0 2 f 6 5 c a 7 2 8 9 c 6 2 c a f 1 a 2 3 9 6 1 a c 5 f 0 c 4 6 7 4 8 a 3 f 6 3 c 8 f 6 2 1 b 5 0 6 0 4 1 6 e 5 5 5 b 8 8 9
C : \ d v z m a i m _ . e x e
C : \ l r w T x l i d . e x e
C : \ d e M v H o v 1 . e x e
C : \ b O f W Z K D T . e x e
C : \ c j U T A C c U . e x e
C : \ K 8 t y d 2 r K . e x e
C : \ h Z p i O 4 L z . e x e
C : \ k 9 k j R N T 5 . e x e
C : \ e r W s P M a r . e x e
C : \ K y H L A A O R . e x e
C : \ n o O X e T E o . e x e
C : \ a P h s e E l T . e x e
C : \ a f 5 0 0 b e 3 0 5 1 a 2 2 3 4 e f 4 4 1 7 1 f f 5 1 8 3 3 5 0 0 0 7 2 7 e 1 4 2 1 6 2 2 9 f 2 c a 3 7 7 c 6 1 f c 9 2 6 2 7 c
C : \ 1 6 2 3 d 6 0 a 8 9 2 4 1 b d c 9 2 a 3 f c 9 f 9 2 f 5 8 4 d 8 7 6 b e b 3 a 9 9 0 0 8 e 9 f 9 9 f 4 c 8 4 5 9 6 d a e 7 6 0 c
C : \ P V 1 W F q 6 6 . e x e
C : \ X 3 X t n k 6 J . e x e
C : \ V 6 M N H 2 3 d . e x e
C : \ l 0 B Z d u p I . e x e
C : \ w 5 G 5 V y c M . e x e
C : \ 2 8 b 3 9 0 1 7 2 4 b 2 3 5 7 a e b 1 6 d e 6 6 d d 6 f f 3 1 e 6 3 2 4 5 4 d 9 8 6 b 4 6 3 4 1 b 8 d f 2 a 4 b 1 d 7 b a 8 3 2
C : \ e 6 2 8 f 4 a 5 d b e 7 b 8 0 5 a b c 9 6 7 1 d 7 c c b 0 3 0 0 1 4 e d 8 4 d c 5 b 4 5 9 2 8 b 3 e 0 5 0 c 4 d 7 9 a 3 f 4 f b
C : \ b 1 a a 8 e 0 2 1 f 3 0 8 b d a 2 c a 7 5 5 7 1 d 2 4 7 d 2 c a d 9 a b 9 d d 9 0 3 b 6 2 6 3 f 5 0 b 8 f b 8 9 9 f b d 7 9 4 e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ H v A k m U R z . e x e
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ B 2 0 6 E 7 C F F 9 6 A B C 4 A E 4 1 0 1 5 1 5 A 6 0 7 A B F D . b i n . e x e
C : \ v z s M J U _ J . e x e
C : \ 3 e e 7 6 6 5 d 6 7 9 e b 5 5 9 f 0 a 2 6 1 a 6 c c 8 4 b f 9 b f 4 7 b 3 f 0 0 b 7 8 c e 8 6 a e c 2 9 1 4 9 8 0 9 a 3 7 3 c c
C : \ c 9 7 4 c 2 7 8 5 f 4 6 d 0 c 5 d 0 d 6 e 3 9 d a 1 0 5 9 d 3 8 c 6 d b 8 1 3 b d 6 4 6 2 1 5 e 0 1 e f 2 d 4 7 2 1 0 c 5 2 0 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ g p o 3 r c k N . e x e
C : \ 4 e f b f d b d 5 6 a f 4 7 f 0 6 3 2 b 1 a d f b 2 8 f 6 1 c 5 b 5 6 d b 1 1 e 9 a 0 c c b 3 f c 2 5 1 b 3 3 d a d e a a 9 3 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ N p i 7 D x 3 G . e x e
C : \ e e b 1 8 2 2 c 1 b 0 f 8 d d e 2 d 8 0 4 1 7 e 7 5 e 5 e a e c 7 8 b 2 5 6 3 8 e 6 8 1 d 6 7 0 3 c 6 6 1 1 1 6 3 f d 4 8 b b e
C : \ 8 1 d 3 2 0 1 f 9 d 3 c 2 8 0 8 d 2 5 1 8 8 0 e f 4 4 1 8 6 4 9 1 c e 9 9 5 7 f 6 e 0 9 e 1 d f c f 1 2 3 a 6 9 0 c 0 4 7 1 4 a
C : \ C y l z r P W 0 . e x e
C : \ S _ N T 9 H g Y . e x e
C : \ a 5 e e 2 6 e 5 e 7 c 1 5 0 0 f 6 2 1 c 9 9 c f d 1 1 f 6 b f 6 2 e c 3 f 9 b a 9 0 5 e 0 5 0 f 2 f e 4 9 4 0 e 9 7 3 7 f 8 d 1
C : \ b e e e 5 c 2 e 1 d 8 8 a 7 c d f 5 3 1 5 f d 9 2 f 1 e c 8 d 7 5 4 5 5 5 7 7 a 8 8 c c 9 b 2 3 5 d a f 1 2 3 7 a d a 3 3 7 c 2
C : \ W e 8 C 0 A v G . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ D d y L e R f e . e x e
C : \ q v a Y p 1 e L . e x e
C : \ 8 4 6 3 d e f 2 c 9 8 1 5 8 3 c 1 3 e c a d 4 2 8 5 4 1 9 c f e f b 2 2 e 2 4 c 1 3 7 c 9 8 f 8 b 9 e 8 d 4 b 2 3 2 6 c f 4 f 5
C : \ R I w w J U 5 w . e x e
C : \ 2 9 3 4 0 0 3 f d f b 8 9 c 4 1 7 b b d f e 5 7 e 8 3 5 b b 1 f 9 5 9 3 d a b 3 7 6 f a 7 f 5 f 1 a 3 2 3 f 8 5 d 4 6 2 9 c 3 b
C : \ 4 6 2 9 3 9 5 d a 7 a 7 d a 2 d a b 6 9 3 d 5 3 4 5 b 2 c 7 a 1 d d 0 9 7 0 a e c 7 d 3 5 2 7 6 9 c a 0 e f 3 7 b a 5 b 1 a 4 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y M U C A 3 s W . e x e
C : \ p S Y j k S K d . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x c 4 M E 8 E l . e x e
C : \ j B L a m S x c . e x e
C : \ 9 2 5 6 a 9 7 9 d f d d 9 e d 5 3 3 6 8 6 a f b 7 8 e e 6 8 c 5 e 7 0 4 1 e 5 8 c b 1 7 3 2 6 9 1 d b 4 f a 0 a a 1 a f 0 2 7 a
C : \ v 7 4 G o 3 r m . e x e
c : \ t a s k \ B 9 6 F 1 F 9 4 E 1 4 E 0 7 4 6 B 7 C F 4 3 2 2 E F 4 3 6 C 2 C . e x e
c : \ t a s k \ F 5 F 2 C 8 7 6 9 A 7 9 5 2 5 8 C 4 5 2 C F C 3 2 4 1 A E 3 4 0 . e x e
c : \ t a s k \ 6 D F 1 D 2 0 0 6 3 C 7 A 3 3 2 8 E B E A 7 5 5 F A 0 3 F D 5 F . e x e
C : \ 0 5 4 e 8 5 f 5 c 2 d 8 9 a 6 0 5 a a 1 e 1 5 9 b d 7 d 8 2 d a f 9 2 1 2 1 f 4 d d 4 1 7 c a 0 3 d 5 a 8 4 7 5 4 b 3 e 5 2 0 c
C : \ a 9 b 4 9 d f c 3 9 8 7 7 d 2 d 9 a 3 d 8 9 4 d 4 e 7 4 6 e f 5 7 2 3 6 7 f 7 1 0 0 2 8 2 0 2 d c f 6 b 1 7 a 3 1 2 8 b c 9 7 c
C : \ 7 e e a c c 2 6 f 6 6 f 4 7 d b c b f 8 8 b a b c 5 d 5 6 2 9 e 4 d 8 6 2 3 8 2 6 8 1 f 9 f 2 6 5 6 6 a f e e 4 d 4 c a e b 4 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 6 S t b 0 p O Z . e x e
C : \ 8 u S u 9 c M 1 . e x e
C : \ b e 0 1 f e 6 1 c 6 d f 3 c b 3 5 5 c 7 2 2 b 2 e b b 0 b 7 7 3 2 3 f 3 d 5 2 4 f 5 3 1 c 5 1 2 d c c 2 0 8 3 9 3 5 a 5 5 f 8 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 3 f 4 b 8 0 f 5 c 8 e 0 d 6 2 0 5 4 b f b 0 b 2 b c b 2 6 a 3 b 3 b a 4 3 4 c c 7 c 1 0 4 2 0 4 9 6 d 0 f 8 7 9 d 7 e a 2 0 c 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ c 9 e c 2 f 7 a 3 9 c e c 5 9 f 3 0 d f a 2 6 a 9 b 6 b 3 0 a f a 8 c 6 d e 7 6 9 0 8 9 3 c 5 b 8 6 d e 2 1 5 3 0 d e 4 2 5 e a
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ b c 7 6 6 a 8 6 4 f 2 a 9 2 b a 1 9 7 b 2 1 b b d d 8 7 c 0 b 2 1 6 8 1 6 a b 6 c f d a 9 0 c 3 0 0 e b 9 1 0 0 9 a f c f 7 b 2 . e x e
C : \ f e 7 8 2 d 1 e 8 2 8 a 5 5 c 8 8 1 c 6 f b 4 4 f 5 9 b 0 6 3 1 7 3 3 9 c b 9 2 a d 9 f 6 4 9 7 4 7 3 2 f d b 1 c 0 c c 7 c 1 e
C : \ f b 8 c 2 0 7 a 1 6 2 3 8 0 7 c 3 e 9 1 3 d 2 3 c 4 6 f 4 d f 0 6 0 5 7 b 7 5 1 4 d c a 4 6 d f 8 b b c 7 b 1 3 e f 2 9 a 1 c 8
C : \ 6 f 9 f 9 7 0 0 e 0 4 5 4 b 8 d a 6 e 5 9 7 2 a c 7 1 f 1 4 7 3 3 3 5 6 0 7 2 0 9 9 b 5 4 3 3 d d c f 7 3 0 7 4 1 1 d 6 6 9 d 2
C : \ c s U y k s U H . e x e
C : \ 1 a 4 f e a 1 f 7 a f a f 0 4 a 5 c d d 2 b 4 a d 0 0 a 4 b f 6 2 1 7 8 e 2 5 9 2 9 3 c c d 4 f f 6 e f a b 9 0 7 e 1 6 1 6 d 7
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ x S m Z g 3 8 S q L . e x e
C : \ 0 1 2 2 0 0 5 5 d 6 6 d b 0 8 e e 4 b 3 9 0 8 b 8 1 7 b f b f 6 e 2 7 3 9 2 4 4 b f 3 8 9 0 f 1 a 3 a 8 1 c c 7 6 d 2 c 3 0 0 d
C : \ a 3 0 6 2 2 3 5 a a 1 7 b 5 5 7 8 5 4 9 5 e b a e 9 2 2 7 0 1 0 a b c f c 7 1 c 2 b 5 3 d d 1 0 8 9 d c c 9 9 5 4 f 2 9 8 4 1 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 8 3 8 4 9 3 e a a 2 e 0 b e 9 7 d 3 b b 9 a e f 3 f 6 5 b 5 2 6 c 6 d d 7 e d 4 9 d f e 3 8 7 5 8 e 1 e c 3 1 b c a 3 7 f 3 c c
C : \ 3 2 8 6 9 8 7 8 5 c 6 4 4 0 7 1 1 6 e 6 1 4 9 3 7 4 f 0 d 4 a f 4 2 8 f 2 6 6 7 2 1 e 1 b 9 8 0 f 5 c 6 a f 3 e 4 0 3 d e b c 3
C : \ 5 0 2 0 d b 7 7 e f d a 3 a 2 c f 5 e 4 2 2 b 5 5 5 c 3 a d 0 a 6 c 8 4 b f 3 1 7 b 3 7 2 7 2 2 5 6 4 6 f b a 0 3 9 d 5 8 c a 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ v Q 5 X N S A B . e x e
C : \ 9 e d e f 4 c b 8 5 6 e 5 7 c 6 4 e 6 7 e c 7 6 6 e a b 1 2 1 d c e f 0 a 4 6 e d 5 6 6 e b 7 9 9 4 d b e 6 3 0 b c 2 6 2 c c e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ c b 0 e 5 5 5 9 c 7 3 a e 6 4 c 3 5 1 b 5 7 e 7 4 b 2 2 1 f a b d 9 d 5 3 e 8 8 c f 6 0 9 5 5 3 c 1 d 4 a 3 f 1 f 4 0 6 3 3 e 7
C : \ 6 2 1 d 2 5 b e 7 0 c 9 d c 7 f d 5 8 0 f 4 5 d e 6 1 0 8 e d b 7 5 d c b b 6 4 5 3 1 1 3 1 a 3 7 3 2 4 5 9 c 7 0 5 5 b e c 2 9
C : \ a d 9 8 4 0 2 1 0 6 f 2 6 3 4 3 6 5 e f b 4 7 2 4 4 8 2 b 7 5 3 7 b 5 8 6 7 7 d 9 e 7 4 2 0 7 5 e 1 0 2 9 6 7 0 3 8 b e 1 a d c
C : \ 9 6 6 0 a 7 e b e 2 1 d 3 7 3 2 3 2 d f 9 f a 5 e c 7 5 6 6 8 e 7 f f 4 2 f f 0 8 a 6 f 5 3 2 6 0 a 4 6 5 0 b 3 6 f 1 0 7 d 4 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ c c 4 2 8 7 2 c 0 b 6 8 c 3 5 9 c 1 f b 3 4 7 a 2 b 0 c e c 6 0 6 4 d 6 7 f c e 0 5 4 e 3 8 c b 9 6 a c 3 b d f 1 9 8 a a c e 5
C : \ 6 f b e b 4 7 d d f d f 3 0 1 7 f b a 6 e 8 1 6 a 3 c 8 6 8 c a 2 2 c c b f 7 a 3 9 c b a a 7 7 3 c 9 4 6 e 4 c d e 6 b 2 4 8 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 1 6 5 2 d 6 9 0 c f 0 2 e 6 7 e 3 9 b c 2 d 0 f d 2 0 0 a 0 7 0 b 7 5 b 4 2 0 1 0 8 6 e 9 9 6 2 5 a 8 d 9 5 7 7 4 e 7 b a f 0 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 5 f 0 5 7 3 b 5 4 6 8 b 9 1 f 9 f a 5 e a f 8 d 4 4 7 3 1 6 9 4 c 5 c 8 d a 6 7 3 a 4 1 2 8 6 c e f a 0 c 6 a e c 4 b 2 e 0 8 6
C : \ a 4 0 a a 3 0 4 6 c 0 b 4 3 e c 9 6 f 4 a 1 5 c d 8 f 0 c 6 4 9 d d b 5 c 6 e b 2 d 5 8 2 f 1 5 c 0 f 5 e b 6 5 1 b 4 7 b 4 9 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 2 b c 6 b e 8 3 6 1 0 a 4 b d 2 d 4 c 5 c 0 a 0 8 7 0 1 c 4 a 4 b 1 9 3 a 4 f 6 3 4 b d 8 4 1 0 c 6 2 6 7 2 6 e b 0 3 c 8 f 7 b
C : \ 1 d 6 6 9 4 0 f 9 d d 0 9 b 2 8 3 4 f 3 5 6 b 7 a b 3 d a 3 6 7 d e c e 2 6 8 2 c f e 1 1 b d 6 b 2 6 1 5 1 c d 0 c a 8 9 d b 4
c : \ t a s k \ C 0 E 3 6 2 C 8 F 6 E B D 4 6 2 C 5 A C D C E 6 F E 3 D 1 D C 0 . e x e
c : \ t a s k \ 2 A E 4 F 0 B 5 0 E 8 5 8 A 0 D 9 A B D A 0 7 4 A 6 C 2 8 D 4 E . e x e
C : \ 0 1 2 7 e 0 a 2 6 a 3 0 2 b 3 4 9 a b b 3 b f 8 d 6 e 0 6 2 5 3 5 4 9 f 0 7 1 5 f 5 7 a 2 c 9 0 8 7 0 c 5 c 0 9 c a 7 0 5 1 e c
C : \ 8 f 1 4 8 e 7 4 b 0 e d 1 8 7 3 c f a 5 d 0 a 6 9 f 2 c c e a 1 c a d 8 b 6 f c 0 a c 0 1 2 0 6 7 5 8 a d 3 8 b 4 9 3 9 f 8 a f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 0 1 e 3 1 7 a f 5 c 1 8 5 5 0 _ t e z i n . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 3 0 d c d 8 b e 2 2 2 e b 5 e a f a f 4 c a 0 c 6 8 4 0 1 5 4 d 0 2 3 7 5 c 2 3 7 9 a c 2 c 4 6 a 0 1 c 8 f 7 6 6 3 a 1 6 6 c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 2 c a a 0 7 9 0 1 e 0 a b c 4 5 1 a e 1 6 d b 3 b 1 4 6 2 7 4 3 a 4 0 0 f 0 4 a a 2 8 1 d 2 6 c 8 d 2 7 d 4 1 1 e 7 6 2 5 3 e . e x e
C : \ 3 9 c 9 2 9 c d 2 1 d 0 9 d 8 5 d 0 e 9 6 0 e a c f 2 3 1 f 3 4 b 5 3 2 6 5 8 6 9 a 6 4 8 e 1 7 4 c f d a 5 4 5 e 9 0 3 f 0 c f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 7 f 5 8 e 4 5 c 6 7 3 4 1 9 7 _ t e z i n . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b f 9 8 d 6 2 a c 4 2 0 7 5 f d 5 5 6 b 0 f 9 9 5 2 c 3 8 1 f 7 0 b 3 4 2 4 8 0 d d 1 9 b 5 8 0 a f c e f 1 a 8 0 d c 4 b 9 d a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b c b 0 1 a 5 1 f f 7 1 1 6 8 a 6 7 c f 0 5 4 5 a 7 5 9 7 d d e 8 e 8 5 f 0 4 a 3 6 1 f 7 5 7 8 4 7 8 d 0 2 a f f e 5 0 5 d 7 6 . e x e
C : \ 6 1 4 0 c 8 9 a e 5 8 a 8 c 0 e f 8 a c 7 f b a 0 c 4 b 0 5 0 b 6 3 9 4 f f 4 2 6 d 9 0 7 9 1 b c 8 8 1 1 1 e 0 5 4 6 2 a 9 7 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c c a b 2 d 7 b 4 7 f 1 3 b a f 3 7 0 a 1 8 b 2 4 e e a 6 b e e 0 c 0 d a b 5 a 4 2 0 6 d 1 f 7 c d 5 8 0 0 3 9 d a 6 f c a d 4 . e x e
C : \ 7 5 f 2 6 3 8 9 8 6 4 d 5 4 d c 1 c c 9 6 2 6 4 4 e b 6 d 2 5 1 2 d 1 d 1 5 0 7 9 0 3 c 6 6 c e f 2 7 5 7 d 6 b 9 8 0 c 7 a f 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 3 8 c 6 f f 6 6 0 6 2 4 b a 0 2 f 5 1 4 c 3 5 a a 6 a f 6 7 2 1 2 6 4 9 4 3 2 f 0 1 2 9 b 8 8 6 e b d 7 5 d d f b 0 5 3 7 4 3 . e x e
C : \ 9 5 0 d 4 d 0 8 a 0 f 8 b a 8 2 1 8 d 7 9 0 e 0 e f 5 c f b 1 9 2 3 d 6 b 2 f e 0 8 a 9 4 4 c 3 b f 4 5 1 3 b 4 5 1 2 e b 7 2 6
C : \ 0 0 0 f f d 7 4 d 3 0 3 4 f 8 9 0 4 7 a d 3 6 1 f 7 0 b 3 2 4 9 2 0 5 a f f d 8 1 9 d 9 5 8 4 4 b 3 2 c 0 5 b d c 2 f 2 7 e 1 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 9 9 e 5 1 1 f 7 1 a c 6 a 1 2 4 7 f d c 4 7 d 6 0 f 9 e c 8 c 4 4 2 0 8 2 f a 4 9 6 9 5 a b a 6 b a 5 4 5 4 4 6 1 e 2 8 0 e 9 e
C : \ e 5 a d 8 f d 1 0 8 d c 7 3 6 3 9 b 1 9 d e 0 b 4 1 5 2 2 9 3 d 6 2 0 3 5 1 f 9 0 e 1 b 9 c 6 1 8 2 8 9 4 6 0 7 3 e 7 d 2 b a f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ e 2 a f 1 3 c 8 5 d a b 9 0 c b 8 b a a 8 0 6 2 d 0 a 2 5 a c 6 5 2 e d e 0 4 0 b 7 a 3 1 b 3 2 0 0 b 4 7 5 f c 3 7 0 7 7 b 9 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 7 6 b 0 a 5 4 0 8 2 5 d a 5 6 2 c 6 a 1 a 3 7 f d 9 6 4 8 1 1 c 7 d 9 c 4 d 1 a 2 2 4 9 5 d 1 5 d f d 4 a d 7 8 4 b 4 d a d 2 d
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.