0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.53
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20200425 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200426 | 2013.8.14.323 |
| McAfee | Downloader-FSH | 20200426 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b8f194 | 20200426 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意
(50 out of 61 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Zbot.R104556 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | HEUR/AGEN.1115249 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34106.bqY@ayzHPnmi |
| Bkav | W32.AIDetectVM.malware2 |
| CAT-QuickHeal | TrojanDownloader.Upatre.A4 |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.Kryptik.BSMR@568e7v |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.93f0cc |
| Cylance | Unsafe |
| Cyren | W32/Trojan.SPXU-4887 |
| DrWeb | Trojan.DownLoader9.8461 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.HBA |
| F-Secure | Heuristic.HEUR/AGEN.1115249 |
| FireEye | Generic.mg.a8b012b93f0ccf23 |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.bamfj |
| K7AntiVirus | Trojan-Downloader ( 0055c6c71 ) |
| K7GW | Trojan-Downloader ( 0055c6c71 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=80) |
| Malwarebytes | Spyware.Fareit |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FSH |
| McAfee-GW-Edition | BehavesLike.Win32.Downloader.mm |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.L |
| NANO-Antivirus | Trojan.Win32.Waski.cskeil |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM07.1.D173.Malware.Gen |
| Rising | Dropper.Win32.Injector.x (RDMK:cmRtazrpya7Has6nZO1T6+7rObhE) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Zbot-HIL |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-01-08 15:21:26
PE Imphash
1d5d0c5e86a07a6a5cfb325813c26d32
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000014ec | 0x00001600 | 6.565614366224809 |
| .rdata | 0x00003000 | 0x0000084a | 0x00000a00 | 5.600866401114366 |
| .data | 0x00004000 | 0x000001d0 | 0x00000200 | 4.245683812857582 |
| .rsrc | 0x00005000 | 0x00001370 | 0x00001400 | 4.358949233365019 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000052c8 | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MENU | 0x00006188 | 0x000000d8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00006260 | 0x0000010c | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00006170 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x00005180 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x403064 RegisterClassExW
• 0x403068 CreateWindowExW
• 0x40306c GetMessageW
• 0x403070 TranslateMessage
• 0x403074 DispatchMessageW
• 0x403078 DefWindowProcW
• 0x40307c BeginPaint
• 0x403080 PostQuitMessage
• 0x403084 ShowWindow
• 0x403088 UpdateWindow
• 0x40308c SetWindowTextW
• 0x403090 SendNotifyMessageW
Library KERNEL32.dll:
• 0x403008 GetModuleHandleA
• 0x40300c GetStartupInfoA
• 0x403010 GetModuleHandleW
• 0x403014 CloseHandle
• 0x403018 CreateFileW
• 0x40301c WriteFile
• 0x403020 ReadFile
• 0x403024 GetSystemTime
Library GDI32.dll:
• 0x403000 SetBkColor
Library MSVCRT.dll:
• 0x40302c _acmdln
• 0x403030 _controlfp
• 0x403034 _except_handler3
• 0x403038 __set_app_type
• 0x40303c __p__fmode
• 0x403040 __p__commode
• 0x403044 _adjust_fdiv
• 0x403048 __setusermatherr
• 0x40304c _initterm
• 0x403050 _exit
• 0x403054 _XcptFilter
• 0x403058 exit
• 0x40305c __getmainargs
L!This program cannot be run in DOS mode.
B~BBBBBBB
BBRichB
`.rdata
@.data
@W0Pu@
E W@PE
0u@W0EPEWW@E@W0uW
@W0WEE@W
EW~`WE
@u00W
PPuu0 E
PPW0PP0uE
P E @ u E
W Eu@Pu00
W0PW0u
EuP E@
EWE0@0
Wu0E0W
@P00UE
EPEEu u PW
WEPP PU
t(=p0@
MQ3PPPUR
EP0 00u0W000W
@EPuP@
uW@E 0
[uSAVWAf9
GGEGGEM;r
u P0Wu
W000 0UV3W}
FG3@_^]
j);~)z>
/d>^?p &
W]R/:\
p% osk@
`/_)Az
XSLU/W-
"0?{)^ZzX
.AB%r8
"YJ4fm
]d2Ag+ j
jP|v(6B ^
uO/T(6|V
%~R/:kKb;P
MD("+S(
{ES~` )^ZzX
J^>~O} 4
0 WMP^R/:]i
xPW0PEu
@@ @PuEEPW@
IuX[_[+S
PEPEWWu0@@
CSWPVR@
00 PP Eu@
u0WuuE
E u E W
uuWWEW
WUjh4@
hSVWe3
EEP5A@
EPEPEP
0u>"u:Fu
<"u>"u
> vFuj
YY3%40@
V.^SI;
ZW,>)T4
N+@,D]
J^>!32C
&_'6F4!N
8.S96IP4=1;
1_'5 :
7J$P>4:R
J#!VL
BW:517K9\:.
.!a# S@
E?NF22
%#\S:C
?'K<V1I
`5DCZI
>Y-RO@
$J;<&3
K%4DNO?\$);/_4)
`!QO[](
40^33(<QBM
(a4A4,VT
KZG= 6<
aB`5W9a
.Y">[,>
.9.M#*$&
.\3V?[7
]$;"M/KW B+[Z
C7;8AGC-
.Q:\62:ZARa
N11Q'8MD
S%U/TNRG
SendNotifyMessageW
SetWindowTextW
RegisterClassExW
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
BeginPaint
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
GetSystemTime
ReadFile
WriteFile
CreateFileW
CloseHandle
GetModuleHandleW
KERNEL32.dll
SetBkColor
GDI32.dll
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetModuleHandleA
GetStartupInfoA
u@W0EPE
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>(
nyz{|}~~
nopqrstuvwg=x
HI*JKL
ABCDEF
&'()*+,-
n o v i c e
s t a t i c
b u t t o n
& A b o u t
M i c r o s o f t S a n s S e r i f
C : \ D O C U M E ~ 1 \ T E M P \ L O C A L S ~ 1 \ T e m p \ T e m p o r a r y D i r e c t o r y 1 f o r V o i c e M e s s a g e . z i p \ V o i c e M e s s a g e . e x e
C : \ e 0 7 3 9 8 9 1 8 6 3 7 a b a 8 e c 1 2 2 6 3 4 0 3 6 0 e b b 4 8 b 0 c f a a 5 4 5 b 2 8 c d 9 a 9 f 5 d 9 5 b c 3 d 0 1 f 0 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ f O o e b D y E V . e x e
C : \ 6 F d a X M w f . e x e
C : \ t 7 A 5 F V 3 4 . e x e
c : \ w o r k \ 4 0 9 1 4 9 6 \ 0 4 9 1 3 0 e d 7 9 d 2 d 6 6 6 1 e c 2 8 0 a 2 7 8 0 4 2 b b 9 . e x e
C : \ 8 9 f c 7 8 8 0 0 b 7 a 8 d 2 5 5 5 9 c 8 f 0 8 6 0 6 2 9 a 8 6 2 6 e 8 f e 6 4 b a 0 c 8 1 9 5 e 5 0 6 4 8 3 8 7 c 2 2 f 1 4 e
C : \ 7 8 4 3 6 b 8 1 a a b c a 7 e a b 0 4 6 f 2 2 7 0 0 4 2 3 8 3 1 7 f 3 a 3 c d c 1 1 5 f d 4 7 1 2 d 8 e a 4 1 8 a a 3 5 7 b a 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ e S a i h f Y B 8 . e x e
C : \ m P 8 Q q d 5 k . e x e
C : \ q y 9 V E A U d . e x e
C : \ C R G a c e P Y . e x e
c : \ a n a l y s e \ 1 5 5 8 3 1 5 0 5 1 . 1 0 9 0 1 3 6 _ 4 7 4 9 d 9 a f - e e 1 b - 4 a 2 f - a c f 3 - a 4 1 8 2 b c 5 3 d e f
c : \ a n a l y s e \ 1 5 6 5 2 5 0 5 4 3 . 7 6 3 9 0 4 3 _ 1 d a 8 0 1 4 a - b 8 d 1 - 4 4 8 5 - 8 1 9 2 - 4 0 2 d 4 8 f 8 f a 9 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 8 c 4 c f 3 4 3 4 2 f f d 6 a b 4 1 c 9 e 7 3 d 7 4 c 3 5 1 e 1 8 5 b 3 7 4 0 c 5 6 c f e 6 1 7 0 d 4 1 6 6 a 3 b c 9 1 8 e d 2
C : \ 5 0 1 c 3 b 2 8 9 b 4 4 8 7 4 c d 1 6 1 a a 7 6 0 f 5 b 0 0 b 1 2 a c 8 e e c 7 c b 6 c 7 9 2 8 c d 5 e 5 1 1 4 3 c b 3 b 1 4 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 8 b e 2 9 5 6 0 4 1 9 3 6 0 9 0 0 e 6 6 6 f f d 6 5 9 e f e f 9 0 2 8 6 b 2 2 1 1 7 5 9 a f a 6 d c 0 3 7 6 5 e 7 1 9 c c 1 c 2
C : \ d 6 4 a 8 a f 0 c 3 7 2 7 1 8 0 b f 0 6 8 0 a 6 0 6 4 8 a 5 8 d 9 2 4 1 4 3 5 7 9 0 6 d 3 5 7 3 e 0 3 9 8 4 9 2 7 a 7 6 d 6 4 f
C : \ 4 7 c 0 3 1 3 f 2 1 b d 0 0 c d f 4 0 8 c 6 8 6 a 3 7 0 9 1 a a 8 9 1 f 7 0 a b e e f c 2 a 1 8 d 3 a c 2 2 6 2 a f 2 b 1 9 5 4
C : \ 3 d 5 7 c 6 e a 4 9 5 c d 2 b f 0 6 7 3 e 5 8 4 7 9 7 8 d 1 6 4 7 0 f f d f b a 7 d f 0 5 f 4 1 9 b 6 9 8 c b e 0 1 8 8 7 5 c e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 1 4 6 1 d d 1 5 6 0 0 5 f 1 c e 6 d 9 5 e 7 9 d 8 f b 4 6 b c 3 3 6 a 6 6 b 2 c 0 2 2 e f f 7 6 1 6 9 0 a 2 8 2 f d 7 1 e 2 1 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ c 9 2 f 7 6 c f 7 2 4 5 9 6 2 0 f d 9 5 c 1 6 b e c 4 7 7 a 5 1 a 3 3 2 1 a e 3 3 b b 4 f c b 9 9 f 1 0 5 4 d 9 1 f e 4 d 4 3 5
C : \ 0 5 2 9 c f b 1 a a f 1 a 3 7 5 a b 1 c 3 a a 5 b 7 d 9 d 5 5 7 1 e f d a 9 e b a 5 a b 4 9 9 e c e e 1 3 0 8 7 a 7 2 2 d 7 b 2
C : \ H p v N G v V 3 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 9 a 8 1 2 7 c 5 9 7 2 5 6 e c 7 6 5 8 c d 6 9 1 c 2 c 0 b 4 1 8 5 2 a a b 5 e 4 4 c 3 f 7 a a 2 a 3 d b c b b c 9 4 4 5 a c 0 6
C : \ 1 0 8 5 6 9 b 8 0 d 3 5 9 e a 8 7 0 1 3 8 2 0 6 8 2 d b 7 c c 9 7 2 5 3 8 1 b 5 2 a 9 c 2 f 2 b 4 3 1 9 5 3 f c f e e d 0 f 7 e
C : \ 5 4 e e 1 f 6 2 b c 7 0 5 f 3 f 1 f 1 2 3 2 3 6 0 f e e 3 d 1 9 2 1 1 a 2 4 c 1 7 9 2 1 3 9 6 d d b 1 f f c d a 6 9 2 f 2 5 f 2
C : \ 6 5 0 7 9 3 7 8 4 e 8 8 7 e 3 1 3 6 9 b 5 2 c 0 1 b 1 e b 2 f 2 3 3 8 5 d 6 d d d b 5 4 c c 5 c 8 7 2 c c 9 b 8 6 d c 9 a 0 3 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c o d e c u p d a t e r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 1 N a M s 3 n z . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c o d e c u p d a t e r . p e 3 2
C : \ R R f 0 y z u 3 . e x e
C : \ 6 8 e 5 f 2 0 3 8 8 5 5 1 1 0 6 2 5 6 d 7 d 1 a 2 5 c 6 a e 3 3 1 1 9 8 c 3 a 8 e f e 0 3 a 1 1 8 9 8 f 9 b 4 f 4 7 5 9 1 b 6 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ e 0 f 4 e 9 0 f 0 f 3 9 6 5 0 d 4 b b 7 5 4 e 6 f c 2 7 8 f 3 f c 2 3 4 8 7 8 d 2 8 e 5 d d c 6 2 6 0 2 f 8 a 9 c f c c d f c 0
C : \ 9 d 9 2 c a b 3 9 7 1 c 2 1 3 7 2 e 1 a 9 a 1 a 9 f d e a 3 f 1 5 d d 9 c 8 5 9 4 6 f a 2 6 7 f e 3 8 a 7 a d 8 4 2 2 5 6 b 6 7
C : \ 9 2 5 0 e e c 1 7 0 c 5 2 6 1 3 d 5 6 2 7 a 7 9 a d d 5 9 4 9 d 2 3 f e 3 d a 1 1 6 d 0 a 7 c e c 9 3 0 4 4 8 4 e 9 5 c a 3 d 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ c 4 c 9 3 b 9 3 b 8 d 8 d 2 a e 9 8 7 6 1 4 6 6 2 6 a c e 8 7 4 b 8 1 1 d 6 5 7 d 3 c f 9 8 3 5 0 b 4 d b 6 6 c c 4 0 8 1 d c 2
C : \ 0 2 5 8 6 0 9 3 d 2 b 3 2 b b 8 7 8 d f 4 9 9 0 3 5 f 3 4 7 3 6 0 b a a 6 4 2 9 9 c 0 6 1 7 a 1 5 e 1 5 0 d 7 e e 0 f b 1 7 c 6
C : \ o M V p y f M h . e x e
C : \ d 1 8 8 9 8 c c f 7 b 2 0 8 9 2 6 2 e 6 0 6 8 b 0 8 0 d 8 3 3 c d 2 9 1 d 2 2 8 d 3 3 0 b b 7 6 9 2 e b e 7 0 d b a 9 7 2 d e 4
C : \ 3 8 8 4 7 2 7 c 8 3 e c b 3 f 1 1 2 2 c b 8 a 7 f 2 4 0 e c 1 3 8 4 3 4 b c d 1 1 a 0 2 f 9 9 f d 1 a 1 7 b 5 0 1 7 5 b 1 e 0 3
C : \ 9 f b d 0 9 4 1 0 6 9 3 b d 4 e 9 2 6 4 6 8 7 b 9 e d e d c 9 2 1 d c a e 4 5 f 3 5 3 2 d d 7 9 e e 8 1 0 1 f b 4 5 7 9 7 4 a a
C : \ D I L x 3 S k R . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 2 F f g 4 z S M . e x e
C : \ 6 7 5 e 4 2 b e c f 7 c 5 7 f 9 5 c a 3 1 9 c 7 2 1 b 5 b b 0 9 7 7 9 0 c 9 0 7 9 8 3 a 4 b 7 4 e e 5 7 1 6 5 0 b 5 a 6 2 f f 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ b d 4 d 1 2 1 c 2 c c 7 f f 4 4 e e e 6 a 4 a e 3 7 e d b 5 9 b 9 2 a 1 9 1 f e a 7 6 5 a a 9 4 e 2 8 6 e c 0 d 5 e b f 0 e d d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ 0 f 9 6 7 d 6 4 9 d 2 a 2 d 8 8 7 f 8 6 8 8 e 6 a 0 4 b 5 d 8 a a e 3 e 6 0 5 e c c 9 6 8 8 6 c 9 4 c 0 3 8 f 3 1 d 2 5 4 2 2 6
C : \ f f 8 1 9 b f 0 7 c a 7 d d 1 f d 1 f 9 5 1 d 5 8 c b 9 5 0 e 2 f 0 0 7 f f e d 1 2 5 8 6 d d f 9 8 e 4 3 4 7 8 2 c 6 2 8 a c 3
C : \ e b 8 c 7 8 1 b 6 b 2 5 5 4 f 2 1 b 5 6 8 0 6 9 a 4 e b f c e 9 5 4 f 5 b 8 a c c 4 3 0 d c f 5 5 e 8 2 d 1 4 c d 9 a 5 9 9 7 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ 6 2 0 b 2 6 8 a 1 d 5 6 7 3 c 6 9 c 5 d 3 8 d c 5 6 8 6 9 a 4 1 8 8 6 b 7 0 b 5 d b 3 c 6 2 5 b a 9 f d e d 1 5 b 6 4 7 1 e 0 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ 6 2 d 9 b e 7 b f 0 c 2 b 5 c 0 8 6 6 b 1 0 8 e 0 2 d 2 5 b 4 d 0 7 3 9 d a c c f f 1 9 4 9 4 e 2 0 d 6 1 5 4 4 b 5 9 9 3 b e 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ b f 4 7 f 9 8 e d e 5 1 3 5 d 5 6 5 5 f 2 f 2 8 e b d 6 6 2 0 a f 9 e 5 c c 4 6 c 9 1 3 c d 7 a 0 5 8 7 6 4 f 0 6 d c b c 9 e 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ b 8 2 8 8 c d 7 3 1 b 1 4 1 0 9 7 9 9 e f 2 d 0 2 a 1 1 c 7 3 0 b 7 e 7 e 9 5 b 0 c 0 5 1 1 d a 8 8 e 5 d 6 9 b d 5 8 6 b 9 3 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ d e a 2 2 a 3 2 3 6 0 5 0 4 c 5 f 5 a 6 7 0 6 e a 0 9 0 3 6 6 d 5 9 3 7 5 4 4 2 9 d 1 8 e 7 f 3 6 e f 9 d 0 0 3 b d 3 2 0 2 e 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ 9 7 3 5 b 5 4 4 e 2 4 2 e 5 f 3 e 8 8 f 7 7 e 8 d 5 f 5 8 b b 9 3 f b 8 6 0 4 6 f b 4 7 2 4 b c 8 6 6 d c c 4 e 0 3 c b 8 3 7 c
C : \ b 0 7 4 8 c 9 8 0 5 f 4 3 3 7 5 6 3 e 5 7 2 0 a 2 8 c 7 9 9 1 a 7 2 b 1 c 1 2 5 7 c 5 1 f 3 4 8 3 6 4 c 3 8 1 b b c 8 9 e 8 3 0
C : \ e 0 a 7 6 5 3 6 b d f 9 4 3 2 b 1 f 8 b 0 c 1 9 3 9 2 9 5 1 5 f 1 a 9 4 2 6 8 b 3 6 9 d 5 c 4 5 0 4 e 4 4 7 d b 9 7 7 e 4 6 1 4
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ u q 5 M 3 K b O X y . e x e
C : \ 4 5 7 e a a 9 c 5 2 4 9 8 3 b d 5 e f 0 f 6 0 d 9 0 8 6 f 5 2 2 7 6 7 c e f f b b 1 d 9 c b 7 8 9 2 4 8 d 1 9 7 1 6 7 2 2 1 e 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ b f b a 4 a a 3 7 7 4 0 d c 3 3 2 d 0 7 c 3 6 e a 6 8 c 7 2 8 1 f 7 8 1 7 3 0 f 4 d e 8 f d 9 0 d 2 b 1 d d 5 c a 1 d d 6 f 2 b
C : \ 2 4 7 b d a 9 e d c 1 c 4 2 7 6 f a 9 6 2 c 7 5 b f 2 e b 7 c 6 5 5 d 5 7 8 f 4 0 b 8 9 7 6 4 b b 4 0 b d d b 1 5 a f f 0 2 4 4
C : \ 0 c 0 c 0 b 0 2 b 9 2 0 6 9 4 7 6 0 7 c f 1 9 c 9 5 d 5 d 1 a 9 4 3 e 3 1 5 4 4 8 8 d c 6 3 3 c d 0 e 4 f 8 4 2 f 8 3 e 6 7 b e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c o d e c u p d a t e r . p e 3 2
C : \ 0 b e c 4 9 9 e b b d e 5 6 9 b 9 c e 4 d d 6 2 b 4 8 d d 0 2 0 4 d b 3 6 1 2 3 a 8 a 6 1 c b 8 1 9 1 e 4 9 6 a 9 9 f f f 6 f e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c o d e c u p d a t e r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 3 3 8 2 8 2 f 7 f c 2 5 b 7 0 _ c o d e c u p d a t e r . e x e
C : \ 3 d 7 3 f 9 f c e 4 1 9 e 2 c 1 5 b e 8 b a 9 8 2 c 9 a f 2 f 2 9 3 5 2 5 0 0 a 3 1 b 3 b 0 f e 7 8 5 2 3 5 d 1 2 9 3 2 6 b 1 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ 9 1 2 b 1 9 6 b c a 1 a 3 7 b d 7 f f a d 5 0 9 2 b 6 f 6 0 2 2 1 f 2 2 c 9 1 b 2 e 8 6 c 7 e a 4 1 1 9 3 5 f 8 8 e 9 6 b 5 9 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ f a d 5 d 6 c 1 8 3 d 9 a c 3 2 0 2 0 2 3 8 e 7 e b 9 a b 1 f 0 9 8 3 8 d d 3 2 e c 3 1 1 5 c 2 5 7 7 e 4 9 1 f f 7 2 a c c 7 f
C : \ f f b f 7 c 4 8 0 2 d 9 b d a e e 0 4 a 8 1 6 e 1 b 6 f 1 0 e b 0 2 3 f 2 c a 8 6 c 6 c 8 6 1 5 5 f e e 1 a 8 9 e 3 1 f 4 c 3 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c o d e c u p d a t e r . p e 3 2
C : \ b 2 0 a 1 f 4 f 2 b 6 1 f 7 e b a 9 a 0 6 1 c 9 8 1 6 4 3 b e 4 a f 9 6 a 4 6 9 c b 5 1 6 c 7 0 8 4 b d a 0 7 f 7 1 f 4 4 1 9 7
C : \ 7 0 7 3 d 7 3 4 8 2 b 7 5 e 0 6 6 4 7 8 c 9 d 2 2 1 e 3 7 a 1 b 5 1 8 2 1 d e 5 9 3 9 d 6 7 9 b d 1 9 5 4 5 b 7 4 3 d 8 2 e 8 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c o d e c u p d a t e r . p e 3 2
C : \ 0 4 b 4 7 e 7 8 7 0 6 d e 1 a a 8 6 2 9 f 0 2 1 c b 5 9 5 d 8 6 5 d 3 d b d 5 c c 8 d 4 7 6 6 c b 6 6 c c e 9 f a 0 7 4 1 1 d 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ 1 2 6 a 8 c 6 d b 4 b 2 1 7 6 2 e 1 0 5 2 6 e 8 9 a f a 3 a 3 4 6 3 c 7 5 6 a e 7 5 f a a 3 9 a 2 3 e 8 c 3 5 d b 0 1 d 2 5 5 3
C : \ d 8 6 b f 7 b f 9 a 0 3 7 5 f f 3 c 3 7 7 b e a 5 f 1 9 3 9 a 7 1 a 0 2 7 9 7 3 7 5 5 c d 0 c 4 9 a 9 6 1 9 2 9 7 e 1 2 0 2 f 4
C : \ 1 2 d e 1 5 7 5 1 7 5 9 b 8 4 e 4 0 9 4 b d 0 b a 7 4 d d c 2 2 b 2 4 3 e a f a d 4 3 5 7 b a b a 6 e 0 4 1 b f 9 b d c 2 4 b 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ 6 3 6 3 d a b f 6 3 c a 6 1 5 6 8 b 4 9 8 4 3 a a 4 7 a 2 f 2 e f 0 c e 5 1 b c 2 7 b 9 f 3 7 a 2 4 4 c f 9 c 3 e a 3 4 8 2 0 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ 8 2 2 0 0 4 e e e e 8 8 0 9 1 c 4 0 6 d 2 a 2 e 9 6 7 b 2 4 a 9 9 0 0 4 0 2 4 f 9 b 9 d 6 9 6 f 4 0 3 d e b 5 1 7 9 6 f 2 c d 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ 7 2 e 1 4 e 0 1 b e 7 9 0 4 e 6 1 9 6 1 7 f 0 6 5 e 1 6 6 8 1 6 d 7 c 6 3 b 9 1 a f 5 4 f 8 4 1 7 3 5 e 0 c e 1 a d e 2 5 e a 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c o d e c u p d a t e r . p e 3 2
c : \ t a s k \ 8 8 5 2 E 0 4 7 9 1 A 0 3 2 7 2 F 7 4 6 B 7 0 3 A 5 2 8 9 B B 7 . e x e
C : \ 0 3 4 2 9 a 1 1 6 0 9 8 4 7 6 1 9 f c c 0 d b 3 4 5 7 2 4 2 8 d e c e b e 4 3 9 4 1 0 f 4 7 2 f 0 e f 2 a 0 8 2 7 1 5 8 f c 5 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e r . e x e
C : \ b c 2 e 7 3 b 1 5 b 6 6 7 6 1 2 2 2 1 e d 0 4 e c e d 6 3 a b 8 1 d 0 8 e 8 f a d a e 3 0 2 4 4 e 6 b d 9 9 d 7 3 f b 6 5 2 c 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c o d e c u p d a t e r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 b f 5 c 9 9 f 1 c f 0 a 5 3 7 _ c o d e c u p d a t e r . e x e
C : \ 6 1 6 a 9 d 1 a 5 d f 1 4 f 7 9 c c 9 7 4 8 3 e a d 1 f 9 c e 8 4 f 6 d 0 c d a c 1 c 9 8 5 a e 9 e f 7 d 0 e a 9 2 8 e 0 a 0 3
C : \ 5 8 8 2 3 5 7 8 e 7 6 e 9 0 6 8 9 b 6 4 f d 7 c 5 e 3 6 4 1 c b 8 d 1 4 f 5 4 e 9 c 0 c 3 c a 0 9 3 9 a 3 8 7 b f 1 e 4 d 8 9 5
C : \ a 5 7 0 8 9 a 9 b e f b 8 4 d b d d 1 c 7 e b d 8 b 9 5 9 3 9 b 4 1 8 a c 6 0 d 1 5 9 e a 8 0 a 1 a f b f e f 6 e c 3 c 6 f 7 5
C : \ e 1 7 a f 5 6 1 2 4 3 d a 9 d 1 e 0 4 e 3 6 0 e a 6 0 e e 2 3 c 0 6 d a 6 c c 9 b a 2 b c 5 1 0 a 5 1 e 6 c a 3 2 a 8 4 f c 7 9
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.