1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.67
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | TrojanDownloader:Win32/Upatre.4f751dbd | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20240423 | 23.9.8494.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | None | 20231026 | 1.0 |
| Kingsoft | malware.kb.a.1000 | 20230906 | None |
| McAfee | Downloader-FSH!AAF8D2BEF6B5 | 20240423 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10bf0882 | 20240423 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(1 个事件)
| section | {'name': '.rdata', 'virtual_address': '0x00003000', 'virtual_size': '0x00000b40', 'size_of_data': '0x00000c00', 'entropy': 7.070256148465221} | entropy | 7.070256148465221 | description | 发现高熵的节 | |||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.Agent.BCMC |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| AhnLab-V3 | Trojan/Win32.Waski.R103294 |
| Alibaba | TrojanDownloader:Win32/Upatre.4f751dbd |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Agent.BCMC |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | TR/Agent.BYSY |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Agent.BCMC |
| BitDefenderTheta | Gen:NN.ZexaF.36804.buY@a0VLaJbi |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDownloader.Upatre.A4 |
| ClamAV | Win.Malware.Bublik-9948473-0 |
| Cylance | unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.DownLoad3.32514 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Agent.BCMC (B) |
| F-Secure | Trojan:W32/Agent.DUUN |
| FireEye | Generic.mg.aaf8d2bef6b592dc |
| Fortinet | W32/Waski.A!tr |
| GData | Win32.Trojan-Downloader.Upatre.BK |
| Detected | |
| Gridinsoft | Trojan.Win32.Agent.vb!s1 |
| Ikarus | Trojan-Spy.Agent |
| Jiangmin | Trojan/Generic.azvqp |
| K7AntiVirus | Trojan-Downloader ( 0048f6391 ) |
| K7GW | Trojan-Downloader ( 0048f6391 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Kingsoft | malware.kb.a.1000 |
| MAX | malware (ai score=87) |
| Malwarebytes | Generic.Malware.AI.DDS |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FSH!AAF8D2BEF6B5 |
| MicroWorld-eScan | Trojan.Agent.BCMC |
| Microsoft | TrojanDownloader:Win32/Upatre.O |
| NANO-Antivirus | Trojan.Win32.Bublik.cwbxyq |
| Panda | Generic Malware |
| Rising | Downloader.Waski!1.A489 (CLASSIC) |
| Sangfor | Suspicious.Win32.Save.a |
| Skyhigh | BehavesLike.Win32.PWSZbot.nm |
| Sophos | Mal/Upatre-A |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.10bf0882 |
| TrendMicro | TROJ_UPATRE.SMBB |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2006-12-17 21:24:28
PE Imphash
bef15b6d6e736ad99d551c5b799de830
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00001073 | 0x00001200 | 5.418291402443088 |
| .rdata | 0x00003000 | 0x00000b40 | 0x00000c00 | 7.070256148465221 |
| .data | 0x00004000 | 0x000004c6 | 0x00000600 | 2.040062143206467 |
| .rsrc | 0x00005000 | 0x00002978 | 0x00002a00 | 4.744015383823262 |
| .reloc | 0x00008000 | 0x00000126 | 0x00000200 | 2.709729649431876 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000053b8 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00005278 | 0x0000013e | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00007960 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x00005130 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x403030 DialogBoxParamA
• 0x403034 SendMessageA
• 0x403038 SetFocus
• 0x40303c GetMessageW
• 0x403040 DispatchMessageA
• 0x403044 EndDialog
• 0x403048 GetDlgItem
• 0x40304c IsChild
• 0x403050 GetActiveWindow
• 0x403054 SetCapture
• 0x403058 GetWindowTextW
• 0x40305c TrackPopupMenu
• 0x403060 FlashWindowEx
• 0x403064 TranslateAcceleratorA
• 0x403068 GetKeyState
• 0x40306c MessageBoxA
• 0x403070 GetDlgItemTextA
Library KERNEL32.dll:
• 0x403008 HeapAlloc
• 0x40300c GetProcessHeap
• 0x403010 GetModuleHandleA
• 0x403014 CloseHandle
• 0x403018 GetTickCount
• 0x40301c HeapFree
• 0x403020 GetSystemTime
• 0x403024 GetVersionExA
• 0x403028 ExitProcess
Library COMCTL32.dll:
• 0x403000 None
L!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
0h5Tjh
3hE0HhHE
3P0P3DE0ET
53 0ED3
D$Hu$H
EEPHTH0hhTPE
hTT0 555H
EjP5D5$ED
PDhuPHD$
j0P Hu
hh3ET3
tM5\D@
MQ3PPPUR
j05TD@
j05HD@
j05LD@
j05PD@
j05DD@
TP0HjPEP
Du3jPD EH
DH 0D3
u5jEDEu
DPh$0$
E$$p`E
30u0PP3jH
h5 DD5uE$DT
u33jTH
$H03Hu
P55Pu3D
uSAWVAf9
GEGEGMG;r
QIUY0@
h0hhE5T
3P3Tu$HDD
P j jH
DhDjEHj T
uPj5$j33j
T5EPuTh
H 3 $DuEE hj
D00Dj E
EUV3W}
FG3@_^]
DPHTPu
E T$T5h
Hjh55H 5$HDj
PPE5HP0j5
EHhT3hE3
E E 33D3
jjE$$P3$u
h$Eu $D0 VWSSu
X+PQkYIuKXG[O_^
huHjjDuu$PD
5uPPhP
Du$uhjP
E3PE$TDj
3hH3uE
uHjhTR
SUl$(3VWD$
PL$4j%D$4PL$
n0Q'Tk$ Xx
jR0@k(=_
- _`n0Z&vp-6eh
Yu$S|yEDR&vp-6|h[!z&Sm.!R
E*}0UQ =O
o(WCx| #hln0Z&xx/7G
Y(];Ym
!D~^*['\uA
f!>7Uk/6_c
]DJ3Uw
6Z~a0[
/0J)6Gu
Q%@s&jxA!2
p>noNU
.hk$6O)S;b)D
~A;DT)1qAS+
XDKdl=u+S{l9
d\$\CQ
^cjxhAu>h
/H>/C0
$\g[+0
AS>\$\O
S3[UVwc7|^p
^xHUdkoC0H
~XnP^+
ASzjx($\{g
\lj[>)n'
H|50DdLAS+
U{(]3B|2 ikG
U(dxiAA
H$$\['in
ES+lM%)u
3N@ hk
>\$|.hk$m
z> Qjo6S}
"@i-:Hd
%]/Em(<En
@DUmSv,S
^km4)3F
tdiminutiveness
#/ Hu*g
GetDlgItemTextA
TranslateAcceleratorA
GetKeyState
FlashWindowEx
TrackPopupMenu
GetWindowTextW
SetCapture
GetActiveWindow
IsChild
GetDlgItem
EndDialog
SetFocus
DialogBoxParamA
SendMessageA
MessageBoxA
GetMessageW
DispatchMessageA
USER32.dll
GetVersionExA
GetSystemTime
HeapFree
GetTickCount
CloseHandle
GetModuleHandleA
GetProcessHeap
HeapAlloc
ExitProcess
KERNEL32.dll
COMCTL32.dll
VmrtuelPrktecp
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>
}zz~{{
/ / / / / / / / / H</ / ZL/ / / / / / / / / / / / ,
0 0 0 0 0 0 0 0 G<z0 G<0 0 .
/ 0 0 0 0 0 0 0 .
0 2!2!2!2!2!2!2!2!z2!\Q2!2!i^2!2!2!2!2!2!2!0
2!3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"2!
4#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#4#
5$5$NBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNB5$5$5$
4444444444444
5"575A5^5i5o5t5
555555555555555555
6$6,646:6A6F6P6V6h6o6t6z66666667777:/;;;<<
*2.22262:2>2B2F2J2N2
e n e r a l P u b l i c L i c e n s e a l o n g w i t h
l a s t v e r s i o n
M i c r o s o f t S a n s S e r i f
C : \ D O C U M E ~ 1 \ U S U A R I \ C O N F I G ~ 1 \ T e m p \ R a r $ D I 0 0 . 4 6 9 \ F A X _ 6 2 9 1 7 4 1 _ 7 9 4 1 7 2 4 . s c r
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ 4 z 8 O 1 S 1 3 5 . e x e
C : \ 8 5 e 0 0 e a 8 b 1 0 d 3 7 2 3 5 5 b 3 5 a 5 f e 7 3 6 6 4 1 8 f 7 4 7 6 2 f b 1 b c 3 c 1 e b 6 1 5 8 c a 0 1 f d 2 8 b f a f
C : \ 8 0 6 8 f 1 9 9 a 3 e 6 e b c 6 7 4 0 b 7 f 0 8 b 0 c 8 8 f d 5 a 6 4 b 2 8 6 f 2 4 6 a 5 d c 5 e 6 8 5 0 5 d 1 a 0 e 4 2 f 4 7
C : \ 3 7 f f 5 b 5 c 4 a d f 9 5 0 0 d e e 0 0 b f 2 8 2 b 5 6 d 1 2 2 8 a 0 4 9 b 0 5 e 0 b 6 b 2 5 4 a 3 b 9 4 b 9 a 9 6 1 8 e 4 7
C : \ Q n a _ _ D g S . e x e
C : \ 5 e t X 4 m I 7 . e x e
C : \ R j r 8 7 c B a . e x e
C : \ V T 2 R 5 L u d . e x e
C : \ x j o N c L l t . e x e
C : \ c 5 Z 6 N E y F . e x e
C : \ k o n i z K s I . e x e
C : \ p U p z F n 2 i . e x e
C : \ 9 u K E y Y Y w . e x e
C : \ A Y 9 Y V w q V . e x e
C : \ f K S 8 n j d k . e x e
C : \ 1 4 Y j U T Y M . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ t c 0 7 U h G S J . e x e
C : \ c 4 4 a 4 5 4 1 2 e 6 d 0 c 6 3 f 7 7 7 c a a f 9 f 4 e 4 8 3 6 a 7 9 8 d 7 d 5 2 0 1 9 4 6 9 c d f f 1 d d d 9 b f 4 5 7 f 2 8
C : \ c 3 e d 9 e 9 8 7 7 c 8 0 a b 3 d b b a 3 0 0 a d b 6 1 f a c 8 8 2 9 1 9 e 5 b b a d e f 2 e 5 3 f 8 2 2 0 3 7 c 6 4 0 b 5 8 2
C : \ 6 c b 1 3 e 8 7 4 0 6 8 e 4 a c 9 d 0 b 6 3 d a 0 4 e 1 4 2 d 4 d 7 e e 5 0 7 a 6 e 9 e 1 d 7 0 6 a 3 4 5 7 b f 8 5 a 7 4 3 5 1
C : \ h F A 3 U V y i . e x e
C : \ c W p h x C a k . e x e
C : \ p f q 4 W E p i . e x e
C : \ y o e h Q T m 7 . e x e
C : \ m j n Q 6 K h r . e x e
C : \ 8 b e 4 e e 8 7 8 e 6 4 e 2 5 c 2 b f 6 a 4 e d f a 4 9 2 c 6 1 e 0 8 2 7 f b a 1 1 9 7 b 5 a 5 9 3 b f 5 c c 5 2 7 7 c f 0 9 f
C : \ 3 d 8 7 2 d 1 3 5 8 8 d b d 1 e 3 2 2 7 f d 6 5 1 d f b b 6 3 4 2 0 d 3 9 9 5 4 3 3 f 1 4 4 8 6 5 9 3 b 2 4 1 a 5 8 d b 7 0 e 5
C : \ d 3 0 3 d c e 1 3 e f 4 2 d e 3 b 8 4 0 7 9 9 3 f 3 2 0 d 5 2 6 f b 8 b 3 d c b 3 1 c b 5 e a d f a d b 3 d c e 3 c 0 0 4 5 6 9
C : \ W I U E J G w k . e x e
C : \ 0 b O q y Q k p . e x e
C : \ 8 m R 4 E m M z . e x e
C : \ W C d r 4 j h B . e x e
C : \ 0 4 f 8 G R 9 3 . e x e
C : \ D R B m O m 3 8 . e x e
C : \ x B N u b u X g . e x e
C : \ O d 9 x 3 j j s . e x e
C : \ O n d P E k I d . e x e
C : \ 4 p I o I Z L s . e x e
C : \ W 5 f n l X 8 J . e x e
C : \ e g K V A _ 7 N . e x e
C : \ 7 u H y U 4 x E . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ V b 5 o Z 4 J w c . e x e
C : \ d R u S Z D 0 A . e x e
C : \ R M k f 6 l c y . e x e
C : \ o U a x A k a k . e x e
C : \ 2 z j Z r l G 9 . e x e
C : \ L V x e H f 9 F . e x e
C : \ D O 0 L R u t U . e x e
C : \ Y O Z 2 M v h _ . e x e
C : \ W A 2 G a 3 M C . e x e
C : \ o Z Y b d o Z D . e x e
C : \ V S W a k 6 s b . e x e
C : \ a c f 4 6 0 1 1 6 f 0 d f 5 6 3 9 6 9 2 9 1 9 c 7 6 f a 2 6 5 3 8 8 c e e 4 8 8 a 4 4 5 1 9 2 c 3 a 7 c 0 2 3 1 f 8 8 5 5 b 0 4
C : \ f 4 3 4 a 9 8 9 5 9 2 0 4 4 3 8 c 6 3 f f 1 4 d a d 7 f 6 a 7 e d b 8 f a 6 7 d 1 3 1 d d f 7 9 0 5 4 8 e c 9 8 5 b 6 2 7 5 6 1
C : \ 9 i P L 9 6 p a . e x e
C : \ e 8 1 3 9 a a c 5 0 c 0 1 5 e e 7 6 f d 3 0 7 8 4 8 8 2 0 6 f 2 b 8 4 0 f 3 e 5 b b 4 b 1 8 3 6 f 8 7 a 6 2 0 b 7 f c 0 2 6 6 1
C : \ 3 4 d b 8 d b 2 b 2 7 2 2 3 8 0 5 6 b 5 f 5 d 6 c 2 d c 8 5 9 5 6 5 6 e a 5 5 e 7 6 5 b f 6 8 8 1 8 0 d e b 1 8 2 f e 7 4 7 0 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 2 b c 2 b 3 0 5 c 6 1 a 3 d 7 c 8 9 3 0 7 5 9 c 8 9 9 7 a c 4 b e 8 3 0 a 8 a 6 b e 9 6 7 d 6 e 3 e 4 f 1 4 e 3 6 0 a 7 b a 8 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 8 a 8 d e 1 5 d 5 3 d 6 d 1 d 3 8 7 d b 7 a 6 5 f 1 a e 9 d c 4 7 2 5 7 2 5 6 3 4 d 3 8 d a 3 8 e e e 6 3 8 8 e 1 8 8 c 2 6 e 7
C : \ 7 6 5 a 9 9 3 d d 8 0 6 0 e 3 4 c 9 5 4 f 6 1 f 5 0 8 0 6 b d e 0 f 2 3 f b e 0 e 9 e 9 c e 5 f 5 e f 6 f a 9 9 d c d e 5 0 2 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 6 5 5 2 2 5 6 6 8 a 3 d 7 8 6 f 1 5 6 d 3 a 1 5 e 8 d b 9 f 6 d 8 7 e 2 3 a e 2 b 1 3 3 7 9 0 5 a 4 1 9 2 f 8 5 e f c 3 e f 2 a
C : \ 8 8 6 D t 1 c a . e x e
C : \ 2 e 9 0 6 f 9 c b 5 c 6 c a 7 4 d 6 7 f 2 0 8 9 2 3 f 9 2 6 1 1 9 1 7 b 4 e 2 3 3 8 8 2 e a c 1 7 1 0 7 4 0 8 a 5 a d 6 3 2 5 a
C : \ 0 9 b 2 3 7 f a f b d 9 d b 5 3 6 5 2 b 5 4 8 9 d e a c d 9 1 4 a 9 1 c e 1 3 e 3 f f c d 8 2 7 f 9 7 b 1 a 2 f 9 f 0 f a 5 0 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 5 5 0 d 8 e f 4 1 e 9 a 5 2 5 e f 8 0 4 2 f f c 6 6 c c c 9 1 1 2 9 0 f 5 4 6 9 6 0 a f 9 a a a 8 3 9 1 c 8 4 0 1 e 3 b 9 4 b b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 9 3 6 c d 2 c d 3 2 6 3 5 5 c 7 a 4 a 2 c 7 2 3 6 c e 8 b e 4 4 8 f 1 9 6 d 9 8 8 6 8 6 e 1 e 6 3 6 0 b 4 0 9 6 7 b 2 f 4 b e f
C : \ 9 7 d b 3 7 b c b c 3 9 3 7 b 5 a b 8 5 6 1 e 3 e f 7 4 3 8 7 5 5 d b 4 e 3 8 d f 6 7 8 b 8 7 0 d 3 1 7 5 2 e 0 7 8 0 c 7 c 5 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ c Y P y k M Q f . e x e
C : \ 7 6 3 c 4 d 6 e a 2 a 5 d 4 a a a f 9 1 9 b 7 8 5 5 6 5 8 8 f 9 d 2 6 9 a 1 8 5 1 0 6 a e 2 3 2 a 6 8 e a 9 b 1 4 7 0 6 4 a d 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ d 9 a 7 b 4 d 1 3 d 2 1 8 2 0 d c 6 f 2 a 8 f 4 2 9 d e 8 8 2 4 7 a a 0 c 9 7 1 6 f 1 b 0 9 5 6 1 d 3 a 2 e a b a 8 c 5 7 c 2 8
C : \ 6 6 f e b c e 0 2 3 6 d 7 e b a b e 3 c c 2 4 1 e 2 8 e e e 8 b 1 1 f e 6 0 4 5 3 6 d 6 d f d e f 7 7 8 c e d 1 3 d c 5 1 7 5 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ e a 6 5 0 e c e 5 4 0 c 2 c a 8 5 e 7 d 8 3 2 7 b 6 e 5 9 a 6 e a 9 c 7 7 5 1 7 c 0 9 0 d d c 1 0 c 9 9 4 6 4 a 7 9 9 9 6 4 a 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ r d d V u Z x H . e x e
C : \ 8 d e b a 4 8 4 8 0 1 2 6 a f 3 4 4 3 a b 1 3 0 1 f b b d 3 3 1 3 9 e 6 a 9 0 8 3 b 1 e 8 3 e e 0 b d 3 5 9 9 4 1 b 7 3 6 5 1 e
C : \ e e 4 a d a 1 4 7 d f 0 6 9 c 1 8 3 7 4 b 2 0 9 2 9 b 9 e f c 1 6 d 1 1 9 7 f c 5 6 c f 8 1 a c 5 0 8 0 5 7 2 a c 1 1 2 1 5 7 1
C : \ 0 6 4 7 9 f 6 a d 7 9 3 0 a 2 6 a b c 0 1 6 0 2 1 2 b 1 3 6 3 2 c 5 a 9 b 6 3 9 f 8 2 3 d d 2 5 d 6 3 0 2 6 c 0 9 1 9 1 7 1 3 b
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ 8 N s A a n F A H Y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 8 9 0 b 6 e c 4 3 a 0 6 4 2 8 f 5 0 d d 3 a c e d 2 8 c 5 3 7 . e x e
C : \ 7 b 4 c e 3 8 8 f 2 6 b e 4 8 6 c e f d 9 e 5 6 9 d 9 7 3 5 c 8 7 2 3 b 8 2 0 c a a 0 b 4 c 8 0 8 6 3 f 2 8 9 2 f 6 0 6 2 1 7 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ l c a s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ l c a s . p e 3 2
C : \ 8 b e 5 d 3 6 3 5 8 a e d 4 5 5 7 e 5 b b a c 3 b 8 d 1 2 5 7 9 d f 3 9 6 2 8 6 e c 8 0 9 c c f 1 e 5 6 d b 7 a 1 9 8 6 4 5 0 4
C : \ 4 0 5 7 f 8 7 7 7 9 9 5 0 9 f c 6 e 1 9 0 9 6 f 3 f 7 8 0 a c b 0 0 8 a d 7 9 0 2 b 2 6 b 5 5 f e 4 c 7 a b 0 c e a 9 c 8 2 1 7
C : \ 7 9 1 6 5 e e f 6 5 c f 2 1 8 a 6 8 a c 4 4 5 1 9 9 7 c 2 8 d 0 c 3 d 1 5 b 0 1 3 1 7 5 3 9 d a 6 c 0 d a b 4 2 e 0 d 2 b f 4 d
C : \ U s e r s \ J o h n \ A p p D a t a \ L o c a l \ T e m p \ i Z k f a i o h G v . e x e
C : \ d 9 5 1 8 9 b 9 d 8 3 b e 7 f 3 f 7 b d a 0 3 a d 7 e 2 1 b f d 6 1 f 1 3 3 2 b 8 f c 5 2 9 7 a 3 8 f c 2 e 5 3 5 d 6 1 c 0 8 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ l c a s . e x e
C : \ a 5 0 f 7 2 8 f d 2 8 f f 0 d f d d b d 3 f 0 6 1 c 9 5 8 e 0 f 7 c 8 c 6 a d 5 1 5 a 6 8 3 c 7 b 1 4 8 4 0 5 e 0 6 4 f 4 0 8 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ l c a s . e x e
C : \ 3 7 4 2 f 6 9 b a 1 b d c 0 b 2 4 2 2 1 2 8 4 f f 9 4 0 0 a 4 b 3 3 2 3 7 7 b d 7 d f e 0 4 0 a d 7 3 6 4 9 4 1 2 0 f 6 c e e 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ l c a s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ l c a s . p e 3 2
C : \ 4 7 b f 3 2 9 5 c d 3 5 1 b b b 9 b 3 a d 2 1 4 0 2 b a 9 d 8 3 b b 8 0 c 4 b a 2 8 c 5 2 7 3 6 f b 6 1 d a b 3 6 0 d 5 7 0 3 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ l c a s . e x e
C : \ 4 1 4 2 8 5 5 c 9 4 e 2 a 5 1 a 4 4 7 6 a 7 8 7 1 6 b 6 a b a b b e 5 9 6 9 d 1 3 a 2 3 5 7 8 9 b 1 2 a e 7 d 1 8 f e c 3 5 b d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ l c a s . e x e
C : \ 8 9 0 2 4 e 4 6 9 8 7 5 5 5 b d 1 8 e 7 3 9 0 e 4 e 6 0 5 2 2 3 8 d 5 a 5 c 5 2 c c 0 b 2 b 0 7 1 7 c 1 1 b 2 f 8 7 a 2 9 e 0 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ l c a s . e x e
C : \ d e a 7 1 0 c 2 a a 9 d 6 c 4 a 9 f 0 a 8 0 b 4 6 c a 0 6 f 5 7 b 7 f c 1 e 0 a 3 8 8 7 1 1 2 5 2 b 8 d 5 3 c b 8 0 e c d 5 0 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ l c a s . e x e
C : \ 6 4 0 8 8 d 2 f b 9 6 5 d d a 7 6 7 4 f 7 7 1 6 1 8 9 8 a b 1 b a 8 7 2 8 d 1 b c f f 4 b b 3 5 a 6 e a f 5 5 8 a b 5 6 0 7 9 7
C : \ 4 0 d 7 9 0 9 c 4 1 0 e 6 2 0 8 9 9 4 b f b 5 e c 3 3 9 9 2 3 e 0 0 2 8 4 d 2 4 d c a 8 c 8 e 8 6 6 3 0 4 2 0 d 9 a 8 3 6 c a c
C : \ d 4 b 8 5 4 1 d 5 4 6 7 4 c b c a f 5 0 d 6 d 3 4 6 2 6 6 e b 5 4 5 9 b 1 0 4 0 e 6 3 2 8 1 5 e d d f 9 9 9 3 3 b 3 c 0 f e 7 e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ l c a s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 7 1 b c 5 3 4 6 4 a 1 c c 8 e _ l c a s . e x e
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.