0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.68
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Crypt-QDX [Trj] | 20200430 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.av | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200430 | 2013.8.14.323 |
| McAfee | Downloader-FWH!BD88D3CA0DF8 | 20200430 | 6.0.6.653 |
| Tencent | Trojan.Win32.Bublik.bkdm | 20200430 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.GenericKD.1393477 |
| APEX | Malicious |
| AVG | Win32:Crypt-QDX [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1393477 |
| AhnLab-V3 | Trojan/Win32.Zbot.C216253 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Generic.D154345 |
| Avast | Win32:Crypt-QDX [Trj] |
| Avira | HEUR/AGEN.1108089 |
| Baidu | Win32.Trojan-Downloader.Small.av |
| BitDefender | Trojan.GenericKD.1393477 |
| BitDefenderTheta | Gen:NN.ZexaF.34108.fqZ@ayAp0sci |
| Bkav | W32.AIDetectVM.malware |
| CMC | Trojan.Win32.Bublik!O |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.MAUA@5rueuc |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.a0df8c |
| Cylance | Unsafe |
| Cyren | W32/Trojan.CSFI-3153 |
| DrWeb | Trojan.DownLoad.64690 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.ABG |
| Emsisoft | Trojan.GenericKD.1393477 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.GLI |
| F-Secure | Heuristic.HEUR/AGEN.1108089 |
| FireEye | Generic.mg.bd88d3ca0df8ccc4 |
| Fortinet | W32/Bublik.AEOV!tr |
| GData | Trojan.GenericKD.1393477 |
| Ikarus | Trojan-Spy.Zbot |
| Invincea | heuristic |
| Jiangmin | Trojan/Bublik.gex |
| K7AntiVirus | Trojan ( 0001140e1 ) |
| K7GW | Trojan ( 0001140e1 ) |
| Kaspersky | Trojan.Win32.Bublik.bkdm |
| MAX | malware (ai score=81) |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FWH!BD88D3CA0DF8 |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.nh |
| MicroWorld-eScan | Trojan.GenericKD.1393477 |
| Microsoft | TrojanDownloader:Win32/Upatre.E |
| NANO-Antivirus | Trojan.Win32.Bublik.coezmj |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM20.1.E760.Malware.Gen |
| Rising | Downloader.Small!8.B41 (TFE:dGZlOgV1ZPjVnIwWhA) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/DwnLdr-LDU |
| Tencent | Trojan.Win32.Bublik.bkdm |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-11-11 22:50:45
PE Imphash
93f3c3f7fa917eec6b457a216663e185
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000e7a | 0x00001000 | 6.627736516392026 |
| .rdata | 0x00002000 | 0x00000454 | 0x00000600 | 4.661152375082767 |
| .data | 0x00003000 | 0x000000d0 | 0x00000200 | 3.0215210660042207 |
| .rsrc | 0x00004000 | 0x00001f10 | 0x00002000 | 5.210524071213055 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00004250 | 0x00001ca8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00005ef8 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000040f0 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x402038 GetMessageA
• 0x40203c PostQuitMessage
• 0x402040 DispatchMessageA
• 0x402044 UpdateWindow
• 0x402048 LoadCursorW
• 0x40204c TranslateMessage
• 0x402050 LoadBitmapA
• 0x402054 CreateWindowExA
• 0x402058 RegisterClassExA
• 0x40205c DefWindowProcA
• 0x402060 MessageBoxA
• 0x402064 SendMessageA
• 0x402068 LoadIconA
• 0x40206c PostMessageA
• 0x402070 GetClassLongW
• 0x402074 SetWindowTextW
• 0x402078 ShowWindow
• 0x40207c GetKeyboardState
Library KERNEL32.dll:
• 0x402008 GetProcessHeap
• 0x40200c GetModuleHandleA
• 0x402010 HeapCreate
• 0x402014 HeapFree
• 0x402018 DeleteFileW
• 0x40201c CreateFileW
• 0x402020 HeapReAlloc
• 0x402024 SetFilePointer
• 0x402028 WriteFile
• 0x40202c ReadFile
• 0x402030 HeapAlloc
Library GDI32.dll:
• 0x402000 GetStockObject
L!This program cannot be run in DOS mode.
R:)RSR
RRichR
`.rdata
@.data
USER32.dll
NTDLL.DLL
KERNEL32.dll
GDI32.dll
C/3u+GXMl
h@@E@ 30 33Eh3@
0@hjj 3@ 3 @ E
3@3hhj@@@
@j 00 Eh E@3@ jj0
@h hULV5h @
WWPWWh
t*=L @
3E jE3Eh3@@@@
0 jEhjj
00h0hj@ hEE
h3jjEE@hE
E3@@3j3jEhh
EE0h3Ej j3@hE@E3hE
VWAAf9
uE@ME;ve
E;Es N$
jj@E 03@ 3@@0 hj@ 0jEh0 0
3jE@ 3@3 @@E0jEh
hhj00@@E
E0j @3E0@ j0h3hh
FG3@_^]
j hE@j0j0j0
0E0E3030j0
@3j0 @jhj @
333h0E
jh@0E3j3
0@E@E
NLLl|S
o1NA4+"
Yu<!lmE
N)4~Bq7
y1L^"+"
C"BVul3= <u`*
&NG3B"X
t[iZ1FG3B"
ZChV6^569
b J@u*.1#
q[ c7JA
|6J@"+)=?
NR&}7F\"+3(
=?%r` c7JA
B(e-bH
/3usKXM
C/kG/G
qaWk,)/A
H!WIltI
CE3 +2
w?Xsvr#A
wy04tnM_bi
CE0 *GX
f,3n!-
QHSgy>y
u+-2Mn
[Mrw7o$
eXKE3}
o;<5wi
8"[.?[)/[w+-8
nUeC-3 #22]
w4?e.3neEEl
y-XMo5%H
fnqJYM
~XM=KaXWvB
0tDXM:pgo,
@_='Xo
+Bhj0O-
"9e/3 )-0Ml
l>QH_a
pc%}tCXM}aS
+",blm[
rZFd.NT
},F][Hi6M
zRFa,H\
# @^ZB&=>
HC17jH].
A53&JV@3 33
30 3@ 3 h
h3Ej
3@hEhh3jj33 j3 @3@ hj
0hE hj
j @3 0
h h@j@ hj 3
h3 @ @EE@j3j0@EEhj
h@h 0E0jhE03WSSQ
Iu[[_[+S3EjjhhE@@h3 E00j@3j@30j@E
jEjh330@ 3j30j033
EjE 0 3 h3
3 j300h @0
00 3j
hhj00 E@
}}<?}$}
{}}{}Y5}}
x}|}.}}c*}
}.a}};}} }
static
delivery
button
Gendalf
EH#BM94
X+"B/c]
U44T(C
W "MD:YbY
(:Ia4?a*
GetKeyboardState
GetClassLongW
SetWindowTextW
PostMessageA
LoadIconA
SendMessageA
MessageBoxA
DefWindowProcA
RegisterClassExA
CreateWindowExA
LoadBitmapA
TranslateMessage
LoadCursorW
DispatchMessageA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
ReadFile
WriteFile
SetFilePointer
HeapReAlloc
CreateFileW
DeleteFileW
HeapFree
HeapCreate
GetModuleHandleA
GetProcessHeap
HeapAlloc
KERNEL32.dll
GetStockObject
GDI32.dll
[T[)GA6OH"\
ZDGBT($
BKc4K`+=GO)#]#
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
F;, {s
LB/#PD
;1TLxr
C9$!lc
F=_We]
-#<50-
kVPVOUOUNUOUOUNUOVOUOVOVOUOVOVP\U_XXQUOVP[UD@
I?qj.#
G<4(kb
xxxtttttt
ODj_j_[P
MCVK/!,
- - - - - - #
j_WLB6
. , - - ,
- / / / / / / %
PCbW`TI<
0!/ / . 3%
/ 1"1"1"1"1"1"0 4%K>REF91!6(K>PC>0/ / 9+M@THH:2#0!1"1"1"0!5'
1"1!1!1!1!1!1!4$2"+
3#4$0 +
3#3#3#3#3#2#7(!
4$F8F8F8F8F8F8>.@1A2B3B3A2A2B3B3B3A3A2B3B3B3B3A2A2A2A2A2@1H9!
L!This program cannot be run in DOS mode.
}&9H9H9H
;HBD8HjQ;Ho[
H9HcH[[.H9I
N8HRich9H
`.rdata
@.data
U_^]3[
VL|$ iGa+
|$ W~T
]_^]3[
D$ Vt$ W
t$$D$(3
5y7_^][
Q3SUl$
t$ VPSm
A;|_^][Y
QVWhHF
D$8L$0
T$HD$D\$<L$,WRPSQVT$0hQF
D$@L$h@
T$D4L$
<(gT$DD$,Rj
PVL$(hPF
T$8L$`B
T$<,L$
][_^L$
L$DD$8
L$,D$8
L$(D$8
T$HQRj
T$HQR1
T$@j=j
L$ D$8
T$(VRD$D
D$ j j
D$ RPz
L$ D$4
L$$D$4
L$(D$4
L$@D$4
_^]3[L$
L$ D$4
L$$D$4
L$(D$4
L$@D$4
L$,_^][d
L$(D$8
L$$D$8
L$DD$8
L$ D$8
T$@j=j
D$(j j
L$,PQm
D$(RPZ
L$@D$4
L$ D$4
L$$D$4
L$(D$4$
_^]3[L$
L$@D$4
L$ D$4
L$$D$4
L$(D$4
L$,_^][d
D$ PD$
D$(N@L$,V<T$4F$D$0N(L$ FD
V,F0D$
u#N@F8QN
3|$!\$ V8N@fQRD$(htSF
3ISQL$(Q
PT$ QRD$,hdSF
SV3W9^D
^H_^3d
S\$4VW
d$ hSF
d$(hSF
D$HT$LSL$ PQRD$P
T$ fD$$3N
PD<$PR
u,D$<t\P
3~I\$<N
F0F4u2j
F4F8u;j
PD$$T$
t$$t$
QSUVWD$@33;D$
t$0SD$
t$0SL$
VQUaD$$
D$0t$,3
PU5t$0
T$<PD$
d$LPD$<
d$`RD$@
PD$$T$
D$$t$
3|$a\$`f3\$
fD$)D$
uH;~8Vt$ `F
PWNhTZF
fArpfZwj
QSUVh^F
D$$RPS
PVL$$T$lQRD$,P
\$<\$@T$D
\$LD$P^F
D$HD$,P
SST$\SR
t*=d%E
L$XQSST$`SR
QSUVWt$
L$$T$(N4RD$
D$,L$0?U
R trhP
|$$;D$
F0F4u2j
F4F8u;j
PSR8D$
_^]3[d
SU-D&E
PL$(SQRn
D$ _^][
VS_^][
QSVWt$
D$ L$$3hP
|$ ;D$
|$4T$0@
|$uD$(T$tfT$
T$$RT$$=D#E
3|$0D$
D$lD$pD$th
D$0RPj
T$0QL$0Rj
PQD$d(_F
;yuNU(
L$0PQj
_^]3[h
QSV3W98
QSRVD$$
S\$$UV
d$ hSF
d$(hSF
D$<SL$DPQUD$D
pD$03~ N
D$0;|t
JlBp;t691t
QSUVWt$
L$$T$(N4RD$
SQP(hP
|$$;D$
SVWF(u
ST$ QRD$$
S\$0UVW
d$ hSF
d$(hSF
D$HSL$PPQUD$P ~8V$3
QSW@SS
PD<DPR
~8N$\$$\$ D$$
PSWBSS
D$<3;~ N$+SP
D$<;|;t
L$(_^]d
|$ wv$(c@
|$0|$4Bhh
t*D$(L$$PQQT$
3|$<T$$
T$(D$$L$<T$,PQRRRRRRT$PRT$4D$`D
;sPL$$4V
T$$QR$
;sPL$$4V
T$$QR$
L$44V`
SUVW\$,D$+3
3|$4D$
3;t4L$
T$8t$$L$,RV
SUVL$$W3
3|$0\$,D$
\$ \$$@
3|$,+T$,T$0
S\$$UVWS
d$ hSF
d$(hSF
D$<SL$DPQUD$D"
RT<8RP
pD$03~ N$+j
D$0;|t
;uv l$$T$(RV
HD$$ut$
;t$D$ D$ VPa
;L$ u{
;t(D$ D$ WP
;L$ uL$
t$ +l$$;t$D$ WP
;T$ uL$
T$ L$$
|$(t9+
L$$|$(
l$(t t
+;t4L$$t
L$ ;ut$
tWHu]D$
SUVWL$
;|$(tC3t$
S\$$UVW
d$ hSF
d$(hSF
D$<SL$DPQUD$Dl
RT<8RP
pD$03~ N$+j
D$0;|t
D$ ~(F$~,~0L$ ~8N4~<~@
D$ PD$
WWhD_F
~8~<~@F(PD$
~(~,~0D$
QSUVW333C(;t~K,+
;sdK(L1
C(,0G4{3C8;t:K<+
k,S(;t
4;uK,S,S<L$
;uS<_^K<]T$
QSUVWT
8SUVWl$
93to4;u
m,C4;t
4;ut$LD$
L$LH,jD$
m,C4;t
4;ut$LD$
d$ P$P
SUVW3h_F
L$0\$(3w
D$,j^SL$
T$,j^j
SRV\$,
L$,D$$
L$,D$$
L$,D$$R
_^]3[d
SVWhHF
j^D$,SL$
j^T$,j
D$ SRP
SUVWL$T3h_F
UD$DUL$dPT$,QRT$0D$lUL$<PQUU3URt$H
D$ ;tG
T$@L$\fB
PQL$(T$@j
D$$;t?
@|$eD$H3D$d
3fVVVL$TVT$tD$,QRUP
PT$TQR
L$(Qh?
uTVL$<VT$DQD$PRPD$<L$`VT$DQRVVVPt$\t$|t$tt$lt$h
S\$$UVW
d$ hSF
d$(hSF
D$<SL$DPQUD$D
RT<8RP
pD$03~ N$+j
D$0;|t
D$$3hP
FH^$^(P
|$$;D$
QSVWC(u
C(tC0P!
s<3tF3
|C<UPJ
t'K0t$
{D_^3[Y
S\$$UVWS>
d$ hSF
d$(hSF
D$<SL$DPQUD$D
RT<8RP
D$03~ N$+j
D$0;|t
|$\3;uCD$`t$
|$ L$$T$
L$(\$T
T$<D$8
++PQL$DD$\
T$ t$<+
#SSPQL$@RSSQ
L$(\$T
L$8D$T
L$(\$Tr
L$8D$T}
L$L_^][d
SUVWt$ 3
|$(L$$h
QM`D$,
\$ \$$\$(
;tQP+%
FL;rSf$
pSUV3WU
SWUUV$
T$PPUUR
3|$dfD$Z|$PfD$n
fD$4BMD$t
T$6L$6T$:T$>D$>6
D$pD$4P
Uj(L$xj
L$HT$`,D$Xj
PD$(P~
L$ D$x
SUVWhHF
N4PQT$
D$$RP]
L$ D$,
F$F<F,D$,
L$$_^]3[d
+SU33V
3|$$D$ h
SUVWL$
;|$(tC3t$
S\$$UVW
d$ hSF
d$(hSF
D$<SL$DPQUD$D\
RT<8RP
pD$03~ N$+j
D$0;|t
D$`3|$ah
fL$dD$ D
RPD$P(_F
D$ PD$
M0jxQQ
U0jyR3
E0Hduehp
AdU0Jd
3|$(D$$
+T$8hP
RHdT$<Qj
t$ D$,N0
V0ONZd$s
4;uD$$PW
T$$RV>
t$$;uIVV
;uU4;t
t$$;uC
4D$ H0
3|$\T$Xh
t SWQT$
SUVWhHF
T$ RK
L$ hDkF
D$@P5#
L$DhHF
L$,3\$4D$8D$<D$@xF
RPD$<QPn#
L$DT$4jdQR
D$DL$ P|d
d$ hSF
d$(hSF
D$@L$<PT$ QRWD$D]mT$, 3v^K
;ru93L$
SSSSPQ
d$(R}^
44;u_^[
VWPjft$
Nh~l~p~t
^l^p^tD$
D$$3|$%3fL$$
D$ PL$
SWVL$
SV3WSe
3|$ T$,
L$ Q=[C(K
EpMhRj
3|$ T$,
L$ QZs(K
3|$ T$,
L$ Q1Zs(K
3|$ T$,
L$ QYs(K
3|$ T$,
L$ QKYs(K
3|$ T$${(L$(QRVD$(
|$ uD$ G0D$$G4L$(O8T$ R
3T$,+h
L$ Q|Xt$
3|$ T$,
L$ Q+Xs(K
3|$ T$,
F(t]N,+
;sCV(D$
tTmdS0E(L
d$(P9M
REuP=P
3Flt)Np+
SUVWl$ |$
\$ D$$
PD$(QI
HtBHt!Hu(F
luQVt$ VhkF
SUVW3hHF
3|$-\$,f@
;v%Pj@
>T$(-$ E
D$ RPL$$SQSWSD$D
\$8\$<
s0L$ ;v(
w T$(D$ R$4
PT$$QD$8RPWS;t
L$,QL$
SUVWhHF
L$ RR@
D$ RPC?
T$(3T$,D$<T$0T$
RL$X\$4\$HD$T
|$8t$$3t
|$8t$$3t
T$$D$(
L$$T$(
;uD$ UPSh
SVWhHF
T$ QR7
L$(RL$0h
D$$ucL$
VWD$dhp[F
L$dhlF
D$$L$"T$ %
QL$"RT$$%
D$$L$"T$ %
PD$"QL$"
D$$L$"T$ %
QL$"RT$$%
L$4t$,
;u`QQP
t$4L$8QV
L$<D$<(
|$`+hHF
j(PVD$ (
L$ V$t
D$<PSe
j\L$ $
L$|D$$H,E
D$|D,E
L$0SQL$4
T$$@,E
D$$hlF
L$$PQ-
T$$PR2-
D$x;t!PC
SL$0^"
SSSSL$ *
T$$L$|L$ B
D$|D,E
jL$$D$|D$ Q
WWD$4U
|$,|$$|$8
QD$$RPL$Hj$Qj
RL$$PQWUj
j0Vl$H
t0D$8PWVj
tNT$4Rh
+T$`$d
@$;D$$
SUVWh?
tkD$(UVh
VS^]L$(W!
VW^[L$
SVW3eu}0
y4t9L$
QSUVW|$
QSUVt$
C 8tIK0
ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppC
C : \ U s e r s \ J o y c e \ A p p D a t a \ L o c a l \ T e m p \ R a r $ E X 0 0 . 9 8 1 \ p a y m e n t - h i s t o r y - n 9 9 9 8 7 6 5 - 3 4 5 4 3 - 4 3 4 5 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ G i c g s u M e N . e x e
C : \ 4 6 6 9 f 9 1 b 4 4 f f 9 9 e 0 2 0 f 8 3 5 1 b 9 5 1 c 6 1 8 b f b 1 9 4 3 5 0 c 1 4 0 c e b 4 e a 2 6 3 2 9 5 9 b 6 e a 5 3 6
C : \ z o 9 7 t M H Z . e x e
C : \ V Y O a T 1 O 7 . e x e
C : \ g K W E e 5 l S . e x e
C : \ a w A B L b V u . e x e
C : \ M n r O 7 w t E . e x e
C : \ i T 9 Q c 4 p F . e x e
C : \ J A 9 5 P F o n . e x e
C : \ t t k Y O i D U . e x e
C : \ Q W 5 A M O 8 j . e x e
C : \ g o h F 9 b 2 1 . e x e
C : \ V W K S E 4 m 2 . e x e
C : \ q h B i s k 1 j . e x e
C : \ 7 1 X f Y G C _ . e x e
C : \ _ _ n G O 8 m m . e x e
C : \ I _ k K _ B c V . e x e
C : \ t m T b Y k q y . e x e
C : \ w O 5 A Y 5 U W . e x e
C : \ T O I q W f B 7 . e x e
C : \ K v f 0 Q 9 6 m . e x e
C : \ 4 6 x i n 7 C G . e x e
C : \ i u p k b _ Z o . e x e
C : \ 0 N u y s q y r . e x e
C : \ p e w g s c v C . e x e
C : \ a 3 6 1 c 8 7 6 3 b e 3 4 4 7 f 0 3 a 1 b 7 0 b f 4 c d f 6 9 3 e 0 6 e 3 7 8 1 f e e 9 4 7 e 1 1 d 4 a 3 8 f 6 f 5 1 a 5 6 e 3
C : \ c 7 3 7 8 e 8 5 a 7 0 6 6 d 7 4 e a f 4 4 5 a 1 1 7 d 3 0 c c 9 6 0 4 6 3 e 1 2 b 0 7 7 7 6 2 5 8 a 0 d 7 9 a 7 2 b d 1 5 1 f b
C : \ H _ n Z z H o 0 . e x e
C : \ b 5 0 T n q R J . e x e
C : \ I q q F S R d 0 . e x e
C : \ 7 0 o G J x I x . e x e
C : \ L q k 5 B x s O . e x e
C : \ i Q J 5 D M 7 e . e x e
C : \ I 7 H l i R 0 t . e x e
C : \ N 1 2 j t w n _ . e x e
C : \ z 2 g D G G W S . e x e
C : \ U x t f b E o I . e x e
C : \ G l T G B k D V . e x e
C : \ Z R V O O D x D . e x e
C : \ T F 7 z c 6 X u . e x e
C : \ T U W b I 0 p 5 . e x e
C : \ o p G r I a u W . e x e
C : \ S g H D f y x l . e x e
C : \ t Z x Y 3 R I Z . e x e
C : \ u r I 4 o N c N . e x e
C : \ g o v a 7 o l f . e x e
C : \ d 5 O 2 e N 5 l . e x e
C : \ u d W V V 5 q z . e x e
C : \ v H t Z x N q w . e x e
C : \ w 9 y R e X 5 e . e x e
C : \ O I O b a l i V . e x e
C : \ Y H z Z 7 f v X . e x e
C : \ b v G p o z 0 f . e x e
C : \ 7 q 8 O q 2 s a . e x e
C : \ _ u c 3 z 1 G L . e x e
C : \ p 9 B V M f y T . e x e
C : \ s B k F S o f M . e x e
C : \ U p e f u g U U . e x e
C : \ A F e h 1 6 0 s . e x e
C : \ c 5 K U B M t z . e x e
C : \ 0 O W x y i c D . e x e
C : \ U 7 P v W y 1 _ . e x e
C : \ x 7 X v L D 9 m . e x e
C : \ n r P 7 A g 1 x . e x e
C : \ C X D I z n k W . e x e
C : \ 9 C y k w 1 k R . e x e
C : \ 3 d e 4 1 c d a c e 5 4 a 3 9 6 3 0 5 5 1 c 5 3 d b a 1 e 7 8 e e e 4 d 5 b 7 4 7 1 a 2 2 2 6 5 a 7 3 7 3 e 3 7 2 c 8 d 8 7 9 0
C : \ P U l V p x d 5 . e x e
C : \ w O w b F l P r . e x e
C : \ k d 4 o l W E J . e x e
C : \ d f u o 9 k P F . e x e
C : \ t A L 7 6 e 6 x . e x e
C : \ 9 4 V V O Y 1 l . e x e
C : \ P k K 3 b X s k . e x e
C : \ v 2 Y S D 5 A n . e x e
C : \ i 6 _ I e 8 x 3 . e x e
C : \ W 5 f A S f H W . e x e
C : \ r y h D k F p H . e x e
C : \ 1 c F c R _ 5 b . e x e
C : \ 4 4 z h T o 3 j . e x e
C : \ o E 2 m D L K M . e x e
C : \ P g 0 e B Y H A . e x e
C : \ z J N a h A u _ . e x e
C : \ w i 8 E W D K 0 . e x e
C : \ a v q E Y t U E . e x e
C : \ a m B b Q R l A . e x e
C : \ y h 5 H 7 T t 5 . e x e
C : \ T L c g h w 1 5 . e x e
C : \ e r S 2 m u G b . e x e
C : \ Q z u V e T O E . e x e
C : \ L s s s l D k w . e x e
C : \ G X f u 4 i D n . e x e
C : \ B H _ 9 a u J c . e x e
C : \ H r v m J e D l . e x e
C : \ O 6 J t M 5 2 R . e x e
C : \ 4 1 f b d d c 1 a 1 4 3 5 7 9 c f 9 3 d 7 d 7 1 2 c 4 6 a 3 f b c f f 2 e 2 8 0 2 8 2 1 d f c 2 e 8 4 d 1 f 6 a 1 4 a 5 f b 3 a
C : \ 0 7 2 c c 8 e c 0 1 a e f a f f 1 3 3 e d 1 6 b 6 b 1 7 4 7 7 2 5 e 2 3 4 5 5 4 3 f a d 4 0 3 6 8 0 8 a 2 8 4 f f f 2 6 3 3 3 d
j j j j j j j
C : \ a 7 c 4 8 4 1 b 0 1 3 6 8 d 3 8 4 b 6 c c d f 8 c c 3 e 3 9 5 e 4 e 8 2 2 0 7 0 a 6 3 3 b f 0 b 5 3 0 a 3 b 6 3 3 d b 5 c a c 8
C : \ 0 6 6 8 8 e 1 8 b d 4 7 7 6 3 4 e 0 2 6 a 1 3 8 9 5 7 7 f 7 c b 2 e 3 b 3 5 4 3 1 c d 1 8 4 a 1 a c 2 6 a 7 a c 0 c 6 6 e c 0 3
C : \ e c 1 c b c a d 5 4 9 3 1 5 4 a a 4 5 d 5 8 c a 8 a d 4 e 4 f a b c d 1 9 1 7 7 b f 7 4 2 3 0 4 a 7 0 b b c 5 f 0 f 9 c 8 8 8 1
C : \ e W f U l C s E . e x e
c : \ 2 5 x m v k \ q i 3 g k s . e x e
C : \ 9 d e 3 b 4 4 2 b 0 8 7 f b 1 b e 1 d e 8 2 4 0 b c 1 4 4 c 6 e 1 8 0 4 8 b 3 b 0 7 2 9 c c 1 5 4 8 0 5 2 8 5 2 9 4 b 4 0 b 9 c
c : \ l v y j a k \ j k v 6 p 5 . e x e
C : \ K 3 f G 7 o j O . e x e
C : \ X M D P h t J _ . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u r o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 9 c a 9 c a 4 b f d 1 f 7 1 d 6 a 1 5 2 f b 3 b 5 e d 1 b f d 5 c 3 8 4 9 c 0 7 f 9 a 3 0 c 0 5 d 9 d b 0 1 7 c 7 3 d 2 f 3 1 . e x e
C : \ 7 3 4 2 c 1 c 0 4 8 4 3 9 4 7 c c 7 2 7 3 4 3 7 c d a e 6 d 4 f 8 3 6 7 c 6 a f e c 5 d 6 9 d f c c d 6 f 6 a 1 2 1 c b 2 5 f 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u r o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 c b e 9 3 4 f 0 0 5 2 4 4 f a 4 d 8 2 0 5 6 5 9 5 5 4 1 9 9 9 7 e 7 0 e 9 a 3 0 6 f 5 9 5 a c b f 2 6 7 b 9 1 a 4 6 7 7 9 6 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u r o . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 5 1 1 3 b d c 9 3 2 b 9 9 4 2 _ h u r o . e x e
C : \ 7 3 f b a 5 5 b 7 8 6 5 a 9 0 5 2 5 d 9 5 1 2 a d 4 f 1 3 3 2 7 9 a 9 5 0 f 2 6 c d 4 d 7 1 6 f 1 b 6 3 f 3 c f 7 c 3 7 a 7 2 8
C : \ 8 2 6 7 a 9 7 e 1 3 0 3 4 9 4 c 3 7 a 8 5 9 8 4 a 4 e 9 d 2 d 2 9 c 2 f 9 6 5 7 b 5 4 a d 3 0 f 5 6 1 c 4 5 8 e a 3 5 7 4 a b e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u r o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 6 1 d 3 1 e 0 1 6 4 a d a 0 a e e 8 b a 1 d a 5 5 8 b d 7 3 a 4 a 3 b c 0 9 9 5 f 9 6 d 4 9 1 7 f 9 e 7 a 5 4 b 3 5 9 5 f 6 e . e x e
C : \ 2 c e 4 2 2 6 b f 5 4 6 7 6 6 a 8 c 3 3 2 0 6 6 5 4 4 2 c 4 f 7 a 5 8 2 5 d e b 4 f d 4 d 3 b d c 9 d c 6 0 c c 9 8 2 2 7 d d 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u r o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 4 6 c 5 2 5 e b b 5 e 0 0 0 f 2 2 7 2 6 2 1 6 d 4 b c d 1 8 7 d 3 7 3 6 5 6 2 5 f c a 2 3 8 1 3 1 7 b 2 9 1 d 0 0 6 7 f 1 5 0 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 b 9 b 9 b 9 7 1 8 d 4 7 c e 2 0 b d 0 f b 9 8 1 1 8 2 f d 8 2 e 0 4 5 5 a 2 4 d 9 c 8 8 a 8 2 1 7 2 2 8 a 4 9 e a 6 a 2 b 4 6 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 2 2 2 5 9 5 3 b c e c 2 c 3 4 9 1 e 4 6 5 c 0 5 6 8 2 a 7 9 1 2 c a 2 1 0 8 1 d c 0 2 5 1 0 c 2 b 8 4 4 3 1 3 7 5 2 2 b 8 2 d . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 9 b a 9 c 1 a b 7 a 3 6 3 3 8 e 8 5 1 5 d 1 a 7 8 d 4 b 0 7 b e d c 6 d a 7 0 b f 1 1 6 e 8 d b 9 0 f 9 1 b a 7 5 0 8 c b 2 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 2 5 9 b a 5 6 6 9 2 5 a 7 b f 4 8 3 b b 7 b 7 3 a 7 c 5 e 3 0 5 4 d 3 1 0 9 2 3 2 2 a a c b 2 7 f f 6 2 c 8 0 9 1 9 a 4 e f 8 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 5 7 c b 4 7 f c 1 5 c 2 0 6 4 5 2 f 2 e 4 7 e 3 1 b 7 7 8 2 c 8 9 a 1 b d 7 6 c 0 8 5 9 9 e 2 1 e d 8 0 e 7 9 5 3 7 0 e e 3 9 . e x e
C : \ 3 1 3 4 5 6 a 0 f 6 3 f a 6 d 3 2 f e 6 3 6 3 d c 0 f 9 f 1 6 e e 1 7 b c 4 a 9 1 4 8 e 6 2 1 b b f a 3 9 b 2 e 9 4 3 3 2 9 d b
C : \ a a 6 1 2 d d f a 7 4 c 1 a a 9 8 3 3 4 5 a 4 3 6 a 1 d 4 4 e 5 b 3 a c 1 1 4 d f 0 b c 5 7 d 9 b b 9 6 e 9 a 7 f f 4 6 b d 7 8
C : \ 8 3 1 3 a 5 8 1 c 9 f b 9 5 d 0 b e 4 1 0 b 3 7 0 3 1 4 1 2 e a 7 f 9 4 9 2 9 c 4 0 c 4 c 6 b 3 e 0 5 2 7 9 d 3 1 1 4 e b 3 e 0
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.