1.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.79
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
动态指标
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Program Files (x86)\e8fdc9c8\jusched.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Program Files (x86)\e8fdc9c8\jusched.exe |
搜索运行中的进程，可能用于识别沙箱规避、代码注入或内存转储的进程
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545337.249875 Process32NextW |
snapshot_handle:
0x0000003c
process_name: jusched.exe process_identifier: 628 |
success | 1 | 0 |
重复搜索未找到的进程，您可能希望在分析期间运行一个网络浏览器
(50 out of 100 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
操作本地防火墙的策略和设置
(1 个事件)
| registry | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 209.202.252.54:21 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2011-03-03 03:56:19
PE Imphash
fe9b94dd0e4ea2a905fbd4f42f4b2f8f
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000049c6 | 0x00004a00 | 6.327950212661485 |
| .rdata | 0x00006000 | 0x000007a8 | 0x00000800 | 5.571708494368706 |
| .data | 0x00007000 | 0x0000e000 | 0x00000a00 | 2.3341854176937415 |
| .rsrc | 0x00015000 | 0x0000265c | 0x00002800 | 3.2227979577665775 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000150a0 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00017648 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.dll:
• 0x407790 Sleep
• 0x407794 GetModuleHandleA
• 0x407798 GetLastError
• 0x40779c GetLocaleInfoA
• 0x4077a0 GetStartupInfoA
• 0x4077a4 ExitProcess
• 0x4077a8 RtlUnwind
• 0x4077ac HeapCreate
• 0x4077b0 HeapDestroy
• 0x4077b4 HeapAlloc
• 0x4077b8 HeapReAlloc
• 0x4077bc HeapFree
• 0x4077c0 HeapSize
• 0x4077c4 HeapValidate
• 0x4077c8 GetSystemTimeAsFileTime
• 0x4077cc GetFileType
• 0x4077d0 GetStdHandle
• 0x4077d4 GetCurrentProcess
• 0x4077d8 DuplicateHandle
• 0x4077dc SetHandleCount
• 0x4077e0 GetCommandLineA
• 0x4077e4 GetModuleFileNameA
• 0x4077e8 GetEnvironmentStrings
• 0x4077ec FreeEnvironmentStringsA
• 0x4077f0 UnhandledExceptionFilter
• 0x4077f4 SetConsoleCtrlHandler
• 0x4077f8 VirtualAlloc
• 0x4077fc VirtualQuery
L!This program cannot be run in DOS mode.
.rdata
@.data
9|F9|E
u;54NA
U,SVWE
EE;E~8NA
UEf:MZt
EP;EP@NA
PlP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EPwEP@NA
EPREP@NA
EP-EP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EPeEP@NA
EP@EP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EPbEP@NA
EP=EP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EP_EP@NA
EP:EP@NA
BuXhDc@
BuXhBc@
U8SVW]
EPeEPW
EPEEPW
U<SVW]
EP(EPV
EP7EPV
U<SVW]
EPhEPV
U4SVW]
EP(EPV
4Pv4PW
4PP4PW
4P*4PW
lP4PV4P
BuX4PlP
lP4Pr1
fPdfPV
fP>fPV
E0F0EE
BuXEPP
P\Ppj#
P5PIj#
BuXPj#
SV1W8NA
BuXhNA
PEPEPEPh
BuX_^]
t<;t"SP
.P$h`@
BuXh@`@
BuXhNA
BuXh6`@
BuXh,`@
2f4qBft
f9tf9u
BCNu1^[
Pr=lr@
Ujh@e@
PSVWeh
YM_^[Md
PX1tPQ1
VC20XC00U
11111]^
USVWUj
t9|$$t
;t$$v,4v
UXSVWh
9rG95OA
URPVEP
?"u.G+t
GE?\tE
YEPEPE
u@E>=t
u@E>=t
|9]s#SY
OQJ9<\s@
u%}M<\s@
JMWzUzUW
WBP9<\s@
|^J9u8]
| ZKYM9
/Downs/HelpVer.hlp
/Downs/Help.hlp
Help.hlp
/Private/
Pfile.hlp
\VirtualDevice.vxd
ProgramFiles
?>D85<9>EH
6D@]DB9@?4]3?=
gdaheb
eedeia
7B9@D?<?:9]8?CD\54]>5D
gdaheb123
5<571>0ghfddd
5<571>0ghfddd]5<]6E>@93]?B7
B57549D]5H5
!B?7B1=v9<5C
$?6DG1B5]aaaaaaaaaaaaaaaaa]sEBB5>D'5BC9?>]#E>
e.gteeixrde
JUthnaac,uvdSdSapee
JUthnaac.uvdSdSapee
JUthnaac_uvdSdSapee
JUthnaac-uvdSdSapee
JUthnaacuvdSdSapee
\Java\jre-
gFsomeralPri
\RLN06530
\RLN06527
\RLT6990
\RLT6989
\RLT6988
\RLT6987
DtlgeaAelVeReeu
CtygaeAeeKxRreE
oePari.recFtutMSrtiipSnsaldzLereiati.eeecllYt.rlPeinvsrnhoCtdryeiSrSaPrdstisedonu.As..cTohmooAtCc.warsrSc.SAaElaelfp
bd:ael*nE::
leeexthEuSlcA
l.e2lh3lsld
PipFAtteFul
etsnteoaennlHlIrCed
GipFAtteFel
etnAtentnnocIrCe
etnteennpIrOA
i.ntlielwnd
CegsyeoeRlK
SaEgVeetuARelx
OKxgnEeeyRpeA
a2lv3ldidap.
broFlleGae
bloAclloGal
FSteeelzGii
dealeiRF
tliirFWee
aieFAreeCtl
snoaelHlCed
c3xosersNPe2t
c3rosirsFtPe2s
CerstrPedertcIGunos
aoe2pteTh3aorelpnhCtolSs
LcrSntiDeiAeglvrsGoaitg
DeetvpeiyGrTA
eilFAeeeDtl
oitAmDcyeeerRvro
dsnoilFCe
dtenxlieiFNFA
dslnriiiFAFFte
VmfantunmoelIriGoeotA
WoitAtdDcyenserGiwro
yeploiCFA
EreabtimVaAevntieGnonrl
MllmtuiaedFNAGoeee
aitAeDcyreerCtro
FAieterteltuASitbs
erebyrirFLa
drAabyoirLLa
MlnAtuaeedHlGoed
PAetcreodsGrds
n2lr3leldke.
0123456789abcdefghijklmnopqrstuvwxyz
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_abcdefghijklmnopqrstuvwxyz{|}~aa1vd2apeJUt
JUth1naac2uvdSdSapee
GetModuleHandleA
GetLastError
GetLocaleInfoA
KERNEL32.dll
GetStartupInfoA
ExitProcess
RtlUnwind
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
HeapValidate
GetSystemTimeAsFileTime
GetFileType
GetStdHandle
GetCurrentProcess
DuplicateHandle
SetHandleCount
GetCommandLineA
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetConsoleCtrlHandler
VirtualAlloc
VirtualQuery
-kkeJ/
.nnnnnnnS8
/qqqqqqqqqqq\@$
ICONMD5.94c1157c
tttttttttttttttfI3
wwwwwwwwwwwwwwwwwwwpS<
zzzzzzzzzzzzzzzzzzzzzzzz\E&
}}}}}}}}}}}}}}}}}}}}}}}}}}M
H((w6f,
I33lFfZ
KUUmfh
]WWn6f
6134<>j7>9;<DFr?FACDLNzGNIKLTVOVQST\^W^Y[\df_facdln6134<>j7>9;<DFr?FACDLNzGNIKLTVOVQST\^W^Y[\df_facdln5d2<efk<=l:DmnsDEtBLuv{LM|JT}~TUR\\]Zddebl31f8i7ih;9n@q?qpCAvHyGyxKI~POSQXW[Y`_ca19:6f5ki9AB>n=sqAIJFvE{yIQRN~MQYZVUYab^]a19:6f5ki9AB>n=sqAIJFvE{yIQRN~MQYZVUYab^]a61c7jfj;>9k?rnrCFAsGzvzKNI{O~SVQW[^Y_cfagf1478j68n9<?@r>@vADGHzFH~ILOPNPQTWXVXY\_`^`adghfhilopnpqtwxvxy|
61c7jfj;>9k?rnrCFAsGzvzKNI{O~SVQW[^Y_cfag9d3h:<7kAl;pBD?sItCxJLG{Q|KRTOYSZ\Wa[bd_icjlgq895ef:k:@A=mnBsBHIEuvJ{JPQM}~RRXYUZZ`a]bbhiejjadf9h77lilnAp??tqtvIxGG|y|~QOOYWWa__iggqooyww
7d6d5g9l?l>l=oAtGtFtEwI|O|N|M
QWVUY_^]agfei8d48h6g8@l<@p>o@HtDHxFwHP|LPN
PXTXVX`\`^`hdhfh15c4jj:89=k<rrB@AEsDzzJHIM{LRPQUTZXY]\b`a
!9@jX)/k
4uvG vYid
+rI{%HjAF1`
y)e,m*
wYiO9c[%
$+^>VFGCR#X+{'BgR4^ec
qjDzMpQ2@
IS4O8A
n@/Tp
Peiq&ym
-Soyv?0
h1G*C3dQ
3-WeotX2IXJ
aqGBLV #:*
pD%]W\Zln
kU]ka:Z
U{BC{[!{;
Gb->Aw:
k!U6IAPp
^Ya+h@&;N0E[
-DX\/r?
1AQ"2a
4%5csT&6DEt
A"2Qaq
#B34Rr$bs
GKVw(VwC)J
C2ULP(u
Uy::/P0_
2Q:Ph/Q
>G.Qax
J(s?@AQ
J ]5QdQ$A
RUfC?"?Qz
3?Cu^g(u
g(WJ*f
RUPVwC2+CCg
Qp0000L%p000
0fTeYQP1
iY7o./
L_,*W,#
JrMUOW
ni9A-U>#mtrY
7k^<r\*jj
N&8xN!{eb
T\&UPYP^T
A,UEAyB
VP7TSZ`
BTXs1zO
#*8< y~
3hc*Dj<`7u@s3D
yXsdNLe|kwj
HxL;]fU6
BVf1gj^mYe
'/\{Cc
,RUl*pK;U{_c
,0MvWe
xj{9R-
I2wVEdBX5#^
/*,5PyPK(a2/*Y
*@vAvE]X
AvD]TY
5EhktU
TXsq#<
}[}aCq^</O
tB\<Bn3
ILqsu8mq
z|pW'KO\C5
zZtiz`b
!:v)*[A
IUW=\E
PKNj}:b59
ZGw8{ }. Q
YR-VeOeYz
2&tBLUY
D2 L""dE
.Z#nLH
2,Ef]"KnF2&
ii-EmY+|w
CN"7o pYtAtnR
:{DjR,?
pDW{_pEkcE.GC"`
E%F5QZ4U
B!YP6('EU(r
+""dAY
vdUeAYPXb
F\:4)!
|N'eN'dO
i<4Gx[s>
&TUeC)
qP"ZxxhW
t/'cFS
GAQ`SZY
0bPRKs
\OHfD^:
-s,nq 2N
Zw3[iv1|
QVS6_C3
U6R}L]",-93I
)2M6//&3j}xoo2Upt
CkyoF%
KQ\Ny0,uT
w_9s=J
CX%}__Y
~]V^{Ra
N-X^/i
G)p}DD2zYw;)
19\q Vv
[;O0^W
3/On BXx5mv
d`u8_^fyu3
(heB~9;
G/az`;]a
D@.Eb0S
ir8jPO[S?<
~[[Ib)c
-lUgI_!
W.v^gv
W[6<7}'Kx+
a|XnX.)bd
l}^6i]$\oloW%aD
:;Dy{a
AVa{&N)bd
&N)bd\
/WzH)Y
ze0|^,B+8e`
/(@*9S
z46./"
G"V^}M<%T
$lD1nkko
ry2~)'eWKoA7
)X[Kof
,~+5 *
E<[C1 >s
O$hTY:{7\hx
V^=zf F
K~w^I^k[/
!M;yZ^Kx|by
cm/OO4N
f;W;DA
n1-Ypj|
u<:8L{^.
"G`@0Zz
#?\y ~T
KWXx5{ZrK"
g>x)oFZ
'9p}E "
&((eEr@
ivuX#|K*'+J-}Wy
OWJ/hO"O
<So=cM
yA!$28"f
iv$WKoW
WK?_)Y?
2gJix9b~}
~Erm)sD
Z/U0VJ
L?YhSR}
;AVfsob
h?Z{9K
jf L=T_.
Ix*tp[JeM
W1,9N.0
:F{zIx
?C"h "
x"K__-]
""T l9\vb\W1Fb4N
s)_^HEFe
W5yaH<
;:X-9B5!+"_
r(yp`U
LrtIy54-Jq._
G8oJDG
z7pZ:>oJ
:_?Z5n
k!L >e
Z>Vu>mzIz>WH
Bf~KZ4
z).U3VH57
Vr0A@X]*+1
kB3+pD,k.&
+:WW_6c):Yyo9_{kV
S8URz>qV
-XtMp!Gp^|mG* P
VA,U&L
m;>~Gq)<%W+}0cG xo^6~kmy
u!<D~j{qKC
Dm1Z:[
rK A{ I{c
YZ{Ej#
\-k^k^BY
vTazHm
J 5Xucgn+:n%GP
i],k"Qb
9usWT6,
4U%z(F*
GvN1LkzWho
%=JbAeY
+~?5Moq
O`/Wq>vYUrD
=wS~fJGq
}r.z{V~
Gyy;xaNUA
!,ELdmdfdd
X?4wTAFi
}<z@VIz4Kd"K(Zs
-Te|A=
e8(k\}X\W}g
gNiX ,n
SOWl:&
o~BdM<;<
*r$ywG
o-_|~^}
M3/9j>E|x@\1
n0G]ZkG5f
!p}4@/1wbJ
[Xs7jNh{M
in?LeyrT
a z*{{OMW4
z-<kg/=K-
3</'<G
z_*/}G?
~/MJF;YDD
^d}c9r B}t
[O,V`L>KZrN)
LBQ!Bv>
:]YM7ouB4
,md`8M
p`[yr L"
'izN^(~S
0;'>%tUJ
mOGs^*O
{YULqfprc_
K*/*"eAYQP
/\w>} K
gzK53K7v
W=/=aAH"
O`qSRl4<s |U} ,5pcFg
QG~KF *9un!B
Z27y&W~
">Tx*>
/E{>6z
[wgW}7z=Gdh *eTB
n.'RH/
9Hf0[&'t&
"Xb @l)#>%
O/ jOWp
s%NFJr(U
^J]<~#`
X-Fe7X
1HSJ7.
%'/KWW<EVUL"
Edh/@uUH/
,0bnpT?M}v
=wmoz_}>
_GBtb^:
fyi5c$
}j~vU-d
GoWs~#
/Y?&FU
ehv*[C
ajPm_L2>G7
Dt[y0z>
<8"Q%N
B ;d=<
X~+V'/>?p
(rqr#Ao4y[zuRVdvZ_S/]gr{
3/M!z>
Po@]/a1
g?6^=j_
FUr?_v3[o{
g7*J=Yt
Tykh`#NY{tW
%ylt)e
I1C[<WW99
R%9V%*
0"88u?|
Vau"jgi{
u[.O%_
W\}xN} 4[Z
Kmems+3*/
~AcUkG
tM;+wJ/E4^,
GL#WqW#
}NSq6q
Vr\2An
D<ZSY^
%;5-KzGy|
ho]x#vcS
8w +mY
3N:8OV
oS_ *1
%|OPGj,g
II:9M<Mi+:1)q~q
}.Q3e||hGF_
l?i>SS=\[~+ja
);:Cf>+4
$&Q`5 9>5f{o2
^1_GQ4`[a -
p F,-O9{<8q7+
~95ZM}
:=5~y9if,:-su
DL4RWQg|]C]a-
mYt[Do9k
.3.6&Q+
<>F)lRj^A
gRo-kHcXzQ
DGofO7J=
!zg*YE)
oOGs^*Q
}Ax7/f7
5[5t^.
~<.1cFQ
{ZlB]\
ZsdcS
;klhe+
ex^XiMHU
1z>&fS^
YR@>.z{;m
#"qO3^Z
j_C5Ov%D
fa-!UFp
/ Vx1G
|{^m9L2
#5V%WO
"QKr!NUf
%w/G Wpmr
PuufCUG
\<WIb^M+oO
yod"D,,Gcn!V
qs^{mc_[m
}=a^yht5O
cr]NUb"Y
WB}_/[+
]0{^sn
gW j&^j
^:alenM
%K A,Y
`zj`vYc9V.:YO
gGs^y#>
%K A,Y
%K A,Y
j)Ozp6UT8>
27TsK WL>
VWBGr}(zX/)VDK A,Y
xISuOW6U*{gEb
kHV]!7
rK8U0,
A(d|fa8.G[Js
p1vytus3
UY_.s5=TN<' /
-\)M=r!u
$&Y\Ee4hjx5M
-?GRUSs_{Q
<B]slE
Fr2j2agVfqv&mZ
=2?'2_
UOsF+MnozRm
Pl J;1
S4a7_N[m
2.D#U&Y1
\l[:S9
6.q_N/v]fT7)
^=N+3U
{S%\u\oG/UG
.Tj{AT{EO*~%~k|o
l-I<Jy4#?!U
\'?&y;
)/<$'DKq
y4_7?$
:(n~ITu)PSsO
hCM?hESsO~<'
M?h~)'u?S
~)~y8ki
G-XO~_&+
hESs_w?RM
g)Ss'S)Q?
3 G=^V+k[
(e[\vB
kp3,R%i7`
<5t%*Q
;}nUC3[
v-FzC;.E,Q
0]LQtWC)C)C+!2
(Y7he[\F
f[Q:.Zqi
KvA]02sW
9*dB\nC
.XP3pVY
rC!\*MSr:!
^tU2@tx"<L'%H
"7He[2
n-7ZJN
+*5%Fz;%
$*M&SrSrWCn
2!nOD2SrU(rMCnP
{[9&7(rMCnJ
#(e{LF"%nJ
VL#Yf|G3
hh{22L
bZpo?U*N
EnPM+O$BHP2
}PW((e[9
BNHa(eF
rPBP(QC(!(d[UC*&
\C)C)Cn
YS)C&F_
D;-gCG\
S"d9O"<
P-F{n!FN
j$XlUfL
sXftc@k([!*GC+0!
IC(`C)
C,'4*QAwZFF2222
(e7(e7
e{2'%J
*0nP(e{NI(C
\eA@Zz,
R%YeF`cA
GzO%-L4+
*.WU222
sC_eq5I{{.]6F
e7(e{2Vz6q
QC+d=V
$>F72#,I{:(T7"
F-C*1L/"_s&
7'rxtw
-m<4(:4UbVilDK'{%T4FjT2
^\'$x&
w6D\=1
IC)SsPC
F[QQ(4L
ro_Y6ZPu
sRQ4ju(
ElxUnFdsS
d.aK4]
2&fQ*e
E}c[k(H:'!V2[+n8
{2LV;1
bUp9/p9(
Sqt{2`6S
?F%0g}
{kj{\_I
]w|>w{\L<
>FCC)C+
NTzgbYjx,
\Ue<>/c
s+#x]Vrk(}E8@
DZCpfw
,^}#}gkqf-_YQ44K
.2v[pd
`ny\@s.6w}{/ v
Yb]0mlpanQrPS!S$>F
-DM$gTW/#
<[2CX
e~AoxQbY"nF4V[
2Uc+!n
He7Hd[5`PmV
u^}MOH}}
g]q}5
sTzvU2
%).F*4SJ<
B2sUA#&T
~iDnhe7h&
SG_?evne!
'Qil!F
[ OBin
guRcu-P56XhY
sEy856\-M
i^|.:G
Rdpd"yscU
=%zN0l2\c
dm+m~by
!{$sx.US/0qZO+i3^Vg-
T>ttIV/%
T27_sB B
!T.J!{D
+y!xnb4@Q
hxrL,Yv@<xI
,9~%FD
7wW9_tSv
?3IFB;
,A2W"9
.!F\PKR\
BFMhD0
e;\g6#K6|w#tr>3v
5eYteC*t`
6&#(tx
^P5(eSpU
xBKu4nbF
T01Hz6
R[N*Nuuwb
HHijj*
7^#qtpu
AbU+bi
C[mcwmv2
k.S}
ZefG3x*+*
caqTs Y.x
hdAYlYPeC,oomX
ieA2 Bdtq0
8-\*K(
RUS!uPE
r%FJS)
QYQ$2*
0kQY9
GkJMRx
OQ7>]ax&f
xLOt2_
l:ls^(&6 sJIQF
AZfdpn
%K A,Y
zH*&"ok
ift\\:W3X@
8r8[W<K8<&HfM
9]ylta
-L3{0]e
*bn3;Q ?"
%K A,Y
`,+I#K]
#Q6wGt#fE
|kvNu53
WSQv{>=eIjQ
P3*2 LeY
FNcUfETVdP4
8S:] 7yX}
%KA.t{
C;GV!9<
GvSSHm
x{{e+Yb63
b6274y`^n4'+|NNau:GZ
#sn|RpGp
V4[q08;E
Y2):Pne
uXK\1A
h6m6z8nTU
@*)n@#DE)
FMhD9VOcUfNkUg#hD
XD_@AU
r*&CQXQ3xf2
!sKXk(
&t0pgC
&t\&t00gC
aMk(fY?=m
&T6`F6?;
OYzb?*
nV]0S8F;l14r)qM*Z3FHOuuH8
fK%54sJb}
6Wi/ulS#
KIO5F%O#m4Dex
YwL>8~
7M>Vq(
\/R!xxd{n
LZe6j R
ILhQY5
$D<P@uA|0+@
hq3/SG$
5gwQ4GS<j {W
&y4oQ29
|l% )aqm
W_$DS:8
bc+5Xl>)NW<3
o;~zt^
+xQ0000000000000\
f!zG9NzD
umyi$W'
iFIAV@J**
"QJr1'e
jDaV%W9
j"L.S*
LcUfdj
H,",
{+lky%{
69J$Ak
:;uDi?ue0o
d&:fs-iZ
&0$I@&7
OGmyGc?'n-*u{
y{000000000000%Fw
vAj*3>eoH
Lqkm:9]W' $XDQE
4SR4[@TRD
hEVe"AQ
'4#'5VM
=-1\ekH$
tVgWEbl+yyfni`
a{00000L
&WgOH+Ii<
knZpgp
-uL!ab5
7+[C;}01bT8i
5U|?pt.
gS U2
YLmF`x@r
xt^OMP
*>:A00000
lz$0w_W%j
b`<4xS-EE
08]n2Sw.
iHDV@6E
R)eVe$Mb1VNb3-
op0L\5
oPoPooo5
aZm~}n-K>|
pDwx )%5
y-84,no/qCW
Hk-0:
WXt1ZRDn}&M>
cp"H ?4k
[njeIQf0Dr'@1S
*~F0aU
Y2b76ifi?:j?>qnqGBrGFyvyOJzON~WRWV_Z_^gbecfi6ijhmknq>qrpusvyFyzx}{~NV^fnv~
ec:98h>hmkBA@pFpusJIHxNx}{RQPVZYX^ba`fjihnrqpvzyx~
af4h6f>jin<p>nFrqvDxFvNzy~LN~VTV^\^fdfnlnvtv~|~3663;ik<;>>;CqsDCFFCKy{LKNNKSTSVVS[\[^^[cdcffb58f:>6;j=@nBF>CrEHvJNFKzMP~RVNSUXZ^V[]`bf^cehjnfkmprvnsuxz~v{}~
b72ee:g7j?:mmBo?rGBuuJwGzOJ}}R
OWRZW_Zb_gbjgojrowrzw
cd79<j<?kl?ADrDGstGILzLO{|OQTTWWY\\__addggillooqttwwy||
b5cg;7ljj=koC?trrEswKG|zzM{
SOU[W]c_ekgmsou{w}
6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn773def7l??;lmn?tGGCtuvG|OOK|}~OWWSW__[_ggcg48d<69<9<@lD>ADADHtLFILILP|TNQTQTX\VY\Y\`d^adadhl64dd5h?;><ll=pGCFDttExOKNL||MWSVTU_[^\]gcfdebb:;7=<;jjBC?EDCrrJKGMLKzzRSOUTSZ[W]\[bc_edcjkgmlkrsoutsz{w}|{
d7gdh9?hl?olpAGptGwtxIOx|O
|QWWY__aggiooqwwy
3d6h4567;l>p<=>?CtFxDEFGK|NLMNOSVTUVW[^\]^_cfbf969jg9jnA>AroArvIFIzwIz~QNQ
QYVYYa^aaifiiqnqqyvyy~
7fci9>9j?nkqAFArGvsyINIzO~{QVQWY^Y_afagini6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikneg:;956hmoBCA=>puwJKIEFx}
RSQMNZ[YUVbca]^jkiefrsqmnz{yuv}~
ee646k<?mm><>sDGuuFDF{LO}}NLNTWVTV\_^\^dgfdflonlntwvtv|
a:h66:89iBp>>B@AqJxFFJHIyRNNRPQZVVZXYb^^b`ajffjhirnnrpqzvvzxy~~7dg7g>=??lo?oFEGGtwGwNMOO|
VUWWW^]___fegggnm3d6h4567;l>p<=>?CtFxDEFGK|NLMNOSVTUVW[^\]^_cf73;7e6<7?;C?m>D?GCKGuFLGOKSO}NTOWS[WV\W_[c_^d_gckgfla9:36j7;iAB;>r?CqIJCFzGKyQRKNOSYZSVW[ab[^_cijcfgkqrknosyzsvw{{~
ac96:f89ikA>Bn@AqsIFJvHIy{QNR~PQYVZXYa^b`aifjhiqnrpqyvzxy~185;h8i79@=Cp@q?AHEKxHyGIPMSPOQXU[XWY`]c`_ad82d8:<hl@:l@BDptHBtHJLx|PJ|PRTXRXZ\`Z`bdhbhjlpjprtxrxz|z
f9678:;?nA>?@BCGvIFGHJKO~QNOPRSWYVWXZ[_a^_`bcgifghjkoqnoprswyvwxz{
6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj654:ej:h>=<BmrBpFEDJuzJxNMLR}RVUTZZ^]\bbfedjd4d<7>:
l<lD?FB
tDtLGNJ
|L|TOVR T\W^Z'\d_fb/dlgnj7ltovr?t|w~zG|
3f5h;j:?;n=pCrBGCvExKzJOK~MSRWSU[Z_[]cbgce72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj6gc4;8gj>ok<C@orFwsDKHwzN
VT[X^\c`fdkhb9hfi=?9jApnqEGArIxvyMOIzQ~UWQY]_Yaegaimoiquwqy}
6bfh:8j;>jnpB@rCFrvxJHzKNz~RPSVZX[^b`cfjhb78ig>77j?@qoF??rGHywNGGzOP
VOOWX^WW_`f__ghnggopvoowx~ww
b3c7<>6jj;k?DF>rrCsGLNFzzK{OTVNSW\^V[_df^cglnfkotvnsw|~v{
72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemja:3987:;iB;A@?BCqJCIHGJKyRKQPORSZSYXWZ[b[a`_bcjcihgjkrkqporszsyxwz{{
95e45:=jA=m<=BErIEuDEJMzQM}LMRUYUTUZ]a]\]beiedejmq
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ a b c d e f g h i j k l m n o p q r s t u v w x y z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~
Process Tree
-
0c1777f06ed9da26fdb8c194e5d801710ff4116a71472b6a5298cab34948f90f.exe (3028)
"C:\Users\Administrator\AppData\Local\Temp\0c1777f06ed9da26fdb8c194e5d801710ff4116a71472b6a5298cab34948f90f.exe"
- jusched.exe (628) "C:\Program Files (x86)\e8fdc9c8\jusched.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 209.202.252.54 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| elegan_786444.el.funpic.org | ||
| griptoloji.host-ed.net | ||
| ftp.tripod.com | A 209.202.252.54 | 209.202.252.54 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | f163c62c72748681_e8fdc9c8 |
|---|---|
| Filepath | C:\Program Files (x86)\e8fdc9c8\e8fdc9c8 |
| Size | 26.0B |
| Processes | 3028 (0c1777f06ed9da26fdb8c194e5d801710ff4116a71472b6a5298cab34948f90f.exe) 628 (jusched.exe) |
| Type | ASCII text, with no line terminators |
| MD5 | ac42fcbe17137c9e75a3d649ff55c054 |
| SHA1 | f0d6b569f7d65935604783d10040d6ddbd2fb4da |
| SHA256 | f163c62c72748681126cbb1b801c7dea485a77a01747de0ce78179cc13984551 |
| CRC32 | 79ADA70D |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 0b875fe962eac194_jusched.exe |
|---|---|
| Filepath | C:\Program Files (x86)\e8fdc9c8\jusched.exe |
| Size | 67.4KB |
| Processes | 3028 (0c1777f06ed9da26fdb8c194e5d801710ff4116a71472b6a5298cab34948f90f.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 31c9decaabe6c385d01a841464757755 |
| SHA1 | 255c04424a5f65a31b2411506010ec517942646f |
| SHA256 | 0b875fe962eac1942f31070e8f8cad702e67c455fc2663887c678bdcbef80688 |
| CRC32 | 04FD3AD5 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.