2.8
中危
DACN
0.12
FACILE
1.00
IMCLNet
0.80
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Dropper-GHV [Drp] | 20200430 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Agent.dc | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200430 | 2013.8.14.323 |
| McAfee | W32/Autorun.worm.aacd | 20200430 | 6.0.6.653 |
| Tencent | Trojan.Win32.FakeFolder.uu | 20200430 | 1.0.0.1 |
静态指标
动态指标
检查是否有任何人类活动正在进行，通过不断检查前景窗口是否发生变化
在 PE 资源中识别到外语
(3 个事件)
| name | RT_ICON | language | LANG_TURKISH | filetype | None | sublanguage | SUBLANG_DEFAULT | offset | 0x0003b568 | size | 0x00001ca8 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_TURKISH | filetype | None | sublanguage | SUBLANG_DEFAULT | offset | 0x0003d210 | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_TURKISH | filetype | None | sublanguage | SUBLANG_DEFAULT | offset | 0x0003b220 | size | 0x00000348 | ||||||||||||||||||
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Program Files (x86)\e8fdc9ff\jusched.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Program Files (x86)\e8fdc9ff\jusched.exe |
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
在 Windows 启动时自我安装以实现自动运行
(1 个事件)
| file | C:\Windows\Tasks\Update23.job |
操作本地防火墙的策略和设置
(1 个事件)
| registry | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 185.27.134.11:21 |
文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意
(50 out of 64 个事件)
| ALYac | Gen:Variant.Ulise.93343 |
| APEX | Malicious |
| AVG | Win32:Dropper-GHV [Drp] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.93343 |
| AhnLab-V3 | Trojan/Win32.Npkon.R18258 |
| Antiy-AVL | Worm/Win32.Juched |
| Arcabit | Trojan.Ulise.D16C9F |
| Avast | Win32:Dropper-GHV [Drp] |
| Avira | TR/Buzy.416012 |
| Baidu | Win32.Trojan.Agent.dc |
| BitDefender | Gen:Variant.Ulise.93343 |
| BitDefenderTheta | Gen:NN.ZexaF.34108.oy1@aiqBGOhG |
| Bkav | W32.OnGameELLCIAUZ.Worm |
| CAT-QuickHeal | Worm.Ganelp.A6 |
| CMC | Worm.Win32.Autorun!O |
| ClamAV | Win.Worm.Ganelp-6776766-0 |
| Comodo | Worm.Win32.Jushed.KA@4cysvx |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.7a70e9 |
| Cylance | Unsafe |
| Cyren | W32/Agent.KI.gen!Eldorado |
| DrWeb | Trojan.Proxy.21485 |
| ESET-NOD32 | a variant of Win32/Agent.ABUD |
| Emsisoft | Gen:Variant.Ulise.93343 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Agent.KI.gen!Eldorado |
| F-Secure | Trojan.TR/Buzy.416012 |
| FireEye | Generic.mg.caf53ac7a70e97e1 |
| Fortinet | W32/Agent.SRG!tr |
| GData | Gen:Variant.Ulise.93343 |
| Ikarus | Trojan.Win32.Webprefix |
| Invincea | heuristic |
| Jiangmin | Worm/Generic.kcq |
| K7AntiVirus | EmailWorm ( 005191521 ) |
| K7GW | EmailWorm ( 005191521 ) |
| Kaspersky | Worm.Win32.Juched.fia |
| MAX | malware (ai score=80) |
| Malwarebytes | Backdoor.IRCBot |
| MaxSecure | Worm.Win32.Juched.FIA |
| McAfee | W32/Autorun.worm.aacd |
| McAfee-GW-Edition | BehavesLike.Win32.Autorun.dt |
| MicroWorld-eScan | Gen:Variant.Ulise.93343 |
| Microsoft | TrojanDropper:Win32/Jushed.AS!MTB |
| NANO-Antivirus | Trojan.Win32.Juched.fbneag |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM02.0.E760.Malware.Gen |
| Rising | Trojan.Agent!1.C135 (RDMK:cmRtazqmUFZQkSostnCEQg457KPr) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Ganel |
| Sangfor | Malware |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2004-01-18 11:19:18
PE Imphash
faea664dccb12d653cbea3ef51eb7d97
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00024000 | 0x00024000 | 3.6949345904629385 |
| .rdata | 0x00025000 | 0x00001a22 | 0x00002000 | 4.316884421155942 |
| .data | 0x00027000 | 0x00012fe4 | 0x00002000 | 0.7842878909713452 |
| .idata | 0x0003a000 | 0x000009a6 | 0x00001000 | 2.822041652632708 |
| .rsrc | 0x0003b000 | 0x00002990 | 0x00003000 | 2.3776818250517735 |
| .reloc | 0x0003e000 | 0x0000e000 | 0x0000d700 | 5.319585983516445 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0003b568 | 0x00001ca8 | LANG_TURKISH | SUBLANG_DEFAULT | None |
| RT_GROUP_ICON | 0x0003d210 | 0x00000014 | LANG_TURKISH | SUBLANG_DEFAULT | None |
| RT_VERSION | 0x0003b220 | 0x00000348 | LANG_TURKISH | SUBLANG_DEFAULT | None |
Imports
Library KERNEL32.dll:
• 0x43a260 GetLastError
• 0x43a264 GetSystemTime
• 0x43a268 MultiByteToWideChar
• 0x43a26c GetLocaleInfoA
• 0x43a270 GetModuleHandleA
• 0x43a274 FindNextFileA
• 0x43a278 FindFirstFileA
• 0x43a27c FlushFileBuffers
• 0x43a280 SetStdHandle
• 0x43a284 FindClose
• 0x43a288 Sleep
• 0x43a28c SetFilePointer
• 0x43a290 LCMapStringW
• 0x43a294 LCMapStringA
• 0x43a298 GetStringTypeW
• 0x43a29c ExitProcess
• 0x43a2a0 TerminateProcess
• 0x43a2a4 GetCurrentProcess
• 0x43a2a8 GetStartupInfoA
• 0x43a2ac GetCommandLineA
• 0x43a2b0 GetVersion
• 0x43a2b4 DebugBreak
• 0x43a2b8 GetStdHandle
• 0x43a2bc WriteFile
• 0x43a2c0 InterlockedDecrement
• 0x43a2c4 OutputDebugStringA
• 0x43a2c8 GetProcAddress
• 0x43a2cc LoadLibraryA
• 0x43a2d0 InterlockedIncrement
• 0x43a2d4 GetModuleFileNameA
• 0x43a2d8 IsBadWritePtr
• 0x43a2dc IsBadReadPtr
• 0x43a2e0 HeapValidate
• 0x43a2e4 UnhandledExceptionFilter
• 0x43a2e8 FreeEnvironmentStringsA
• 0x43a2ec FreeEnvironmentStringsW
• 0x43a2f0 WideCharToMultiByte
• 0x43a2f4 GetEnvironmentStrings
• 0x43a2f8 GetEnvironmentStringsW
• 0x43a2fc SetHandleCount
• 0x43a300 GetFileType
• 0x43a304 HeapDestroy
• 0x43a308 HeapCreate
• 0x43a30c HeapFree
• 0x43a310 VirtualFree
• 0x43a314 RtlUnwind
• 0x43a318 SetConsoleCtrlHandler
• 0x43a31c HeapAlloc
• 0x43a320 HeapReAlloc
• 0x43a324 VirtualAlloc
• 0x43a328 GetCPInfo
• 0x43a32c GetACP
• 0x43a330 GetOEMCP
• 0x43a334 GetStringTypeA
• 0x43a338 CloseHandle
Library USER32.dll:
• 0x43a394 MessageBoxA
Library ADVAPI32.dll:
• 0x43a230 GetUserNameW
L!This program cannot be run in DOS mode.
:!~@~@~@
_w@~@B@
@Rich~@
.rdata
@.data
.idata
@.reloc
UDSVW}
E_^[]UPSVW}
_^[P;P
]UTSVW}
_^[]ULSVW}
MU;U}gE
E}^}7M
_^[L;rM
]U@SVW}
_^[@;L
]UDSVW}
_^[]UPSVW}
_^[]UDSVW}
_^[]UlSVW}
u,U;Uu
t\U;Uu
E_^[l;D
]UpSVW}
EMMU3f
Q<UE8PE
MQxUEH|MU
M;M}-U
_^[p;B
]U`SVW}
EMMU3f
Q<UE8PE
3_MQxUEH|MU
ME_^[]UtSVW}
]UtSVW}
_^[t;:
]U@SVW}
_^[@;X9
]U|SVW}
_^[|;>/
]UHSVW}
_^[H;%
]UHSVW}
E_^[H;U$
]UHSVW}
9Us)E3
_^[H;}"
3EEEfE
jdTQhDzB
MQh`PB
URh@PB
EPR ;
MQPp;E
MQPx;
fUfUfEfEfMfMfE
-oje`[VQLG_^[
TPP`Q#
;}}PRcP
wuWhHUB
E}tEEP
9UtOEi
9UtVEi
9MtVUi
9EtVMi
tAt2t$
PRSVWhVB
_^[ZX]
DDDDDDDDDDDDDD
GIt%t)
Gt/KuD$
GKu[^D$
[^_U=C
]UjhWB
EMQUR&
eEPJMd
_^[]U=C
t h|XB
@v)URc
RPQRPQRPQREPM
u&hpZB
E _^[]Uj
3u&h0\B
;t!hX[B
$REP'6
M;Mt!h$[B
;Et!hZB
E_^[]Uj
]UQSVWzB
t!ht]B
uCE PMQ
uCE PMQ
;Mt!h\B
;Mt!h\B
_^[]Uj
t!ht]B
EE_^[]UQzB
E]UQSVWE
t!ht]B
_^[]UQ |B
E]UQSVWE
E_^[]U
3uNh^B
u&ht^B
u:U REH
QURhH]B
u:E PMQ
u/M Qh@^B
QURh ^B
RE PMQh]B
E_^[]P@
E]UQzB
REP/,
u+hT_B
%URh0_B
H0_^[]U
u.h|_B
A,+B,M
J0+H0U
E_^[]U
PM Qh_B
PM Qh_B
u_^[]U\SVWE
UB E=4~B
EPMQh`B
u_^[]U4SVWEP
3_^[]UQSVW}
Q,Rh`B
Q0Rh`B
3u_^[]U
]UQEzB
=tGjyh
EMMUREPj
UREPMU
PMQUR#
jdh4aB
EPMQUREPj
3%MQUREP?
MU;U}eE8tXM
E}tXMQ
E}@}2M<`C
]USVWUj
t.;t$$t(4v
VC20XC00U
]_^[]UL$
_^[]UQE
]U0SVWEE
j]h$dB
j^h$dB
E_^[]U,SVWEE
jZh@dB
j[h@dB
E_^[]Q=
3lh`dB
EE]U]U$|B
UE;Es%MU
]U8VDC
MU;Us$EM#
MU;UuIHC
U#TDU}
^]UQDC
E}?} MU
UE;Ew]MA
UUE+EE
]UQ=@C
M;t U;u
tn} }2
,3]U0SVWEE
j]h$dB
j^h$dB
E_^[]U
MQUREPj
Ek0H~B
s{Uk0EX~B
Mk0UEfAL~B
Ar;Zw2!C
Qar;zw2!C
}!h|dB
u!hTeB
ddIdd.wld3A@
``C``5
fEfMQR!
U tHE@t
RPRPu0RPQR9~
ERM+MM
fZfZPxQ
QtRxP)
fA]UWVu
DDDDDDDDDDDDDD
^_UjhpeB
3CMQURE
PMQURE
_^[]UjheB
SVWe=,C
REPMQU
EPMQUREPM
EPMQh
QUREPh
QU+RQU
E+]UQSVW}
Uj;heB
_^[]UE
@]UQ=C
M}-s#UE
|jyheB
<uh=zB
<tc=zB
~VUREH
;Eu!MQ
E_^[]UQE
EE]UQVE
3^]USVW}
_^[]%C
Oe !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_abcdefghijklmnopqrstuvwxyz{|}~
VmfantunmoelIriGoeotA
WoitAtdDcyenserGiwro
yeploiCFA
EreabtimVaAevntieGnonrl
MllmtuiaedFNAGoeee
aitAeDcyreerCtro
FAieterteltuASitbs
erebyrirFLa
drAabyoirLLa
MlnAtuaeedHlGoed
PAetcreodsGrds
n2lr3leldke.
broFlleGae
bloAclloGal
FSteeelzGii
dealeiRF
tliirFWee
aieFAreeCtl
snoaelHlCed
c3xosersNPe2t
c3rosirsFtPe2s
CerstrPedertcIGunos
aoe2pteTh3aorelpnhCtolSs
LcrSntiDeiAeglvrsGoaitg
DeetvpeiyGrTA
eilFAeeeDtl
oitAmDcyeeerRvro
dsnoilFCe
dtenxlieiFNFA
dslnriiiFAFFte
etsnteoaennlHlIrCed
GipFAtteFel
etnAtentnnocIrCe
etnteennpIrOA
i.ntlielwnd
PipFAtteFul
leeexthEuSlcA
l.e2lh3lsld
$*$%u}-sEBB5>Ds?>DB?<$5D-$5BF935C-$81B54q335CC-!1B1=5D5BC-v9B5G1<<!?<93I-$D1>41B4!B?69<5-qED8?B9J54q@@<931D9?>C-|9CD
bd:ael*nE::
CegsyeoeRlK
SaEgVeetuARelx
OKxgnEeeyRpeA
a2lv3ldidap.
DtlgeaAelVeReeu
CtygaeAeeKxRreE
\Java\jre-
gFsomeralPri
$?6DG1B5]aaaaaaaaaaaaaaaaa]sEBB5>D'5BC9?>]#E>
e.gteeixrde
/Downs/HelpVer.hlp
/Downs/Help.hlp
Help.hlp
/Private/
Pfile.hlp
gdaheb123
?>D85<9>EH
6D@]DB9@?4]3?=
gdaheb
eedeia
7B9@D?<?:9]8?CD\54]>5D
ieagecJH
2ab0h_hbige
6D@]2I5D8?CDab]3?=
jusched.
!B?7B1=v9<5C
Fi386\chkesp.c
The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention.
Assertion Failed
Warning
%s(%d) : %s
Assertion failed!
Assertion failed:
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
wsprintfA
user32.dll
Microsoft Visual C++ Debug Library
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
(Press Retry to debug the application)
Module:
File:
Line:
Expression:
For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.
<program name unknown>
dbgrpt.c
szUserMessage != NULL
Client
Ignore
Normal
Error: memory allocation: bad memory block type.
Invalid allocation size: %u bytes.
Client hook allocation failure.
Client hook allocation failure at file %hs line %d.
dbgheap.c
_CrtCheckMemory()
_pFirstBlock == pOldBlock
_pLastBlock == pOldBlock
fRealloc || (!fRealloc && pNewBlock == pOldBlock)
_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLOCK_TYPE(nBlockUse)
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
_CrtIsValidHeapPointer(pUserData)
Allocation too large or negative: %u bytes.
Client hook re-allocation failure.
Client hook re-allocation failure at file %hs line %d.
_pFirstBlock == pHead
_pLastBlock == pHead
pHead->nBlockUse == nBlockUse
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
DAMAGE: after %hs block (#%d) at 0x%08X.
DAMAGE: before %hs block (#%d) at 0x%08X.
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)
Client hook free failure.
memory check error at 0x%08X = 0x%02X, should be 0x%02X.
%hs located at 0x%08X is %u bytes long.
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0x%08X.
DAMAGED
_heapchk fails with unknown return value!
_heapchk fails with _HEAPBADPTR.
_heapchk fails with _HEAPBADEND.
_heapchk fails with _HEAPBADNODE.
_heapchk fails with _HEAPBADBEGIN.
Bad memory block found at 0x%08X.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemDifference: NULL state pointer.
Object dump complete.
crt block at 0x%08X, subtype %x, %u bytes long.
normal block at 0x%08X, %u bytes long.
client block at 0x%08X, subtype %x, %u bytes long.
{%ld}
%hs(%d) :
#File Error#(%d) :
Dumping objects ->
Data: <%s> %s
Detected memory leaks!
Total allocations: %ld bytes.
Largest number used: %ld bytes.
%ld bytes in %ld %hs Blocks.
stdenvp.c
stdargv.c
a_env.c
ioinit.c
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
format != NULL
sprintf.c
string != NULL
vsprintf.c
GetLastActivePopup
GetActiveWindow
MessageBoxA
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)
_flsbuf.c
str != NULL
`h````
ppxxxx
(null)
output.c
ch != _T('\0')
_getbuf.c
_file.c
osfinfo.c
fclose.c
_freebuf.c
stream != NULL
aa3vd2apeJUt
a3d2peUt
htdocs
GetModuleHandleA
GetLastError
GetSystemTime
MultiByteToWideChar
GetLocaleInfoA
FindClose
FindNextFileA
FindFirstFileA
KERNEL32.dll
MessageBoxA
USER32.dll
GetUserNameW
ADVAPI32.dll
CoUninitialize
CoCreateInstance
CoInitialize
ole32.dll
ExitProcess
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
IsBadWritePtr
IsBadReadPtr
HeapValidate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
SetConsoleCtrlHandler
HeapAlloc
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle
)y)y)y)y)y
)y)y)y)y
y)y)y)y
kkcccccJ)
})y)y)y
kkkkkkkkkkcJ)
)y)y)y)y
sssssssssssssskR1
)y)y)y)y
sssssssssssssssss{{Z9!
)y)y)y)y
!ssssssssssssss{{{{{{{{{ICONMD5.6c78a9fa
!{{{{{{{{{{{{{{{{{{{{{{{{{{kZ)y
!{{{{{{{{{{{{{{{{{{{{{{{{{{J)y
))sc))y
11kcZ1
RRkck!)y
Zck1)y
9kc!)y
)9{9)y
6666666i777
8(8<8L8^8k8|888888
9)909=9D9Q9X9b9l9v999999999~::::::::
;";,;6;=;J;Q;[;e;r;y;;;;;;;;;;;;<<c=
>2>V>]>n>>>>>>>
0K2c2o2v2222222222
3-343@3G3_3f3r3y33333333333
4'4.4:4A4Y4`4l4s4444{55555555555
6)606<6C6[6b6n6u66666666666
7#7*767=7U7\7h7o777777777777
8$80878O8V8b8i888888888888
:.::::U;;;
<.<E<p<<<<====
> ><>H>O>k>w>}>>>>>
?5?E?a?m?s????
1,181?1[1g1m1v1
2!212M2Y2_2n222y333333/4U44
585L5q5}555555555
6u6666
898^8r8888888
9"9G9R9p9}9999999
=?=K=i=z=========
?"?-?@????
0)0:0L0^0q0z00000
1'2>2L2V222222233_4!56666
777777
8 848b9x999:W:';;
<|<<====
>2>G>Y>k>|>>>>>>>>>>
?*?4?O?^?y?
1'191>1162j2p2|222
3@3O3p333333
4-4C4S4c4444
5Y55555555
6!6R6666667
8?8_8k8
889999
:(;.;:;N;b;;;;;
< <=<B<]<d<}<<<=
> >&>2>F>Z>>>>>>>>9?
22222222
3 333344444444
5%5,5054585<5@5D5H555555
60676<6@6D6a66666666666*7074787<7
:#:(:5::::::::
;';=;B;O;T;b;|;;;;;
< <%<1<7<@<F<K<X<<<<<<E=d=u======3>?>P>Z>j>t>>>>1?7?E?M?S?g?t?y?
???????
0+0g0s00000
1'1-1B1S111111
2/252T2`222253T3`3
33333333
4'434T4g4s4444
5Z55A6V6b6~666666$7L77777E8N8S8[8a8g8o8u8{888888
9"9w::::::: ;%;W;;;;;2<><<<
=%=-=3=<=D=L=R=[=a=g=n=s===
>\>f>r>>>>>>>>
?#????
0#0Y0e00000*101T11111
2M2Y2w2
222222
3;3M33333
4"4x4444
5!55555566666
7)7.7Q7V7y7~77
8I8t8888H9{9999999
;';.;;
<!<@<E<o<<B=l=x===e>>>
?_????
?0a0x00
191>11102]2222@3\333
4L4W4j4~44444444
5*5A5K5\5~5555555
7-737E77777
8"8(8,818>8H8s888M91:$<x<&=/=>=J=Y=l=
>?>b>p>>>>
?<?f?l???
0,0J0\0b0k00
1_111,232b2q22222222
3.3B3P3W3h3p3w3}3333B4\4e4e5n5w55555
6&6/686K6_6h6o66666"7;7U7777::::;;;;!=+=1=<=H=M=r=y=
========
>'>;>J>N>R>V>Z>>>
? ?1?B?S????????
0,0[0j0t0x0|000000000 1'1-1;1E1J1P1\1f1k1p1z1
111111111
444=5D5S55555
6D6d6{666666666666;
<+<6<=<H<P<Y<i<w<<<<<<<<<<<<<
=$=-=>=D=M=U=h=q==
>>>o>{>>>
h2s2{22222222222
3E3c3j333Y4;;;;;;;;;
< <0<;<D<P<X<d<k<p<y<<<<<<<<<<<
3&3/33
4586R666 7J77777777
818^8i8o888
9&9,989_9r99999999
:@:D:H:L:P::::::
<A<<<<<<
=n=}======
>%>8>P?Y?
T0]000+1:1'2S2|22223344A5H5
66=7o888=======
>->1>5>9>=>p>t>x>|>>>>>>>>>>>>
00000000
151<1@1D1H1L1P1T1X111111
2%2@2G2L2P2T2q22222222222:3@3D3H3L33333333
4 4/4L4W4j44
5@5f5k55555555
6"6-6@6g66
8988888#9@9O9999999+:Z:2;<;i;;;;;;
<.<8<n<w<<<<8=Q=f=o={===========
>M>f>x>>>>
?%?:?X?}??????
040h000000
121>1g1u1111111
242@2L2_2p2z222222>3M3333
454`4u455
6*6U6k66677777
8"8(8J8_8q8{888
9=9F999999999
: :&:,:2:8:>:D:J:P:V:\:b:h:n:t:z::::::::::::::::::
t5x55555
3 6:::::::::;;;;;;;;;;;;;;
< <(<,<@?D?P?X?
111111
dd3ii76h7l;qq?>pttCyyGFx||KONSWV[_^cgfkonswv{
d96egh?=lA>mopGEtIFuwxOM|QN}
WUYV_]a^geifomqnwuyv
$* TrDk
!w)xJ/F~}x
(jrXwZ%2m
@Pt6yi^A4f
t%dr0SIg
6Z6yvZ]
<v`gWiKr*
.tns5H?5e"}O
a"v(YV-'x@2^
at*K[4
)6r"UQ.?
m"Wily&7mk
SgMm~C
8pNmX-gP
nxy3] %zXiu
2yqH Il$
d0tJ@R
0K~2dK<
bpt2c>pM^
w4h/jeqxb
8^q,z&b.xo
&e%k96
-D=|uV
2EVnoql-}
)Z:d#J8{9i%d#wE
[ egb1K|W(=
mh.^z/t
'};,36
X2W-XX
`b1]i%A
N JN$J<
Y$Jg}K(\
,tGh?28<
Y;-R'!
`=jd62
@%@FIuj#
\}tmJA6;\<
7^DlkqlI
WU Cn_8"P
f~}biP`,r
%vGn`~
rax%3Rin
'W0b50
`UOg;H
@|o~$+r`Uk
CDzOx,6M9=[+h
~|]>faHO
@qF"bANaF
sxo[,y<!\]Yg
AGeRe(o
u#nf(vV
5W?;fk&~$
ba,m%Fo
UVXRn|5I
.)1pEX
\gp[ z
<:2MM0&w
w"MiLU(2
-4 j3H}VJ4p7
[x[[7& O0!TX\
CFD?w\xX
| =Mnco}Mu
8f-?=y9cbxi
LB;s5Q0
VH^(MVH8Ng'
s@}y;:5J
[:C8b!@g5
{7")WFw
:<&<N, G^$ qJ0
6qjrN.W
j`(-US
E&F<L~KMu
\+o0{T:?
S23@Av
PN$xnh[Qb
R"4>hJ
_v+Tp~\q,"L
pC1UL]YPRA)
-ah #RTvBj
NI@t=o
K+dR^A;Rc
X!+ZHsTM[n9
cxago@!
>]o[b:kX
[EwSM}Xh
X|PoVKP5yP
Xi|#qY
9F@\8r2`
yvqiX2g
G:)ZTFzv.~J8
f3?|@lHO.$$jElsOqV2pK
RC9pj-X
{nM:9-K">N
' q0~L
&E8b{5F8
mt2g8(
HS1Y",
B#\F+!C
D{<]YJ
.Xe|.=3`
! LGbUWp
!ov_Z:
Xj^ihx^"
$S}s-l7
t9l"}\PFD$w >c"?Fc?-F<
y!KLNNl,
{SaKqU
gS;HT.-`OG
E|j+4v
|FUxBH"
b-I[of
j&T{xS\
m;j,A7;C<
2v M%0
'e23nos
{hI<yS9s
GjL(=5XK**
qxpza#NJOY_Sn
Jx0K6)K&
.W7A9eY
qZCajArx
w>PSvxOk
M`z*c9
nVLn-8.=V
+P ^'3
nw4P9&hB
Q&{Y}zjY(Z+ZV@s;a/)
5[P'y^
t5*Ds{
b hvB<<&hwU
j+>Z[l/&{Eq
M]>]|{{^O*YrvD
PR*BJ8
Fh48w}F
393vNZ
v/*bpX>=5W>
=67[;
kg>ekX]-
`r{@d_ d4
gLg0W}^z
Z1?uN+5
CIxmr|4C:V ob<QmQ
\d7brv
=x}lU)w
>@keJCW<
,?+}H)hASU+`B
<+3;uIp['>
Y$_QyXy
'$WdrSjB
gma`<JEjXD.
y|G/*>
Rl#~M#
)[31Dj
@<tdrC
q[6>#}Mf
sSR7R 2%
8y5CEJ
2%Q%|kBKV"
x#U5L^+-
Ms)x \:
WJht2*L\8
n%K5dS5i
M%4c$J
sHM9m<-q6l
;d\"<x
"}4a,#@
?EzI]W? $/
d?5ZH#76'e&
B!ipqlK-
vX8[hJK
7/ %aIOJm
auW%H ^j\
,B)4pQ
k%EfZ=#Am
HjI(`_Mgb.N
7gWse/y,\
zlZS%y8+L
g?J&r!B8
;.SefM+(6
c>qY0
nq2sEW
wp$B^e6
l(+FMH
thNbhf5
s3 >`9
V%Nnt$
BW.?$UR)b
@S+p\O|c
|(|o@H@
:k;o1Q
/x{WA+QX~+a
uGYnx0t
8( Sl^
<FuDpj
:3[$sl
X2hd39X
8h*l;}
xPy~OzT./u
lrQ"}Y
w&/Ap^
/I_ sL
'U`a{vR
8Q+P4NKV
QmSfs~c<
W[ H1_
] '$-MN,&
4X,lGk
cMo\ =!h9G[u
Q{K~A*
u{ukMxMZu{3m
5"M%Ercj7
!>M0t3=j
C#(d&>r
N{FeL!z
U * [)
_QI*t"8A
1{Cc&8AZ^z|
iA!A#SFh
o>>jAf5
7bt%N$:U
Cs_e^2
=zFx!t
XRKZIX
>X_y|~
T6#L:PFx
&Nd%)|Nwb
*WiZVr
BpHHN5
}5OPB(6pE
LKdqrF%I;=a
BNm/w=~#
Xw9V1$2P._w&
;pEk'_w
QD&Mt:U
u]:k!1
\R{@fTu)2
.5RAXv^FgR
?GY$%dKJ+l1c
qG4q</ai
Ed$:#8u
;iS%^wxw8!
9%-.wan?
G<FiIW
?0A0S89
3K@t7.
Kl g5S?-!
J"DR85<<
a8|-1R
h<'B/W
(M|>e9y-\
&X.$j2.2Ur
XV.D+>
;:(iT)\7s
9`LJTh5
nc'Z|P~y
&2 ~ZVf
5@!F^P+
.Q$4pH
ftJ>,4@z
H7Y.'-<P2s
A4Aq48
x%3}w{
Mi/x|8
m'XDj2
N,S[|-_'%
f&XSn}In
T-KK#J
8@*i>|"*
KxKA u08n-[?
==?B<T
+$ROxT3u
|0=hU\
nrk'i,Ac,sLb
`RF623b@B(PH/c
6d*Xf3
zAJXge
;1aZ1r2
v&gVIIw"B-
9utXXXvP
3&diNm'
:7rD.}
sJ`'A 4,
E5l=n/[}_;
KY;5Gp,b8S
TTvI?O1
(?uP_&XR
a,R;Dm
&pt<yj
ZRF8!doufkXw
FR1iZUg
{~i^|[
CCi%#O#qY
4I 9PI
W$2kFHm
:Y&!icRL
Ot#/H'|
cC?>fF U#3ajFB)Z)
tUCT6#]&hIA
-gv"e~
AKAwX
mr2W5XX
(~3.n}P
,. sy[^a)>d
icZ%t+UL
^&ZzZ8QE
G@K8qQ
g0,tP_
3{x:9Ot
@X7A'$
VC8}Y&.
)c}mPKt=^=.m
,yFQbq3J
(qF8ft
9bW0=bb
_olcgx3l3
nz#L""
PoYj-=A
~dK?>f
f.'M6#
Kap,WmI
,R>\9)`
1D RM*
zEp_Xi
uX1mJ-_
:e(U"]x._
)JFlK*Gk%
;zF1}`z
k,["mPHYbi~T^$
EIL1It6=
;E@npq
- L.(21dM#7"f2^NsI
JX[7:a $
MTjj]z6VX
EMr-`4;I;\
}!3cv)9
(.):~u%3<
LmvK8zu
^hAwE _`3
T,SI$6
E|0Vd*
+$7c)6vn6
jI.3
u,Q9|!0
|~l5hV1
)]wf9l2
Yhwn3]
H :r(jYv
R~?/>%V
ez,lipT
DW#^YB
)m(pxn
;m:2G ]
Bi5BlM5)+
T_z&}+g
W'n$E\Z
^^3Gt-!UolY9
__S?i#
@_4S})
W|b9#o1|y
O}?xDvmJ
w]QDoh
`|;bq$G/y
pXn lF
:=l >$NV
%coV&tUZ8|B|
4Y%.a6y'p!'E
rdnz`D
6F)QC2x.sTz
b+<H5)G
+k slF7
>T=33/8K_
P%*83zT{J$=cP<
.m5d:<
oOX7spPQjp#W#2kN$
9w+OSoG
LI_E=r
r}K>(
ykYO|Y:6XRe
@6m:|y D{M;N+vaNk+
1UZR.@VUFyGNy8f
|wCg"~3c,JvZ=2S&
,W{x$o
h9@@.H6y
}Tl5?q
i<Y93r*
`:Az%!
=|:w@U
f<O)g/S|
*6x<z1
lYY "wj@:'B.U@
H~|}M>w}
E+w.kTw
xAFR o,#"x
+PQ3O^3Jd<
'P^B>Ajk+
AJ)]}>
M;yPSwg
0z@eU>
vH?nvc
VgaYt/XP
PbJg:I
Jhd~HF
#e1.s;ykl</
c_vJ[qP[!
p4k}/W0
U =?I%.gX3RU]13jm
(C)4~r
@PxW \1
*~F%#E
PG<kCF
"'l7e/Tq-
[Rr8=v
nl 'JW?]1Qr;z9<+;uNsw?
rYQ?e%
.p$P,k
~!S:[iS
oj;$OGH
<-fiav*B>ew@;T
||*<kr
~JAtlIe O
\23Bq@&
d+p8;J1
&M<|]@5S<tda*
1qr:|wDga
:Gy+IV-sOT
(yl017D
V.;^!vML'4T
O&DS@E"
5ho@=8
u.657)
cw"TU8[
>9}mt%V
Zt_naU_
wr3e"%
.W6E@y?
eV~<n^
mSQw;EcX
cv80IU6_rxg
dpdF&7FW
K9-$7%P`Q
1dzy\Mii
#o*YHjkr
Dzd"6m^w
SFNf#@U
~L}jS8
K7!jGjc
k%EyZ=Am
~w]p`Ow
HeI(`_Mg".N
(seY]"
*p;}#^?
"L*)<qe
3+f(<nyE@
J8-oiqaU@jf,Yr~
#I>%FW
i1FP~d
cV%=jn)
J\}NOC
\R9cd4y
NnU;\`
J2cF}@
0Gr l?
AWQKoR
6bv][?A\
kKi1}:tPN`67
`*<kR=6qg,!}S"arF
h/$|J 5@O3;
oX<pqt
w@H2:&Cn#
QXbv<W"(
2QaKwbq
jFrM<5Wl^6w6
<D@YI4r=,
A|#>N`~
VHAi|ZI
]@]$vccm
KZpB%]?`bY
8`vFW}b
ige/k;
kQNx|>+W0
`lff2
hU38G)
8*ax{8
s,ND]3
fgp#\Az
r>34V6
y=vs&x`D
vgKfha
KV-lGj
aMmyX0t
#!qDJxMj
Cv5/n}`
D0Xd3V
U\B9}B_=fZ_;
4{)=Pp=b!
5gORx"
xu4]%BU?~
5! Y.Om5
T`^iJ~
Dktp+-MAio2&d
LDA)eSiF{y
[WyE8J:[
Gh>uJ,5
2;]1w+
N y4!]cZ?se 4+
58XDiP
C-:|Lu
vC=<n (]7
oO\LfWi
2hgtI'.$
".5mj#
s}oG,Ib
v O"l`
BO0:mu[
@E^+Ht>Hr@
;[0(.9gU}
g@awJ"r;
tF!'4MB
d`fyJK
:S[7~@ed-2
;0eJw+
El/%DL
,DX4*ud
RYD[;x
f*4'U8
9^PYiJ4<xrpn
t8dhdf56>@lpln=>FHtxtvEFNP||~MNVXUV^`]^fhefnf95<:7<7nA=DB?D?vIELJGLG~QMTROTOYU\ZW\Wa]db_d_ieljglgqmtrotoyu|zw|w}
6d68h=:@>l>@pEBHFtFHxMJPN|NPURXVVX]Z`^^`ebhffhmd:c8:7l8lBk@B?t@tJsHJG|H|R{PROPZXZWXb`b_`jhjghrpropzxzwx
c7h86>><k?p@>FFDsGxHFNNL{OPNVVTWXV^^\_`^ffdghfnnlopnvvtwxv~~|
f62f6h7
n>:n>p?
vFBvFxG
~NJ~NO VRVW'^Z^_/fbfg7njno?vrvwG~z~
155f5h889==n=p@@AEEvExHHIMM~MPPQUUUXXY]]]``a28269>>::@:>AFFBBHBFINNJJPJNQVVRRXRVY^^ZZ`Z^affbbh82cih:g9@:kqpBoAHBsyxJwIPJ{R
QXRZY`Zbahbjidcc<j>iklkkDrFqstssLzNy{|{{TV\^dflntv|~
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d54:h?i>l=<BpGqFtEDJxOyN|MLRWVUTZ_^]\bgfedjc1f:g>h<k9nBoFpDsAvJwNxL{I~R
VTQZ^\Ybfdajnlirvtqz~|y
5d36::>k=l;>BBFsEtCFJJN{M|KNRRVUSVZZ^][^bbfecfj19;f;6<?9ACnC>DGAIKvKFLOIQS~SNTWQY[[V\_Yacc^dga775fg;k;??=noCsCGGEvwK{KOOM~
SSWWU[[__]ccggek6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikndcgifg>klkoqnoFstswyvwN{|{
V^fnv~74hi<;=;?<pqDCECGDxyLKMKOLTSUSWT\[][_\dcecgdlkm3f9f9:h
;nAnABp
CvIvIJx
K~Q~QR SYYZ'[aab/ci9b4d7>=>Aj<l?FEFIrDtGNMNQzL|OVUVYTW^]^a\_fefidgnmnqa7h:i7g=i?pBq?oEqGxJyGwMyORO
UWZW]_b_egjgmorouwzw}
745g98<m?<=oA@DuGDEwIHL}OLM
QPTWTUYX\_\]a`dgdeihl6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknf9:e6ki<nABm>sqDvIJuF{yL~QR}NTYZV\ab^dijflqrntyzv|~
496;:g?i<A>CBoGqDIFKJwOyLQNSR
WTYV[Z_\a^cbgdifk6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn5gd:e:<m=olBmBDuEwtJuJL}M
|R}RTUZZ\]bbdej36f;h=>m;>nCpEFuCFvKxMN}KN~SUVSV[]^[^cefcf719f=;<
?9AnECD
GAIvMKL
OIQ~UST WQY][\'_Yaecd/gaimkl4b:6:jj;<jB>BrrCDrJFJzzKLzRNRSTZVZ[\b^bcdjf6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn75f9:k;k?=nABsCsGEvIJ{K{OM~QRSWUYZ[_]abcgeijk4274=j:<<:?<ErBDDBGDMzJLLJOLURTTRWT]Z\\Z_\ebddbgdd4ge5;9>l<om=CAFtDwuEKIN|L
}MSQVTU[Y^\]cafdekinlmsqvtu{y~|}
e:6;i==:mB>CqEEBuJFKyMMJ}RNSUURZV[]]Zb^ceebjfkmmjrnsuurzv{}}z~
8427e>h8@<:?mFp@HDBGuNxHPLJO}VPXTRW^X`\Z_f`hdbgnh148e;;gi9<@mCCoqADHuKKwyILP}SS
QTX[[Y\`cca3663;j7j;>>;Cr?rCFFCKzGzKNNKSOSVVS[W[^^[c_cfff9dh;9?:nAlpCAGBvItxKIOJ~Q|SQWRY[Y_Zacagbikiojqsqwry{y
9dde=j=:AllmErEBIttuMzMJQ||}UURY]]Zaeebimmjq5cei:<>k=kmqBDFsEsuyJLN{M{}RTVUZ\^]bdfejec58h7=<mk=@p?EDusEHxGML}{MPOUTUXW]\]`_edehgmlmpoutuxw}|}
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm122596>h9::=A>FpABBEIFNxIJJMQNVQRRUYV^YZZ]a^fa72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemma58;9j:>i=@CArBFqEHKIzJNyMPSQRVUX[YZ^]`cabfehkijnmpsqrvux{yz~}
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemma634;f;<i>;<CnCDqFCDKvKLyNKLS~STVST[[\^[\ccdfcdkklnklsstvst{{|~{|72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn
@ @ @ @ @ @ @
( n u l l )
( ( ( ( ( H
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 0 0 0 0 4 b 0
C o m m e n t s
C o m p a n y N a m e
F i l e D e s c r i p t i o n
F i l e V e r s i o n
6 . 0 . 1 5 0 . 3
I n t e r n a l N a m e
j u s c h e d
L e g a l C o p y r i g h t
C o p y r i g h t
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
j u s c h e d
P r i v a t e B u i l d
S u n M i c r o s y s t e m s , I n c .
P r o d u c t N a m e
J a v a ( T M ) P l a t f o r m S E 6 U 1 5
P r o d u c t V e r s i o n
6 . 0 . 1 5 0 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
Process Tree
- explorer.exe (1412) C:\Windows\Explorer.EXE
-
0741c1fdc999eb49fe257e83fadf1fe27d7d6915b74f068322644b6d14f8f8e1.exe (1856)
"C:\Users\Administrator\AppData\Local\Temp\0741c1fdc999eb49fe257e83fadf1fe27d7d6915b74f068322644b6d14f8f8e1.exe"
- jusched.exe (1156) "C:\Program Files (x86)\e8fdc9ff\jusched.exe"
0741c1fdc999eb49fe257e83fadf1fe27d7d6915b74f068322644b6d14f8f8e1.exe, PID: 1856, Parent PID: 1784
default registry file network process services synchronisation iexplore office pdf
Hosts
| IP |
|---|
| 114.114.114.114 |
| 185.27.134.11 |
| 209.202.252.54 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | |
| ftp.byethost12.com | A 185.27.134.11 | |
| griptoloji.host-ed.net | ||
| ftp.tripod.com | A 209.202.252.54 | 209.202.252.54 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 185.27.134.11 | 21 | 192.168.56.101 | 49169 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 817e4ae8216f2c9a_jusched.exe |
|---|---|
| Filepath | C:\Program Files (x86)\e8fdc9ff\jusched.exe |
| Size | 239.0KB |
| Processes | 1856 (0741c1fdc999eb49fe257e83fadf1fe27d7d6915b74f068322644b6d14f8f8e1.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | bacda7c55ff38b28ac0d96af1797029c |
| SHA1 | eb739d7908b91598a7c694354fdb2484133f1673 |
| SHA256 | 817e4ae8216f2c9ab5c30a0615a79da360d4c654da8dd6cc46a2740dabf5a871 |
| CRC32 | 22C35F31 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 2f68ca5df04341b6_e8fdc9ff |
|---|---|
| Filepath | C:\Program Files (x86)\e8fdc9ff\e8fdc9ff |
| Size | 30.0B |
| Processes | 1856 (0741c1fdc999eb49fe257e83fadf1fe27d7d6915b74f068322644b6d14f8f8e1.exe) 1156 (jusched.exe) |
| Type | ASCII text, with CRLF line terminators |
| MD5 | 30fe6ad40c47e9a3a5e392e9e39c7fd3 |
| SHA1 | 578c51a6aea2a304fe831eb5bfb772e41fd0460f |
| SHA256 | 2f68ca5df04341b66b566ad7c639f60c3de2a597c87878ca1af6fc266e812aa3 |
| CRC32 | 70E1C66A |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 3215c0cfb4f593be_update23.job |
|---|---|
| Filepath | C:\Windows\Tasks\Update23.job |
| Size | 258.0B |
| Processes | 1856 (0741c1fdc999eb49fe257e83fadf1fe27d7d6915b74f068322644b6d14f8f8e1.exe) |
| Type | VAX-order 68k Blit mpx/mux executable |
| MD5 | b811db840073f9943c182c0f17b250f0 |
| SHA1 | b83bd5e819285dcefb97a582759029fe4f48a0ed |
| SHA256 | 3215c0cfb4f593be7efd2fa5cdde4cab99c6ec85044dcc96770a2ec8f9019f4a |
| CRC32 | D262367D |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.