0.9
低危

14c768238825e437232896147873bdb8d0ad769183f3c5e48bc5dd50426e8af5

14c768238825e437232896147873bdb8d0ad769183f3c5e48bc5dd50426e8af5.exe

分析耗时

194s

最近分析

380天前

文件大小

125.9KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER BUBLIK
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.68
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanDownloader:Win32/Bublik.f39ef58d 20190527 0.3.0.5
Avast Win32:Crypt-QDX [Trj] 20200330 18.4.3895.0
Baidu Win32.Trojan-Downloader.Small.av 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Kingsoft None 20200401 2013.8.14.323
McAfee Downloader-FWH!D63E6E2AE3E1 20200331 6.0.6.653
Tencent Trojan.Win32.Bublik.bkdm 20200401 1.0.0.1
静态指标
行为判定
动态指标
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 66 个反病毒引擎识别为恶意 (50 out of 66 个事件)
ALYac Trojan.GenericKD.1393477
APEX Malicious
AVG Win32:Crypt-QDX [Trj]
Acronis suspicious
Ad-Aware Trojan.GenericKD.1393477
AhnLab-V3 Trojan/Win32.Zbot.C216253
Alibaba TrojanDownloader:Win32/Bublik.f39ef58d
Antiy-AVL Trojan/Win32.Bublik
Arcabit Trojan.Generic.D154345
Avast Win32:Crypt-QDX [Trj]
Avira HEUR/AGEN.1040611
Baidu Win32.Trojan-Downloader.Small.av
BitDefender Trojan.GenericKD.1393477
BitDefenderTheta Gen:NN.ZexaF.34104.hqZ@ayAp0sci
Bkav W32.AIDetectVM.malware
CAT-QuickHeal TrojanDownloader.Upatre.A4
CMC Trojan.Win32.Bublik!O
ClamAV Win.Downloader.Upatre-5744092-0
Comodo TrojWare.Win32.TrojanDownloader.Upatre.MAUA@5rueuc
CrowdStrike win/malicious_confidence_100% (W)
Cybereason malicious.ae3e1c
Cylance Unsafe
Cyren W32/Trojan.CSFI-3153
DrWeb Trojan.DownLoad.64690
ESET-NOD32 Win32/TrojanDownloader.Small.ABG
Emsisoft Trojan.GenericKD.1393477 (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.GLI
F-Secure Heuristic.HEUR/AGEN.1040611
FireEye Generic.mg.d63e6e2ae3e1ca2b
Fortinet W32/Bublik.AEOV!tr
GData Trojan.GenericKD.1393477
Ikarus Trojan-Spy.Zbot
Invincea heuristic
Jiangmin Trojan/Bublik.gex
K7AntiVirus Trojan ( 0001140e1 )
K7GW Trojan ( 0001140e1 )
Kaspersky Trojan.Win32.Bublik.bkdm
Lionic Trojan.Win32.Generic.lNlt
MAX malware (ai score=83)
MaxSecure Trojan.Upatre.Gen
McAfee Downloader-FWH!D63E6E2AE3E1
McAfee-GW-Edition BehavesLike.Win32.PWSZbot.ch
MicroWorld-eScan Trojan.GenericKD.1393477
Microsoft TrojanDownloader:Win32/Upatre.E
NANO-Antivirus Trojan.Win32.Bublik.coezmj
Panda Generic Malware
Qihoo-360 HEUR/QVM20.1.4389.Malware.Gen
Rising Downloader.Small!8.B41 (TFE:dGZlOgV1ZPjVnIwWhA)
Sangfor Malware
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-11-11 22:50:45

PE Imphash

93f3c3f7fa917eec6b457a216663e185

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00000e7a 0x00001000 6.627736516392026
.rdata 0x00002000 0x00000454 0x00000600 4.661152375082767
.data 0x00003000 0x000000d0 0x00000200 3.0215210660042207
.rsrc 0x00004000 0x00001f10 0x00002000 5.210524071213055

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00004250 0x00001ca8 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x00005ef8 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_MANIFEST 0x000040f0 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library USER32.dll:
0x402038 GetMessageA
0x40203c PostQuitMessage
0x402040 DispatchMessageA
0x402044 UpdateWindow
0x402048 LoadCursorW
0x40204c TranslateMessage
0x402050 LoadBitmapA
0x402054 CreateWindowExA
0x402058 RegisterClassExA
0x40205c DefWindowProcA
0x402060 MessageBoxA
0x402064 SendMessageA
0x402068 LoadIconA
0x40206c PostMessageA
0x402070 GetClassLongW
0x402074 SetWindowTextW
0x402078 ShowWindow
0x40207c GetKeyboardState
Library KERNEL32.dll:
0x402008 GetProcessHeap
0x40200c GetModuleHandleA
0x402010 HeapCreate
0x402014 HeapFree
0x402018 DeleteFileW
0x40201c CreateFileW
0x402020 HeapReAlloc
0x402024 SetFilePointer
0x402028 WriteFile
0x40202c ReadFile
0x402030 HeapAlloc
Library GDI32.dll:
0x402000 GetStockObject

L!This program cannot be run in DOS mode.
R:)RSR
RRichR
`.rdata
@.data
USER32.dll
NTDLL.DLL
KERNEL32.dll
GDI32.dll
C/3u+GXMl
h@@E@ 30 33Eh3@
0@hjj 3@ 3 @ E
3@3hhj@@@
@j 00 Eh E@3@ jj0
@h hULV5h @
WWPWWh
t*=L @
3E jE3Eh3@@@@
0 jEhjj
00h0hj@ hEE
h3jjEE@hE
E3@@3j3jEhh
EE0h3Ej j3@hE@E3hE
VWAAf9
uE@ME;ve
E;EsN$
jj@E 03@ 3@@0 hj@ 0jEh0 0
3jE@ 3@3 @@E0jEh
hhj00@@E
E0j @3E0@ j0h3hh
FG3@_^]
j hE@j0j0j0
0E0E3030j0
@3j0 @jhj @
333h0E
jh@0E3j3
0@E@E
NLLl|S
o1NA4+"
Yu<!lmE
N)4~Bq7
y1L^"+"
C"BVul3= <u`*
&NG3B"X
t[iZ1FG3B"
ZChV6^569
b J@u*.1#
q[ c7JA
|6J@"+)=?
NR&}7F\"+3(
=?%r` c7JA
B(e-bH
/3usKXM
C/kG/G
qaWk,)/A
H!WIltI
CE3+2
w?Xsvr#A
wy04tnM_bi
CE0*GX
f,3n!-
QHSgy>y
u+-2Mn
[Mrw7o$
eXKE3}
o;<5wi
8"[.?[)/[w+-8
nUeC-3#22]
w4?e.3neEEl
y-XMo5%H
fnqJYM
~XM=KaXWvB
0tDXM:pgo,
@_='Xo
+Bhj0O-
"9e/3)-0Ml
l>QH_a
pc%}tCXM}aS
+",blm[
rZFd.NT
},F][Hi6M
zRFa,H\
# @^ZB&=>
HC17jH].
A53&JV@3 33
30 3@ 3 h
h3Ej
3@hEhh3jj33 j3 @3@ hj
0hE hj
j @3 0
h h@j@ hj 3
h3 @ @EE@j3j0@EEhj
h@h 0E0jhE03WSSQ
Iu[[_[+S3EjjhhE@@h3 E00j@3j@30j@E
jEjh330@ 3j30j033
EjE 0 3 h3
3 j300h @0
00 3j
hhj00 E@
}}<?}$}
{}}{}Y5}}
x}|}.}}c*}
}.a}};}} }
static
delivery
button
Gendalf
EH#BM94
X+"B/c]
U44T(C
W"MD:YbY
(:Ia4?a*
GetKeyboardState
GetClassLongW
SetWindowTextW
PostMessageA
LoadIconA
SendMessageA
MessageBoxA
DefWindowProcA
RegisterClassExA
CreateWindowExA
LoadBitmapA
TranslateMessage
LoadCursorW
DispatchMessageA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
ReadFile
WriteFile
SetFilePointer
HeapReAlloc
CreateFileW
DeleteFileW
HeapFree
HeapCreate
GetModuleHandleA
GetProcessHeap
HeapAlloc
KERNEL32.dll
GetStockObject
GDI32.dll
[T[)GA6OH"\
ZDGBT($
BKc4K`+=GO)#]#
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
F;,{s
LB/#PD
;1TLxr
C9$!lc
F=_We]
-#<50-
kVPVOUOUNUOUOUNUOVOUOVOVOUOVOVP\U_XXQUOVP[UD@
I?qj.#
G<4(kb
xxxtttttt
ODj_j_[P
MCVK/!,
------#
j_WLB6
.,--,
-/ / / / / / %
PCbW`TI<
0!/ / .3%
/ 1"1"1"1"1"1"0 4%K>REF91!6(K>PC>0/ / 9+M@THH:2#0!1"1"1"0!5'
1"1!1!1!1!1!1!4$2"+
3#4$0 +
3#3#3#3#3#2#7(!
4$F8F8F8F8F8F8>.@1A2B3B3A2A2B3B3B3A3A2B3B3B3B3A2A2A2A2A2@1H9!
L!This program cannot be run in DOS mode.
}&9H9H9H
;HBD8HjQ;Ho[
H9HcH[[.H9I
N8HRich9H
`.rdata
@.data
U_^]3[
VL|$ iGa+
|$ W~T
]_^]3[
D$ Vt$ W
t$$D$(3
5y7_^][
Q3SUl$
t$ VPSm
A;|_^][Y
QVWhHF
D$8L$0
T$HD$D\$<L$,WRPSQVT$0hQF
D$@L$h@
T$D4L$
<(gT$DD$,Rj
PVL$(hPF
T$8L$`B
T$<,L$
][_^L$
L$DD$8
L$,D$8
L$(D$8
T$HQRj
T$HQR1
T$@j=j
L$ D$8
T$(VRD$D
D$ j j
D$ RPz
L$ D$4
L$$D$4
L$(D$4
L$@D$4
_^]3[L$
L$ D$4
L$$D$4
L$(D$4
L$@D$4
L$,_^][d
L$(D$8
L$$D$8
L$DD$8
L$ D$8
T$@j=j
D$(j j
L$,PQm
D$(RPZ
L$@D$4
L$ D$4
L$$D$4
L$(D$4$
_^]3[L$
L$@D$4
L$ D$4
L$$D$4
L$(D$4
L$,_^][d
D$ PD$
D$(N@L$,V<T$4F$D$0N(L$ FD
V,F0D$
u#N@F8QN
3|$!\$ V8N@fQRD$(htSF
3ISQL$(Q
PT$ QRD$,hdSF
SV3W9^D
^H_^3d
S\$4VW
d$ hSF
d$(hSF
D$HT$LSL$ PQRD$P
T$ fD$$3N
PD<$PR
u,D$<t\P
3~I\$<N
F0F4u2j
F4F8u;j
PD$$T$
t$$t$
QSUVWD$@33;D$
t$0SD$
t$0SL$
VQUaD$$
D$0t$,3
PU5t$0
T$<PD$
d$LPD$<
d$`RD$@
PD$$T$
D$$t$
3|$a\$`f3\$
fD$)D$
uH;~8Vt$ `F
PWNhTZF
fArpfZwj
QSUVh^F
D$$RPS
PVL$$T$lQRD$,P
\$<\$@T$D
\$LD$P^F
D$HD$,P
SST$\SR
t*=d%E
L$XQSST$`SR
QSUVWt$
L$$T$(N4RD$
D$,L$0?U
R trhP
|$$;D$
F0F4u2j
F4F8u;j
PSR8D$
_^]3[d
SU-D&E
PL$(SQRn
D$ _^][
VS_^][
QSVWt$
D$ L$$3hP
|$ ;D$
|$4T$0@
|$uD$(T$tfT$
T$$RT$$=D#E
3|$0D$
D$lD$pD$th
D$0RPj
T$0QL$0Rj
PQD$d(_F
;yuNU(
L$0PQj
_^]3[h
QSV3W98
QSRVD$$
S\$$UV
d$ hSF
d$(hSF
D$<SL$DPQUD$D
pD$03~ N
D$0;|t
JlBp;t691t
QSUVWt$
L$$T$(N4RD$
SQP(hP
|$$;D$
SVWF(u
ST$ QRD$$
S\$0UVW
d$ hSF
d$(hSF
D$HSL$PPQUD$P ~8V$3
QSW@SS
PD<DPR
~8N$\$$\$ D$$
PSWBSS
D$<3;~N$+SP
D$<;|;t
L$(_^]d
|$ wv$(c@
|$0|$4Bhh
t*D$(L$$PQQT$
3|$<T$$
T$(D$$L$<T$,PQRRRRRRT$PRT$4D$`D
;sPL$$4V
T$$QR$
;sPL$$4V
T$$QR$
L$44V`
SUVW\$,D$+3
3|$4D$
3;t4L$
T$8t$$L$,RV
SUVL$$W3
3|$0\$,D$
\$ \$$@
3|$,+T$,T$0
S\$$UVWS
d$ hSF
d$(hSF
D$<SL$DPQUD$D"
RT<8RP
pD$03~ N$+j
D$0;|t
;uv l$$T$(RV
HD$$ut$
;t$D$ D$ VPa
;L$ u{
;t(D$ D$ WP
;L$ uL$
t$ +l$$;t$D$ WP
;T$ uL$
T$ L$$
|$(t9+
L$$|$(
l$(t t
+;t4L$$t
L$ ;ut$
tWHu]D$
SUVWL$
;|$(tC3t$
S\$$UVW
d$ hSF
d$(hSF
D$<SL$DPQUD$Dl
RT<8RP
pD$03~ N$+j
D$0;|t
D$ ~(F$~,~0L$ ~8N4~<~@
D$ PD$
WWhD_F
~8~<~@F(PD$
~(~,~0D$
QSUVW333C(;t~K,+
;sdK(L1
C(,0G4{3C8;t:K<+
k,S(;t
4;uK,S,S<L$
;uS<_^K<]T$
QSUVWT
8SUVWl$
93to4;u
m,C4;t
4;ut$LD$
L$LH,jD$
m,C4;t
4;ut$LD$
d$ P$P
SUVW3h_F
L$0\$(3w
D$,j^SL$
T$,j^j
SRV\$,
L$,D$$
L$,D$$
L$,D$$R
_^]3[d
SVWhHF
j^D$,SL$
j^T$,j
D$ SRP
SUVWL$T3h_F
UD$DUL$dPT$,QRT$0D$lUL$<PQUU3URt$H
D$ ;tG
T$@L$\fB
PQL$(T$@j
D$$;t?
@|$eD$H3D$d
3fVVVL$TVT$tD$,QRUP
PT$TQR
L$(Qh?
uTVL$<VT$DQD$PRPD$<L$`VT$DQRVVVPt$\t$|t$tt$lt$h
S\$$UVW
d$ hSF
d$(hSF
D$<SL$DPQUD$D
RT<8RP
pD$03~ N$+j
D$0;|t
D$$3hP
FH^$^(P
|$$;D$
QSVWC(u
C(tC0P!
s<3tF3
|C<UPJ
t'K0t$
{D_^3[Y
S\$$UVWS>
d$ hSF
d$(hSF
D$<SL$DPQUD$D
RT<8RP
D$03~ N$+j
D$0;|t
|$\3;uCD$`t$
|$ L$$T$
L$(\$T
T$<D$8
++PQL$DD$\
T$ t$<+
#SSPQL$@RSSQ
L$(\$T
L$8D$T
L$(\$Tr
L$8D$T}
L$L_^][d
SUVWt$ 3
|$(L$$h
QM`D$,
\$ \$$\$(
;tQP+%
FL;rSf$
pSUV3WU
SWUUV$
T$PPUUR
3|$dfD$Z|$PfD$n
fD$4BMD$t
T$6L$6T$:T$>D$>6
D$pD$4P
Uj(L$xj
L$HT$`,D$Xj
PD$(P~
L$ D$x
SUVWhHF
N4PQT$
D$$RP]
L$ D$,
F$F<F,D$,
L$$_^]3[d
+SU33V
3|$$D$ h
SUVWL$
;|$(tC3t$
S\$$UVW
d$ hSF
d$(hSF
D$<SL$DPQUD$D\
RT<8RP
pD$03~ N$+j
D$0;|t
D$`3|$ah
fL$dD$ D
RPD$P(_F
D$ PD$
M0jxQQ
U0jyR3
E0Hduehp
AdU0Jd
3|$(D$$
+T$8hP
RHdT$<Qj
t$ D$,N0
V0ONZd$s
4;uD$$PW
T$$RV>
t$$;uIVV
;uU4;t
t$$;uC
4D$ H0
3|$\T$Xh
t SWQT$
SUVWhHF
T$ RK
L$ hDkF
D$@P5#
L$DhHF
L$,3\$4D$8D$<D$@xF
RPD$<QPn#
L$DT$4jdQR
D$DL$ P|d
d$ hSF
d$(hSF
D$@L$<PT$ QRWD$D]mT$, 3v^K
;ru93L$
SSSSPQ
d$(R}^
44;u_^[
VWPjft$
Nh~l~p~t
^l^p^tD$
D$$3|$%3fL$$
D$ PL$
SWVL$
SV3WSe
3|$ T$,
L$ Q=[C(K
EpMhRj
3|$ T$,
L$ QZs(K
3|$ T$,
L$ Q1Zs(K
3|$ T$,
L$ QYs(K
3|$ T$,
L$ QKYs(K
3|$ T$${(L$(QRVD$(
|$ uD$ G0D$$G4L$(O8T$ R
3T$,+h
L$ Q|Xt$
3|$ T$,
L$ Q+Xs(K
3|$ T$,
F(t]N,+
;sCV(D$
tTmdS0E(L
d$(P9M
REuP=P
3Flt)Np+
SUVWl$ |$
\$ D$$
PD$(QI
HtBHt!Hu(F
luQVt$ VhkF
SUVW3hHF
3|$-\$,f@
;v%Pj@
>T$(-$ E
D$ RPL$$SQSWSD$D
\$8\$<
s0L$ ;v(
w T$(D$ R$4
PT$$QD$8RPWS;t
L$,QL$
SUVWhHF
L$ RR@
D$ RPC?
T$(3T$,D$<T$0T$
RL$X\$4\$HD$T
|$8t$$3t
|$8t$$3t
T$$D$(
L$$T$(
;uD$ UPSh
SVWhHF
T$ QR7
L$(RL$0h
D$$ucL$
VWD$dhp[F
L$dhlF
D$$L$"T$ %
QL$"RT$$%
D$$L$"T$ %
PD$"QL$"
D$$L$"T$ %
QL$"RT$$%
L$4t$,
;u`QQP
t$4L$8QV
L$<D$<(
|$`+hHF
j(PVD$ (
L$ V$t
D$<PSe
j\L$ $
L$|D$$H,E
D$|D,E
L$0SQL$4
T$$@,E
D$$hlF
L$$PQ-
T$$PR2-
D$x;t!PC
SL$0^"
SSSSL$ *
T$$L$|L$ B
D$|D,E
jL$$D$|D$ Q
WWD$4U
|$,|$$|$8
QD$$RPL$Hj$Qj
RL$$PQWUj
j0Vl$H
t0D$8PWVj
tNT$4Rh
+T$`$d
@$;D$$
SUVWh?
tkD$(UVh
VS^]L$(W!
VW^[L$
SVW3eu}0
y4t9L$
QSUVW|$
QSUVt$
C 8tIK0
pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp
999999999994
Ebcrr<<<<<<
Fr9:a9
F$345'BBu@P
99999:;Y
t pppp/
#]h9::d:n
0d:::::::::::::::::::::d::@<::::::::
5[7799
}0rat0
}txttt?
C:\Users\Joyce\AppData\Local\Temp\Rar$EX00.981\payment-history-n9998765-34543-4345.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GicgsuMeN.exe
C:\4669f91b44ff99e020f8351b951c618bfb194350c140ceb4ea2632959b6ea536
C:\zo97tMHZ.exe
C:\VYOaT1O7.exe
C:\gKWEe5lS.exe
C:\awABLbVu.exe
C:\MnrO7wtE.exe
C:\iT9Qc4pF.exe
C:\JA95PFon.exe
C:\ttkYOiDU.exe
C:\QW5AMO8j.exe
C:\gohF9b21.exe
C:\VWKSE4m2.exe
C:\qhBisk1j.exe
C:\71XfYGC_.exe
C:\__nGO8mm.exe
C:\I_kK_BcV.exe
C:\tmTbYkqy.exe
C:\wO5AY5UW.exe
C:\TOIqWfB7.exe
C:\Kvf0Q96m.exe
C:\46xin7CG.exe
C:\iupkb_Zo.exe
C:\0Nuysqyr.exe
C:\pewgscvC.exe
C:\a361c8763be3447f03a1b70bf4cdf693e06e3781fee947e11d4a38f6f51a56e3
C:\c7378e85a7066d74eaf445a117d30cc960463e12b07776258a0d79a72bd151fb
C:\H_nZzHo0.exe
C:\b50TnqRJ.exe
C:\IqqFSRd0.exe
C:\70oGJxIx.exe
C:\Lqk5BxsO.exe
C:\iQJ5DM7e.exe
C:\I7HliR0t.exe
C:\N12jtwn_.exe
C:\z2gDGGWS.exe
C:\UxtfbEoI.exe
C:\GlTGBkDV.exe
C:\ZRVOODxD.exe
C:\TF7zc6Xu.exe
C:\TUWbI0p5.exe
C:\opGrIauW.exe
C:\SgHDfyxl.exe
C:\tZxY3RIZ.exe
C:\urI4oNcN.exe
C:\gova7olf.exe
C:\d5O2eN5l.exe
C:\udWVV5qz.exe
C:\vHtZxNqw.exe
C:\w9yReX5e.exe
C:\OIObaliV.exe
C:\YHzZ7fvX.exe
C:\bvGpoz0f.exe
C:\7q8Oq2sa.exe
C:\_uc3z1GL.exe
C:\p9BVMfyT.exe
C:\sBkFSofM.exe
C:\UpefugUU.exe
C:\AFeh160s.exe
C:\c5KUBMtz.exe
C:\0OWxyicD.exe
C:\U7PvWy1_.exe
C:\x7XvLD9m.exe
C:\nrP7Ag1x.exe
C:\CXDIznkW.exe
C:\9Cykw1kR.exe
C:\3de41cdace54a39630551c53dba1e78eee4d5b7471a22265a7373e372c8d8790
C:\PUlVpxd5.exe
C:\wOwbFlPr.exe
C:\kd4olWEJ.exe
C:\dfuo9kPF.exe
C:\tAL76e6x.exe
C:\94VVOY1l.exe
C:\PkK3bXsk.exe
C:\v2YSD5An.exe
C:\i6_Ie8x3.exe
C:\W5fASfHW.exe
C:\ryhDkFpH.exe
C:\1cFcR_5b.exe
C:\44zhTo3j.exe
C:\oE2mDLKM.exe
C:\Pg0eBYHA.exe
C:\zJNahAu_.exe
C:\wi8EWDK0.exe
C:\avqEYtUE.exe
C:\amBbQRlA.exe
C:\yh5H7Tt5.exe
C:\TLcghw15.exe
C:\erS2muGb.exe
C:\QzuVeTOE.exe
C:\LssslDkw.exe
C:\GXfu4iDn.exe
C:\BH_9auJc.exe
C:\HrvmJeDl.exe
C:\O6JtM52R.exe
C:\41fbddc1a143579cf93d7d712c46a3fbcff2e2802821dfc2e84d1f6a14a5fb3a
C:\072cc8ec01aefaff133ed16b6b1747725e2345543fad4036808a284fff26333d
jjjjjjj
C:\a7c4841b01368d384b6ccdf8cc3e395e4e822070a633bf0b530a3b633db5cac8
C:\06688e18bd477634e026a1389577f7cb2e3b35431cd184a1ac26a7ac0c66ec03
C:\ec1cbcad5493154aa45d58ca8ad4e4fabcd19177bf742304a70bbc5f0f9c8881
C:\eWfUlCsE.exe
c:\25xmvk\qi3gks.exe
C:\9de3b442b087fb1be1de8240bc144c6e18048b3b0729cc154805285294b40b9c
c:\lvyjak\jkv6p5.exe
C:\K3fG7ojO.exe
C:\XMDPhtJ_.exe
C:\ead4d9987ca109f57c45ae62ad789754887d725953753ef7fd9ec4f83be4aa17
C:\022715a9f1af378c993a1d3be8ca11ee48476ba89cbc161f9a59198e873edc41
C:\45b315212e1adc587d91fb6de9f45d1f541811bba5173dae9437188e2c7ff4d3
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\f42de80563fcd9a6c2ff72e9eccc6f7c2914f11bc02c078c5070cb761678d940
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\fe8306534f2b66bb6f07932c9b2d80dbac8f2bbff54758ec445a2eda6c5a183c
C:\Users\admin\Downloads\huro.exe
C:\2093769a89afd069f4cf69a66abaf65548967c59e6e2f617f54845cde6f670c7
C:\bb147c11fe1ce6bf761c8bb7aa0b53493ee97d489d498d1d4bc8f34c928bfe73
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\admin\Downloads\18d71a03fc4336a1_huro.exe
C:\ba944e6069e22682e959b8307f2afb8bcfd88cf415d8fa30b977ff18b78c55ce
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\admin\Downloads\d431191072492560_huro.exe
C:\a500fc9a50b9fce1a5009862211765330b596c16c35e8d37fb2cd913fdd785ea
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\admin\Downloads\6daa9783226f5564_huro.exe
C:\69d483e6661f578b0d9e1f53e44021e7c51ecb163905387e6a0332805b44bac7
C:\Users\admin\Downloads\huro.exe
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\eec3de097a33c87f963cd9baecf3a585c40ea5b231206d04899098aea1cb6844
C:\6bad02cc50249d931093236f998218a27d8afcc08f47626a4726875adc630086
C:\46547de5dd0cfb8a05e6bf36e7fc236f3181fe6473e42d26af279f788f5bc039
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\admin\Downloads\c70e58c61c0d4786_huro.exe
C:\436609cc55774f41eb0fb1582c5af84167c21a48cc7b2542ac015f0e211bb50b
C:\a3f1a82ebd0889e7258e9d1e400d933bc71fcfe3e18f923e03c28bd69819f557
C:\aa897fba633ab029ba690374fca9b5540cab92b744e88e85c62010661e3385bc
C:\141ad07b81702e77beb192f73d1bf2ff9d865ac240c1e1ca0dfe709034477aea
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\admin\Downloads\7c89a78ba3f6997d_huro.exe
C:\7a3fd751c65983ff86b77292e15e12618f80df3d54d3711ac837f9e1c1ea77d2
C:\Users\admin\Downloads\huro.exe
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\947b7e62c76f6e562470c5ded730effaf3e28876e19d8c4029a88f723188d31a
C:\Users\admin\Downloads\huro.exe
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\077703864933cc0148cf4a38ea0064c1496fcc31e9fa01aba5c2f5b42ef91677
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\admin\Downloads\e0d011526c91d947_huro.exe
C:\0aa834f3726d277c1b03f1b42f7bfe5c048c3dc82d1b5a757dfa945fe114418c
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\admin\Downloads\fac2f1e5ce01fb0f_huro.exe
C:\e8b9b2475eb7671fcfcf7e7ff1f6e7a5876b01baff96ae507fb7f0d072895aab
C:\cf523e9d1e8bd3678a5ac565d7c7131fc9ea6c9f1463bb69659f0eef4235b1cc
C:\Users\admin\Downloads\huro.exe
C:\353063cf01a72129f4b38bee0cb33ac90f163ad473546bf6d642509fd628fd41
C:\Users\admin\Downloads\huro.exe
C:\3C9q_UKD.exe
C:\fdd773244125a81630abb6f46ede1bcfc4397cc762b741d180c5ef9c8d4ad8c8
C:\26893d707855a099606142ee128ce8314307221f9fca4be3941d89abd32c14c4
C:\Users\admin\Downloads\huro.exe
C:\1ceef89d7bfc8a894704495814ace165e4068c5164db6d69c52ee7fe0a3fbba9
C:\a2cbc0806aef7e299bf3fcefeb11915e77d09e3044e0b3896ae31258ab355bdc
C:\f24953dcd32ee727d01c7611261c2b395626bc0b102dc7075fb5ef94d6438f6a
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\785a9f598dbf83deb0dfa7de1a6506646e96d84c3ff7b5f10e830ef5acd80155
C:\351ad7956a32369a0f22852ac2d9d39bcaf4fab8227b3701cb036847b9c422ae
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\admin\Downloads\d4762c2f4a7daf61_huro.exe
C:\be5ff0580ecca8aa3662c9eed9c6bf485760f4a0741e551313c71f2e4537b4ac
C:\6d429868c541333337e773f6a242aa8ccec7246e93d085782475814d5e585e6b
C:\Users\admin\Downloads\huro.exe
C:\c0faa7db387fa4ae4c2928fcfa8e5ebc9dc8b000b5ccf08fa4ca2357217aa3fa
C:\bcc865c3b17f9bdc7e37d9abb8a313e7344b329e7e8165d60be86f79273d8e23
C:\Users\admin\Downloads\huro.exe
C:\xambjcxs.exe
C:\Users\Virtual\AppData\Local\Temp\49f02a00fb378c6d8e1364a93d873f1024d247068011e00bae33b32dc25db33e.exe
C:\b06480a4590bc9aeec105c1e7ebc868a21e6cf7c8759b4060a04a676c7a4bf8d
C:\653024dd1d989f8f26d107f235abd5ec39d7fb1fc6977129e598385b776b4aed
C:\Users\admin\Downloads\huro.exe
C:\72579f072a79b6adba4cafdc599a72c1e7b52bf833bae80585901ab25fbc2662
C:\Users\admin\Downloads\huro.exe
C:\426387e0b040d958397fbd96aefa49a80963ff999cd3eae5fd3f0353a11ef742
C:\eab4901658b146df9e86ea772d74cf9ce52fe5b57c070659b7ca4c98d7ee01bd
C:\Users\admin\Downloads\huro.exe
C:\2c40e2cf5fd5b4eadb8d773caa1e41d87bf942db48786435a24187826419e65d
C:\Users\admin\Downloads\huro.exe
C:\Users\Virtual\AppData\Local\Temp\f34709c3dfd4107910704fb9c1bbafb121eb33452e449c6e3542365bc69345d8.exe
C:\Users\admin\Downloads\huro.exe
C:\5fffd7df829dc98f581ae7ebe7ca4ee21c09c27c4fb1a5ed48f491e98734493a
C:\Users\admin\Downloads\huro.exe
C:\398b79bbe1db292ff1d536513dad983af3ca43cd46a3c3960db430aafb279a9c
C:\Users\admin\Downloads\huro.exe
C:\0f0d35f7345f0bc022a3713ad93ee79d36526999ae235578d353b7d0d3ad027b
C:\70e7f45f4a4a1e17b49906ec899184958ef6fea5cc84c89d665d99c85425ea70
C:\5bf1c2a328ef5e78cff2a609a7a2e0e782744e0f90911eeb9f516d16f49998c1
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\6242d38b479e60891e12fac6f2feea6ffb0f8db753985f9a7607fdbbeeac562d
C:\07383be238db929194740b8dcc89a12b4e1016ac22fa15ae539e810f9e691cfe
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\a72d23e0f3325cb4e7427c23bcb3a55808042a81dcdd0fed64ed641334946eea
C:\9f74762df3a600876e26f6fc1b0de890ca21d2fb8b9a348db2f612eac3bdf17e
C:\Users\admin\Downloads\huro.exe
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\Users\admin\Downloads\bea26e9711368d0f_huro.exe
C:\8219db68c296171a44d21911430a2c508524786e010209379275769c7f72d755
C:\Users\admin\Downloads\huro.exe
C:\0e627ed6e99f5242513f6abd8c303eeb76fdf70cbc249bd4eedc4b4c93a73cf4
C:\Users\Petra\AppData\Local\Temp\huro.pe32
C:\a49a060e47180791e5db79d2094e28b9f4b236ffc6b92282b26506a708f9231c
C:\7d4d99b79e3c43e66bbcb06fed155fdde351c9bef48cfd6cc921a43b1da70dee
C:\GdBe7jQE.exe

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.