0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.66
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20200109 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200109 | 2013.8.14.323 |
| McAfee | Downloader-FWW!E61D1DC384EE | 20200109 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0785c | 20200109 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.GenericKD.1627005 |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1627005 |
| AhnLab-V3 | Trojan/Win32.Zbot.R103153 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Generic.D18D37D |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | TR/Crypt.XPACK.64093 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.GenericKD.1627005 |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDownloader.Upatre.A4 |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.Bublik.CEZE@595kvx |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.384ee0 |
| Cylance | Unsafe |
| Cyren | W32/Trojan.MNWL-4927 |
| DrWeb | Trojan.DownLoader9.53364 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.GenericKD.1627005 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.HYA |
| F-Secure | Trojan:W32/Zbot.BBKM |
| FireEye | Generic.mg.e61d1dc384ee084b |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.GenericKD.1627005 |
| Ikarus | Trojan-Spy.Agent |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.azsev |
| K7AntiVirus | Trojan-Downloader ( 0055c6c71 ) |
| K7GW | Trojan-Downloader ( 0048f6391 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=82) |
| Malwarebytes | Trojan.Email.FakeDoc |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FWW!E61D1DC384EE |
| McAfee-GW-Edition | BehavesLike.Win32.Downloader.nm |
| MicroWorld-eScan | Trojan.GenericKD.1627005 |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.Waski.cwabgb |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM20.1.71F7.Malware.Gen |
| Rising | Downloader.Waski!8.184 (TFE:dGZlOgI2YoXD2PsFow) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Upatre-AN |
| Symantec | Downloader.Upatre |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2003-10-16 10:32:51
PE Imphash
3bf52cce958af28c47ecfbb6d0a01caa
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000871 | 0x00000a00 | 5.1970491195442765 |
| .rdata | 0x00002000 | 0x00000d0c | 0x00000e00 | 6.744979989223934 |
| .data | 0x00003000 | 0x0000010c | 0x00000200 | 2.1289171733483006 |
| .rsrc | 0x00004000 | 0x000027f8 | 0x00002800 | 4.582705204755165 |
| .reloc | 0x00007000 | 0x000000e8 | 0x00000200 | 2.0861688023565215 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00004238 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x000067e0 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000040f0 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x402018 GetWindowTextW
• 0x40201c SetCapture
• 0x402020 GetActiveWindow
• 0x402024 IsChild
• 0x402028 SendMessageA
• 0x40202c MessageBoxA
• 0x402030 TrackPopupMenu
• 0x402034 CreateWindowExA
• 0x402038 TranslateMessage
• 0x40203c DispatchMessageA
• 0x402040 GetMessageA
• 0x402044 PostQuitMessage
• 0x402048 ShowWindow
• 0x40204c FlashWindowEx
• 0x402050 GetKeyState
• 0x402054 TranslateAcceleratorA
• 0x402058 RegisterClassA
• 0x40205c DefWindowProcA
• 0x402060 GetDlgItemTextA
Library KERNEL32.dll:
• 0x402000 GetProcessHeap
• 0x402004 GetModuleHandleA
• 0x402008 CloseHandle
• 0x40200c GetVersionExA
• 0x402010 ExitProcess
L!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
GKj 0$
PIuTE0
3PPPUR
t+58 @
MQ3PPPUR
3 jjuu
u$@Ph@
P0 E$g
uSAWVAf9
GEGEGMG;r
ET@UV3W}
FG3@_^]
E3T$$3
0VWSSu
X+PQ&YIuKXG[O_^
uHjhTR
SUl$(3VWD$
PL$4j%D$4PL$
bad allocation
x10Y( 9
i?$](j
D9 ?(nWv
KIP;?CU:9%4
_KIP;?CU:=%4
/gK!74
us*5=U:U
^&u+yf5
>\jI>,L
4]2RMEm6
PPV\I';
>4jK#L\Q
>(/:C\
sr)1Y)
#}y<\OL{
)N/4m~d
b:`7gOo
s?/W:qVs
"r=yO/W
`w{G;l^jK.F
}W}vvO'
d1I;?#85?
8]2f674<\
<\b:n g9|jKPCN
<\I':,u^u
tdiminutiveness
.XR}v:Ou)f
'GBDA-=QSq
GetDlgItemTextA
RegisterClassA
TranslateAcceleratorA
GetKeyState
FlashWindowEx
TrackPopupMenu
GetWindowTextW
SetCapture
GetActiveWindow
IsChild
SendMessageA
MessageBoxA
DefWindowProcA
CreateWindowExA
TranslateMessage
DispatchMessageA
GetMessageA
PostQuitMessage
ShowWindow
USER32.dll
GetVersionExA
CloseHandle
GetModuleHandleA
GetProcessHeap
ExitProcess
KERNEL32.dll
lantitude
tofkol
wookernof
button
aaaaaaaaaa
ccccccccccccccccc
static
5A)82O1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>(
|||}}}
/ / / / / / / / =./ / / / / i\/ / / / / / / +
0 0 0 0 0 0 0 0 0 H=0 0 [N0 0 0 0 0 0 0 0 0 0 0 0 -
/ 1!1!1!1!1!1!1!1!I=1!I=1!1!/ / 0!1!1!1!1!1!1!1!/
1!3"3"3"3"3"3"3"3"{3"]R3"3"j_3"3"3"3"3"3"3"1!
3"4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#3"
5$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$5$
6%OCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOC6%6%6%
c2h2o2{2222222222222
3$3X3b333333333333
4&4+424<4B4N4Z4`444445!6-6666v7
\0`0d0h0l0p0t0x0|00
L h t t p : / / n o t e p a d - p l u s - p l u s . o r g /
h t t p : / / n o t e p a d - p l u s - p l u s . o r g / c o n t r i b u t o r s
T h i s p r o g r a m i s f r e e s o f t w a r e ; y o u c a n r e d i s t r i b u t e i t a n d / o r m o d i f y i t u n d e r t h e t e r m s o f t h e G N U G e n e r a l P u b l i c L i c e n s e a s p u b l i s h e d b y t h e F r e e S o f t w a r e F o u n d a t i o n ;
e n e r a l P u b l i c L i c e n s e a l o n g w i t h
C : \ U s e r s \ F i r e b i r d \ A p p D a t a \ L o c a l \ T e m p \ T e m p 1 _ C B E _ F o r m . z i p \ C B E _ F o r m . s c r
C : \ 4 f f e 0 4 d f 1 8 b 9 4 5 e d 3 0 1 7 7 4 6 3 b 5 5 4 b e 7 0 a 2 c 5 4 c 2 6 3 2 8 8 c 7 4 6 2 e e 5 e 7 0 6 c 8 f 2 4 c 0 c
C : \ N U V i p h M N . e x e
C : \ g x b y Q b o 9 . e x e
C : \ j u 8 Z 9 b d 1 . e x e
C : \ x u C k p C w N . e x e
C : \ x H K 8 Z f h 5 . e x e
C : \ 2 H n u k b e 7 . e x e
C : \ 0 W L z L u D h . e x e
C : \ 7 y 9 7 k e 9 5 . e x e
C : \ F G V I u Y A e . e x e
C : \ c 2 A 3 I n t g . e x e
C : \ n 2 e u 4 j f t . e x e
C : \ 4 5 f I O v Y Q . e x e
C : \ L Q j h f c d Q . e x e
C : \ o p Y 9 D k E K . e x e
C : \ T U A F e a 3 J . e x e
C : \ 2 2 v C 7 z q 5 . e x e
C : \ E E V T f V X 0 . e x e
C : \ 1 q J E 3 N K v . e x e
C : \ j T d z I G u d . e x e
C : \ B P P X c Y f W . e x e
C : \ 4 z M n F d W N . e x e
C : \ v v g Q X 6 f 4 . e x e
C : \ 7 l 7 t v 7 A z . e x e
C : \ 5 7 c e e f d 1 a 4 f 3 3 f 8 4 d 3 b 5 e 4 c c c c 8 e c 8 2 e 2 b e c c 9 2 6 b f f 5 2 c 8 d c c 2 0 d c b b 8 6 5 2 b 4 d d
C : \ U f l i 3 Z O L . e x e
C : \ a B I Z k U H N . e x e
C : \ E J W 2 w _ i 2 . e x e
C : \ s r j Z b y T c . e x e
C : \ r Y Z J 1 Y d K . e x e
C : \ F Q x E 0 J p B . e x e
C : \ t t 8 8 f h X w . e x e
C : \ q a z T 5 1 C R . e x e
C : \ 1 c 1 b 2 8 6 a 1 6 8 2 1 9 3 5 8 8 8 a 8 6 b e 9 1 2 9 c 8 c 2 a f 1 b 9 5 9 a 3 f 3 d 5 1 3 0 3 4 d 5 f f f b d 0 a c 3 d 3 8
C : \ 9 c e f 8 0 2 6 c c b 7 0 5 7 c 6 3 8 7 8 a 5 4 b 2 8 3 9 0 0 f 2 6 6 3 d 5 c 2 a e 0 3 f 3 c 8 9 c 9 f a b 7 7 3 1 1 7 f 4 5 6
C : \ c 8 d b c 0 7 7 d d 5 a 1 9 2 0 6 4 f 6 0 6 4 e 3 f 2 c 7 3 0 1 f c a d b f 8 0 3 2 0 8 e 9 c c 2 0 2 9 1 8 6 a 0 5 a 1 e 4 7 7
C : \ 0 b 2 5 9 e 2 3 6 5 4 9 8 4 4 f 2 f 3 c 5 5 4 0 4 e d a 3 d 5 d f 8 4 e 1 9 8 d 8 5 0 b 0 d 6 c b 8 b 8 c b e 5 7 9 4 4 a 8 9 0
C : \ B x s r _ L d y . e x e
C : \ r Z U 1 6 P N R . e x e
C : \ t r _ X 6 v P t . e x e
C : \ W m X O 5 h T J . e x e
C : \ x v 2 f h Z 5 1 . e x e
C : \ S K b f b n S E . e x e
C : \ k 2 9 E e 7 R 9 . e x e
C : \ j f Q l q T O g . e x e
C : \ s 4 P 8 m f x I . e x e
C : \ 7 y Y n 1 0 2 K . e x e
C : \ h t _ A d A 6 t . e x e
C : \ o P I b O r 3 J . e x e
C : \ W J q e e h E R . e x e
C : \ U 3 x r O 5 W u . e x e
C : \ n b 2 H 8 U a L . e x e
C : \ m z Y H I z 7 k . e x e
C : \ Z n D o A y P R . e x e
C : \ 8 x R G j j O o . e x e
C : \ t g D E n s i 5 . e x e
C : \ T r q r u K h H . e x e
C : \ 2 Z a U g 6 j 7 . e x e
C : \ 0 5 b 4 a 1 7 7 5 9 2 0 e 2 c 8 9 9 8 e c 2 9 b d 3 8 8 c b b f 9 1 8 5 d 9 b 8 a d b 1 0 7 d 6 1 1 7 c b e 1 9 c c 3 b 3 a f b
C : \ 0 4 1 4 6 e 2 9 1 d c 9 8 2 8 e 9 9 4 c 2 3 b 9 e c 2 5 f 7 4 c 9 2 5 c b 0 f 3 6 2 8 b 3 4 d 9 9 b c d a 0 c d 5 7 5 e 9 c 0 6
C : \ 8 d e 7 0 6 7 c 8 d d f 4 f 5 5 3 5 b 7 4 e 9 d f 9 c c b a 8 9 7 b 6 9 8 d 7 1 d e f 9 e 8 a a 7 9 e 6 0 6 9 b 5 e f 1 3 d 4 c
C : \ 8 j 7 b l B 0 R . e x e
C : \ 0 8 e 6 5 4 f 7 5 c 5 f b e 2 8 2 4 3 0 5 9 6 5 3 7 4 8 d b 1 a 1 d f d 2 c c 5 8 9 2 e 1 8 8 0 b 3 0 1 7 8 e 2 1 7 6 8 b 3 4 d
C : \ 4 2 7 9 b 3 f 8 8 d 3 5 1 7 5 4 7 f a b d 1 f 2 7 b 3 6 e a 1 6 b 6 d c e f 3 d 1 d 1 b 6 5 d 7 d e f 0 f 4 2 2 4 1 1 0 0 b e e
C : \ u S r T X G U b . e x e
C : \ S S 9 h r A e Y . e x e
C : \ n 1 K Z H L k k . e x e
C : \ D x N P j x U 5 . e x e
C : \ q 1 n T Y 0 B Y . e x e
C : \ c o Y o Y S c R . e x e
C : \ w G Z R _ _ K 3 . e x e
C : \ r G m _ x B O T . e x e
C : \ x b I X G Q L y . e x e
C : \ 4 n f b d V H O . e x e
C : \ C I r T 9 i 2 M . e x e
C : \ 1 e U j Q 5 0 J . e x e
C : \ O h B f b D R P . e x e
C : \ u t 7 w G 4 I 6 . e x e
C : \ j 9 j R K y b f . e x e
C : \ r D z V F L W l . e x e
C : \ z 2 s T 5 W k Z . e x e
C : \ p i k z q Y n u . e x e
C : \ X b f u c z x A . e x e
C : \ 3 c b 1 0 e a 2 b 0 c 8 a 8 6 b f 0 e 1 1 8 b 9 0 f 8 b 4 b b 2 6 d 9 7 c 3 9 6 4 f b d b 8 e 2 6 4 3 e 2 c 1 f e a 9 d 8 6 a 3
C : \ e 0 9 4 c c 9 6 0 1 b 7 7 1 0 5 9 7 8 b a 5 5 4 c 5 d d 8 6 b 9 a d 0 9 5 4 5 a 8 9 9 4 7 e b 4 c 5 7 4 b a 4 7 6 4 2 4 f 4 3 7
C : \ u v O V n q y Y . e x e
C : \ e 5 0 f d a b 9 3 6 d 9 b e a c b 4 9 a e 0 3 f 0 d 1 e 6 7 c c a d e 9 0 d 9 8 f 8 c e a 7 9 f a 9 f 7 4 0 2 7 f d 6 f e b a 1
C : \ 5 1 8 0 f c 7 0 a 3 4 4 d f a e e a 3 7 5 4 7 d 7 9 7 2 5 a 6 5 6 0 a 8 d e a b 3 e 3 0 2 0 4 6 a c b 4 b 4 2 5 b 4 3 2 7 5 3 a
C : \ 4 8 e 0 3 6 4 8 a 7 5 c 4 e c b 9 5 f 5 4 e 9 e 7 8 f 4 9 3 8 0 7 a 5 8 4 c 0 2 8 4 a 1 e 1 8 c 8 9 1 d f 3 2 3 3 5 5 5 6 2 b 3
C : \ e _ G Y y k F b . e x e
C : \ 2 d 5 4 0 3 6 a d 1 6 e d 6 0 4 c 2 b f d 9 f 4 9 2 c a 4 3 3 5 d c 9 5 2 9 0 0 6 2 a f 2 a 0 7 0 b f 8 d 4 c 0 8 c c a 2 2 c a
C : \ C P b F R v 7 P . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 3 d 4 e f f c 9 3 7 b e d 6 5 c 0 9 a 7 9 8 3 0 a d 5 b 8 5 d 8 1 a c 0 d 7 1 0 2 e 9 5 4 3 3 b 1 6 6 2 7 c b 4 3 3 c 9 0 d 0 5
C : \ c 1 e a e 6 f 7 d 4 5 5 9 7 9 6 0 1 9 f 5 7 4 1 b 9 7 b 5 3 4 a 1 e 5 0 2 8 f 4 6 5 b 2 e f c 7 4 5 e 6 7 0 5 8 7 1 d 9 4 d a c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ c 8 d f 4 2 f e e d 6 0 5 a 4 1 5 8 d d a 4 c 0 3 c 6 7 1 8 1 6 7 3 8 b 4 b 9 9 4 5 b a d 7 4 1 8 1 e 7 3 7 2 c b 3 b f 1 6 a 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ c 4 6 6 6 0 3 6 8 6 5 9 c 6 3 9 6 b 3 f 2 9 f 0 8 a a e f 5 f 0 e 1 4 7 8 7 9 a 8 4 a 1 d 9 b 0 5 e a d d c a e a 8 e 6 9 c e b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 6 6 1 6 f f 0 1 3 7 6 6 6 c 4 9 f 7 7 2 e c f 4 8 3 4 f c 8 2 5 f e 4 9 e 2 a 6 d 1 a b 6 9 4 e 4 5 8 2 8 1 6 7 f e a 3 b 4 a 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 5 f 6 4 d d f 9 1 9 b a d 5 9 b 7 4 c b 2 e 8 7 2 2 e 4 8 3 2 6 c 6 3 5 3 6 5 3 7 5 e d e 4 b 2 1 3 0 d 7 2 0 b 7 d 1 9 f 9 8 8
C : \ O G C g H Z _ c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ f M P d 2 f R f . e x e
C : \ 6 8 1 1 f b 1 b 9 b 9 a c 0 d b 8 0 1 9 9 e 1 9 c 1 1 7 b d 0 b c b 5 6 f a 3 2 c 9 5 2 7 e 3 6 5 4 a d 8 6 e 8 d 2 7 a 7 3 a e
C : \ i o g a A U 4 g . e x e
C : \ 9 a 6 d 6 9 5 f 0 d 5 2 d 8 0 c 5 0 f 6 0 d 9 7 7 a a 3 c 6 5 b 8 4 7 4 4 f d 6 d d 9 6 b 9 8 6 3 9 e a f a e d 8 c b 0 9 b 8 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ f 1 d 4 7 d 5 b 8 f a f 6 6 2 9 d f a a 9 9 a d 5 c 3 c 5 6 2 1 4 d 0 0 7 1 e 3 6 7 a 5 0 f b c e 9 9 6 1 3 2 f c 2 3 9 b d 8 e
C : \ 4 a e f 0 0 a e 6 6 9 f 2 a 0 4 9 a a c 2 0 c 0 2 9 c 5 8 5 4 f f 4 1 a 1 8 4 5 a 1 4 1 b 1 a c d 5 2 3 6 5 b c 8 7 d 0 b 0 5 3
C : \ 7 1 a c c 6 3 4 d d 9 3 b 7 8 7 f d c 5 0 d 8 b 6 0 5 4 a a b 8 a 7 5 8 c c b e d d 3 7 9 5 6 4 f 9 c 8 c 2 5 3 1 5 7 6 9 3 8 9
C : \ 0 q z z Q U E D . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ a y F k f a r G . e x e
C : \ M g Z h V n B R . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c 0 0 c 6 e 6 d 9 3 c 7 9 d f 4 a f 6 4 . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 7 7 3 2 4 c 9 9 a 3 e 4 a 0 2 _ t e z i n . e x e
C : \ 7 f 9 9 b 5 2 0 0 9 4 3 f 0 5 5 d 1 a 9 2 6 2 7 2 7 d 3 9 e 5 7 f 9 d 4 8 8 d 6 4 9 f 9 0 e e c 6 f 1 e 8 5 6 f 9 6 4 a f 5 9 1
C : \ b 3 4 4 0 c d 5 e b 4 f 7 e 4 e c 1 1 3 e 9 0 6 a 3 2 a c 1 1 d 2 d 9 f 0 7 5 7 f 0 8 4 5 1 8 3 8 8 0 9 4 4 b d f 0 c 5 f 1 9 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 7 1 1 1 9 b f 1 6 9 b b 2 1 3 _ t e z i n . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ 7 6 d f 9 d e c 7 6 6 2 f e f e 0 a 3 e 6 b 9 7 7 e 3 1 1 4 9 5 b 5 9 0 4 c d 2 6 0 e 1 0 d 3 0 c 1 d 9 f d c b f 8 c d c 8 f c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ e e f e d 3 f 4 3 d b 5 7 c a f d 9 2 d d 6 a d a 7 5 e f 2 1 f 0 6 c 4 a 1 b e 8 f 6 8 0 1 3 c 5 8 8 5 5 9 7 9 e 8 b e 2 f f 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 c b c b 5 b e 7 a e 5 c 6 3 4 _ t e z i n . e x e
C : \ f 7 8 5 4 9 3 5 4 e f 5 5 5 c c a e 0 7 e 3 2 c 2 e 8 b 3 9 0 1 e b 3 8 2 1 2 f a 5 c f 1 e 2 d b 2 d 0 b e 7 1 3 7 e 2 f 9 4 d
C : \ 5 6 e b e d 0 a 6 6 0 c 0 d 9 f 8 5 6 3 c f 9 9 0 a e 4 b f a d d f 1 f 0 8 6 5 d 7 e 5 1 f a 1 8 f 6 e a 3 9 1 d 6 5 d 0 a 5 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 8 c 7 2 8 3 2 e 1 f d 8 3 c a _ t e z i n . e x e
C : \ 7 c 5 d e 0 c 8 f 5 a 3 7 4 c 8 e e 2 b b c a 1 4 1 d 6 d 0 b 7 e 7 7 6 b a c 2 f f a 4 9 b 2 4 a 7 7 8 4 9 2 d 5 7 8 5 6 f 9 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 4 c 5 6 c 3 6 2 5 9 e 4 7 a d 6 0 6 b b 0 8 4 4 4 b 7 c d 5 2 5 3 d 2 4 7 5 2 2 3 2 4 5 3 1 e 4 7 8 d e 2 7 f 9 1 6 c 0 9 d e 5
C : \ 4 4 b 7 3 b e 0 0 c 5 2 d e 5 6 1 b 2 6 d 1 2 1 5 6 6 0 1 b 4 c 8 6 8 0 8 3 7 3 6 0 3 3 4 1 f 2 9 4 b 8 6 3 2 7 f 9 8 4 4 3 d c
C : \ c 0 9 3 9 8 c 5 9 1 8 8 2 6 f a 6 1 0 8 d d 9 e 5 3 5 9 8 5 3 b e 6 5 0 7 3 b 0 0 d 1 8 b 8 1 b 6 0 a 3 c 9 4 a 3 0 a a 9 d 3 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ 2 6 3 9 b f 2 1 e 6 8 7 5 9 6 f e e 6 6 c c 1 3 c 1 4 5 c d 2 7 6 d e 6 2 8 0 0 2 d 3 3 5 7 1 4 0 2 d c c 7 8 7 f 5 5 4 6 9 f 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 9 0 6 d 2 9 9 e b 5 5 6 7 9 c _ t e z i n . e x e
C : \ b 9 8 7 7 d 8 7 7 c 8 3 4 1 b 3 8 3 8 e 4 4 a 8 e f 4 b 1 8 0 b 7 2 c 8 7 8 1 c 8 7 1 8 1 b 7 c a 6 b b c c 7 2 0 3 c 9 3 2 b f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ f 0 8 5 8 f d 0 d 0 0 e 8 4 b d 4 0 0 9 b 9 2 a 2 4 4 e 3 2 9 3 d 6 0 e 5 1 4 7 b e b 1 0 9 7 f 4 9 f 6 2 8 7 d 1 f 5 5 4 e c 0
C : \ 6 0 a b 6 8 7 1 b 0 0 0 1 9 1 1 d 1 a b 5 f f 0 c 7 a 1 7 f c 6 f 9 e 3 e a 0 a a e 1 c 1 f 1 0 b 7 5 1 1 6 9 7 d a d 2 5 8 5 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 4 4 4 b b 7 9 6 c 1 a 6 9 d 6 a 9 2 5 8 9 0 b 6 4 4 d f d 3 0 5 6 6 6 6 f 8 c 4 c 3 2 d b 4 5 d c 2 b 5 1 c 7 c d 7 7 a 8 3 e f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 8 6 4 f 4 9 f 9 2 b 1 7 5 f 7 9 7 a 8 1 7 0 a a b 9 c 5 5 7 6 f a 6 c 5 9 3 5 a 7 b 5 e d a 6 e 6 5 f c e d 3 a c a 5 2 2 0 c 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 8 8 d b 2 5 d 0 5 2 b 5 2 7 1 5 7 a 8 a 2 d 4 7 d 8 b 4 3 1 b 6 9 c 7 3 8 1 4 2 8 3 5 a 7 8 c 9 4 e f f e c 6 a a 9 1 a c e 5 6
C : \ b 9 a 2 0 6 f 6 d 0 6 b 6 7 d 0 4 d d 1 8 f 8 9 e 5 a 0 d a 9 d d b c 2 2 6 4 5 1 c 7 5 4 0 b 5 f 6 1 e 7 7 b 4 5 7 a f 1 2 2 7
C : \ c b d 5 7 f 3 d 9 e 7 5 4 3 8 8 e 4 7 e 6 a 1 3 0 d 9 b 3 4 b 3 b 6 c d 2 d e f 2 1 f 1 5 c 5 1 4 c 3 a 8 b 9 e b e 8 6 5 5 8 7
C : \ f e b d 1 9 2 8 9 3 0 2 0 4 d d 5 3 c 2 3 f b 3 e f b 4 e f e b 9 4 f 7 a d 3 a f d 5 c b 7 7 4 8 0 8 a 7 e 8 0 2 0 8 f b 2 2 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ 9 f 2 e b e 6 b c d c 3 f 2 b 9 1 0 8 1 f a 9 5 d a a d 4 a 2 7 c 8 4 d e 7 5 1 e 6 2 2 d d 5 d 3 1 f a b 6 6 3 0 9 2 a 7 7 c 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ d 4 3 2 5 1 9 a 4 5 6 8 2 e e 2 7 6 7 e 3 6 3 a d 7 0 c 4 c 2 c 8 1 0 6 3 5 2 c 6 e d a 9 2 6 5 1 f f d c 9 9 f 2 b 3 4 a f 2 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ c e 1 6 5 7 8 5 c d 2 0 d 1 e 9 5 8 1 9 a a f 9 4 7 0 7 6 c e 7 8 3 a 9 1 5 f 0 d 5 3 9 a a 2 9 b 1 c a 0 a c a 3 f 6 2 4 5 9 1
C : \ c 4 b 8 8 9 a d 4 a e 6 4 b 2 5 a 0 7 8 a d 4 0 5 f 6 b 3 6 9 8 d b c 8 2 3 a 2 4 c e 3 a d c 3 c 3 6 1 4 a 0 2 d 5 9 4 6 9 0 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 9 8 5 3 f 3 4 1 b d 3 4 d 3 1 7 3 5 f e 7 9 2 b b e 2 f 1 b 2 e 5 4 0 7 c 3 9 9 2 d c b 1 5 5 7 5 6 c 8 b e 8 2 7 3 6 1 a b a 0
C : \ 5 9 b 4 6 3 2 3 9 1 d e 8 b f a 5 b e 1 f f 0 f 3 5 9 6 3 f a 5 6 6 3 d f 9 6 c 4 5 d 6 7 3 f 8 8 6 3 d f b 8 3 2 7 0 b e a 2 9
C : \ 3 7 3 e 0 3 8 a f b a b 9 1 a d 7 5 2 3 1 5 7 9 0 c 2 b 5 e 9 c b 0 9 c 2 f 6 6 3 0 3 d f 6 2 a 1 2 8 3 5 e 8 9 8 d 8 a 7 8 1 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ 6 d c 5 6 3 c 1 4 9 6 9 a b f 5 6 0 2 7 2 3 b 4 1 8 3 2 5 7 a 5 8 8 3 8 d 7 e 3 a 1 d a 4 c 5 b b 4 7 f e a b 7 a a b 4 b 7 e 0
C : \ c C f Y P 3 l t . e x e
C : \ 0 5 d c 0 4 9 c a 3 4 5 e 9 c 4 a 8 c 4 9 5 e 0 8 3 a a 9 9 4 3 b 3 2 3 c 5 3 d 0 b a a 0 5 2 d 8 b 9 1 3 6 9 5 e 6 3 7 d 7 6 8
C : \ b 3 c d 2 4 3 e 2 b 9 6 9 a 1 c 1 4 6 9 0 4 b 5 6 2 1 1 4 2 2 2 6 a 9 7 7 b c 3 f 4 a 1 7 a 1 e c b 7 8 6 b f 4 7 4 5 2 2 8 8 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ e 3 6 4 f a b 8 2 1 d 5 c 9 e a 3 b f 8 5 b f 2 c a 8 5 1 6 6 e e 5 8 2 c 1 2 f 8 b a 5 b e 6 5 7 2 5 1 0 c 5 0 8 f 8 3 1 0 b a
C : \ 4 e f 7 d 6 0 0 f 1 2 0 e 8 3 b c 1 e 9 9 3 b 8 2 c 6 e 2 2 3 c 4 d 1 6 a e b 2 f 9 d d 6 a 4 a b 5 9 8 4 9 5 0 5 5 9 1 9 2 b 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 2 d 4 4 2 3 a 4 d 1 4 6 7 7 3 9 4 d 0 9 2 1 0 c 9 3 f 9 c c b f e f d 0 0 4 2 2 9 7 1 1 9 0 2 9 7 e b 1 f 2 a 4 c d 3 a 2 7 7 1
C : \ 4 4 e 7 8 0 e 1 9 e 0 5 f 6 e 5 4 c 2 0 c 0 2 d 8 5 9 f 4 a 2 4 e 4 e 0 1 f 1 3 5 a b c 2 3 2 f d 9 6 3 6 a e 2 3 d 5 a d b f b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 0 7 0 1 3 7 6 7 f 1 f 1 b 0 d 7 9 4 0 3 4 b 5 1 2 c a 7 0 b b b 3 e 3 b c e a a c 9 8 7 5 9 7 9 d 1 3 0 8 9 5 2 c 2 7 c c a d b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ d 7 3 3 6 4 0 5 9 e b 4 0 f f 0 1 4 7 a 8 e f 0 3 3 d d 7 f 6 2 5 d b 6 a 4 1 9 1 6 3 b e 5 5 9 e 5 f d b b 1 4 6 d 4 e 0 6 7 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 5 d 6 2 e 5 0 4 d 5 6 c 6 a b _ t e z i n . e x e
C : \ 3 c 2 8 1 9 c a b f 3 7 b 1 5 9 c 2 c e 4 4 1 8 b b b d c 7 d d 7 a 1 d 6 5 8 9 9 0 c 4 a 9 5 c 1 5 8 a a b 8 1 3 9 1 0 d f d 6
C : \ e 5 e 9 2 f b 1 0 e 6 7 7 b 5 8 6 0 8 e a 1 d 6 b b 1 c 1 e 8 f 9 b b 1 1 9 9 6 d 4 4 c 7 1 d 5 4 b 2 b 1 9 2 3 7 2 4 0 c 8 d d
C : \ b 0 7 2 e 9 9 2 e d 2 3 4 a a 9 3 c c 0 6 0 6 4 e e 3 e 8 4 4 e d f e d e c 2 2 e b b d d c f d 4 f c c d 4 b 9 e 7 b 6 f 9 3 6
C : \ a a 8 9 f c f 1 7 3 a 8 4 1 0 1 e 5 0 d 1 f b d c d f 5 6 9 1 0 b 4 3 2 6 3 d e 0 8 3 a 4 4 e 4 8 6 f 8 0 e 9 5 b 6 8 2 9 9 b 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ t e z i n . e x e
C : \ 4 e e 9 e b 3 a 6 9 4 8 b 7 a c 8 5 1 4 8 4 c 2 7 a 1 5 e 8 5 f f b 8 e 4 7 f c 4 8 7 2 6 1 1 5 2 8 4 5 f 6 5 2 b 0 b 4 e 6 a 0
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 6 8 0 e a e 6 6 4 f 3 9 7 e f 8 6 2 5 b e f 7 b 8 f 0 7 a 0 5 0 4 4 3 b 7 f 2 9 f 0 5 2 f 2 0 8 7 2 0 e 3 7 b d 2 5 4 f 5 1 6 a . e x e
C : \ 5 8 8 c 0 c b d 1 c 5 d b 6 1 1 6 5 d c 9 7 f a c a e 8 d 7 9 1 a d c 0 2 9 e b f 5 9 4 c 0 d 8 6 5 2 3 f c 6 4 f 5 b 1 f c 6 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ t e z i n . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 7 8 9 d d 1 b 0 8 7 1 0 f 2 8 _ t e z i n . e x e
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.