SecuriteInfo.com.UDS.Trojan-Downloader.Win32.GuLoader.gen.1305.exe
| Engine | Download Report | Detection | Info |
|---|---|---|---|
|
malicious
Score: 72
|
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
|
|
|
|
malicious
Score: 96
|
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run Condition: Suspected Instruction Hammering
|
| IP | Country | Detection |
|---|---|---|
| 185.20.186.103 | Ukraine |  |
| 142.250.185.129 | United States |  |
| 142.250.186.142 | United States | |
| Name | IP | Detection |
|---|---|---|
| dwilsonson23.sytes.net | 185.20.186.103 | |
| dual-a-0001.a-msedge.net | 204.79.197.200 | |
| drive.google.com | 142.250.186.142 | |
| Click to see the 3 hidden entries | ||
| e-0009.e-msedge.net | 13.107.5.88 | |
| googlehosted.l.googleusercontent.com | 142.250.185.129 | |
| doc-0o-68-docs.googleusercontent.com | 0.0.0.0 | |
| Name | Detection |
|---|---|
| dwilsonson23.sytes.net | |
| https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external | |
| http://subca.ocsp-certum.com05 | |
| Click to see the 31 hidden entries | |
| http://www.symauth.com/rpa00 | |
| https://drive.google.com/ | |
| https://doc-0o-68-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/cf8qgqli | |
| http://subca.ocsp-certum.com02 | |
| http://subca.ocsp-certum.com01 | |
| https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214 | |
| http://repository.certum.pl/ctsca2021.cer0 | |
| http://crl.certum.pl/ctnca2.crl0l | |
| http://repository.certum.pl/ctnca2.cer09 | |
| http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd | |
| https://doc-0o-68-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/cf8qgqli4rihm7727e1v30p2jqpcricp/1653325350000/16125903511617426447/*/16-ZmAFjeTzH9DAbqoP0u2zSq7p2C4wzm?e=download | |
| https://doc-0o-68-docs.googleusercontent.com/uR | |
| http://www.certum.pl/CPS0 | |
| https://doc-0o-68-docs.googleusercontent.com/ | |
| https://doc-0o-68-docs.googleusercontent.com/%%doc-0o-68-docs.googleusercontent.com | |
| https://doc-0o-68-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/kdqkjtpb | |
| http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd | |
| https://doc-0o-68-docs.googleusercontent.com/# | |
| http://www.symauth.com/cps0( | |
| http://www.gopher.ftp://ftp. | |
| http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD | |
| http://nsis.sf.net/NSIS_ErrorError | |
| http://www.vmware.com/0/ | |
| http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference. | |
| https://doc-0o-68-docs.googleusercontent.com/G9 | |
| http://crl.certum.pl/ctnca.crl0k | |
| https://drive.google.com/9 | |
| http://www.vmware.com/0 | |
| http://repository.certum.pl/ctnca.cer09 | |
| https://doc-0o-68-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/kdqkjtpbbdq1ma5od724n4arlrasmcfv/1653325275000/16125903511617426447/*/16-ZmAFjeTzH9DAbqoP0u2zSq7p2C4wzm?e=download | |
| http://crl.certum.pl/ctsca2021.crl0o | |
| Name | File Type | Hashes | Detection |
|---|---|---|---|
C:\Users\user\AppData\Roaming\ios.exe:Zone.Identifier |
ASCII text, with CRLF line terminators | # | |
C:\Users\user\AppData\Roaming\ios.exe |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | # | |
C:\Users\user\AppData\Local\Temp\install.vbs |
data | # | |
| Click to see the 15 hidden entries | |||
C:\Users\user\AppData\Roaming\logs.dat |
data | # | |
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ios.exe_32bff45bee1557a39d49c4ca2c5bff414e93ae12_bcb1b634_99970dd0-5d80-4a04-b43a-60dbb6c644b1\Report.wer |
Little-endian UTF-16 Unicode text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\vm3ddevapi64-release.dll |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\portaudio_x64.dll |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\nssA056.tmp\System.dll |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\nsqE5D6.tmp\System.dll |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\nsdAA93.tmp\System.dll |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\document-open-recent-symbolic.svg |
SVG Scalable Vector Graphics image | # | |
C:\Users\user\AppData\Local\Temp\Standardiserede7.sma |
ASCII text, with very long lines, with no line terminators | # | |
C:\Users\user\AppData\Local\Temp\MEMORABLENESS.lnk |
MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide | # | |
C:\Users\user\AppData\Local\Temp\Forbudenes2.MON |
data | # | |
C:\Users\user\AppData\Local\Temp\DiFxAPI.dll |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows | # | |
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5AF7.tmp.xml |
XML 1.0 document, ASCII text, with CRLF line terminators | # | |
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A5A.tmp.WERInternalMetadata.xml |
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators | # | |
C:\ProgramData\Microsoft\Windows\WER\Temp\WER57D8.tmp.dmp |
Mini DuMP crash report, 14 streams, Mon May 23 18:02:41 2022, 0x1205a4 type | # | |
