1.2
低危
57 个模型检测该样本为恶意！
重新分析
更多

12ac2f4c92606b1e57abe84083e26b827b47a5d4c3ebcb06423b886cbdc7f4eb

12ac2f4c92606b1e57abe84083e26b827b47a5d4c3ebcb06423b886cbdc7f4eb.exe

分析耗时

193s

最近分析

368天前

文件大小

97.7KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN WORM BRONTOK
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.76
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Brontok-U [Wrm] 20191104 18.4.3895.0
Baidu Win32.Worm.Pazetus.a 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20191104 2013.8.14.323
McAfee Corrupt-TG!808C6BB123D0 20191103 6.0.6.653
Tencent None 20191104 1.0.0.1
行为判定
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (3 个事件)
section {'name': 'QQnaQQna', 'virtual_address': '0x0000f000', 'virtual_size': '0x0000c000', 'size_of_data': '0x00008a00', 'entropy': 7.979148438550858} entropy 7.979148438550858 description 发现高熵的节
section {'name': 'QQnaQQna', 'virtual_address': '0x0001b000', 'virtual_size': '0x00002000', 'size_of_data': '0x00001400', 'entropy': 7.423138084893348} entropy 7.423138084893348 description 发现高熵的节
entropy 1.0 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意 (50 out of 57 个事件)
ALYac MemScan:Win32.Brontok.LW@mm
APEX Malicious
AVG Win32:Brontok-U [Wrm]
Acronis suspicious
Ad-Aware MemScan:Win32.Brontok.LW@mm
AhnLab-V3 Worm/Win32.Brontok.C145373
Antiy-AVL Worm[Email]/Win32.Brontok
Arcabit Win32.Brontok.E5522E
Avast Win32:Brontok-U [Wrm]
Avira WORM/Brontok.N.1
Baidu Win32.Worm.Pazetus.a
BitDefender MemScan:Win32.Brontok.LW@mm
BitDefenderTheta AI:Packer.8AEFDEEE1D
CAT-QuickHeal Worm.Brontok.C.mue
ClamAV Win.Worm.Brontok-9
Comodo TrojWare.Win32.Trojan.XPACK.Gen@2ho5ur
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.123d08
Cylance Unsafe
Cyren W32/Heuristic-257!Eldorado
DrWeb Win32.HLLM.Brontok
ESET-NOD32 Win32/Pazetus.K
Emsisoft MemScan:Win32.Brontok.LW@mm (B)
Endgame malicious (high confidence)
F-Prot W32/Threat-HLLIP.gen!Eldorado
F-Secure Worm.WORM/Brontok.N.1
FireEye Generic.mg.808c6bb123d0878d
Fortinet W32/Brontok.N!tr
GData MemScan:Win32.Brontok.LW@mm
Ikarus Worm.Brontok
Invincea heuristic
Jiangmin Worm/Brontok.kb
Kaspersky Email-Worm.Win32.Brontok.n
MAX malware (ai score=80)
Malwarebytes Trojan.Agent.Generic
McAfee Corrupt-TG!808C6BB123D0
McAfee-GW-Edition BehavesLike.Win32.RAHack.nc
MicroWorld-eScan MemScan:Win32.Brontok.LW@mm
Microsoft Trojan:Win32/Wacatac.B!ml
NANO-Antivirus Trojan.Win32.Brontok.gwhh
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM17.0.01DF.Malware.Gen
Rising Worm.Pazetus!8.D50 (TFE:3:X2m49l0uOyS)
SentinelOne DFI - Malicious PE
Symantec W32.Rontokbro@mm
TotalDefense Win32/Brontok.NcTVcZ
Trapmine malicious.high.ml.score
TrendMicro WORM_RONTOKBR.AT
TrendMicro-HouseCall WORM_RONTOKBR.AT
VBA32 BScope.Trojan.Bitrep
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2006-03-16 07:25:33

PE Imphash

09d0478591d4f788cb3e5ea416c25237

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
QQnaQQna 0x00001000 0x0000e000 0x00000000 0.0
QQnaQQna 0x0000f000 0x0000c000 0x00008a00 7.979148438550858
QQnaQQna 0x0001b000 0x00002000 0x00001400 7.423138084893348

Imports

Library kernel32.dll:
• 0x41b010 LoadLibraryA
• 0x41b014 GetProcAddress
• 0x41b018 VirtualAlloc
• 0x41b01c VirtualFree
L!This program cannot be run in DOS mode.
rI6(6(6(% 4(3$/(3$9(
4(% 4(
?(6(S(
1(3$4(#7(3$7(Rich6(
QQnaQQna
QQnaQQna
QQnaQQna
aQQnaQQna\
PECompact2
Z:a[*5
z@$`)K;H
n%Y_,Seit
N1uQ_N[
_i)#P4saDB,ig
DM:=|"
7C_!5u
h{g-R?8
r( )@i
R,B|{CB"~
]vj~:b(T2
Epkz@TJ
+Oiy%q
(z}w?M
!#$kA!
<: 885$,
twZQb/O%p
4M*J-e97
%!`!D/
j`s-McI:TF5sar
("-[1h%
S{Y) +j
)(Td V~
\:1B\/c)
#|_A5gN\^:t
h8R[RA
K{.=Mf=qDor)f
.V7cfZ?>
N *;NSv
11y%7?
>5C5YM):
BkP_*#5O
9~^Ic>:;]N*'jA
wAAYew
%Z :02
!<.5Cx\E
ZEk#8q
~z9hC~
w9Ieqy<0
+g45G!Wh?
*Q}K\v
Y_= ^
\Zd=p8=X;!o
u;3C+#
dHYs1uW
OCE8{Q\=s}B
5`xi@w-{[ud
4mC)0a
jd"[ad6.MjO=Qt
'9%faEt
(F"!(~L
t-2{]_
Pm6"5`
laAT1sd,
7(3X/^p
mtYqJ=6+
}~b!p`&Y
TJ?A7g
0wo;)~j
#zEfm,WWdP&
1M9!j^y,
_viXTUw
\]!zvg
ej`swV'4uj
B[/Ye;w
Ju[5hPg@~}K&^|k%l}ha%
a0p D*j
eZ+&TLP
y(biZ27)z
+twT2$Bjy
V^[N!!K
u]EkBt>
ul8^8\!
bhyZm0$d9Y
PvL@N7
#o30ZwOC{Uwn
drsbgHko
~C9f[{$nNIj
J?XeEe
zw[OPhjy
UIamE^
6^Vcy@
b*hw#*bx,
-X^Euk2
50UHV&
?<ga7$R
1e#>vy,D
4CW("B-
qaAJf
=&bnE#i
{?W}57
HIx+,,z
m}#}v\sdn
~@|7(
L6TJK
6-ABbf"
9?&XW1/fIR]R\
8xd<PdTs[AS
j,f?3O\Z
@852rm
~'}la2W
(DeH\qB
$I9O7#I*
2#z<3mJ1
sXA3b%HC5[
^`KAD?
`,-kWI
}Kn<*kDi
(zHT~g
[ JbC[Nt{
DH7@q4;us^c
:Yk@|R}$*
j[<F7mOM4Mo;
lldcjk
<le&Od
QSFAl>'
)6r|pv
_m*GSFpR!b'
Nb_XZFLM9-:h
zsF-1"
v ;e7GbxGk=
E$KbVxnAx:
a4E5t*>G
U[)'rp
ME14s2
R%Z%_x
)cr;qLX,
C|++Hh.
"_hNi$8
rIB~qbA?FUa`]?I
qNyY\ZP1eTv
l&PE_b
+?#X/1U
NV)eC&
O=iz?~
MCK_(v{'Zu
gzkLA$3nGV)A]t
(o'~ X
Gmw,,&
`HN+{y+>
nGf'mu]
@!^;80
H(v@Q>
Y6o!_y-o
v!F.>dx@qs@f@9<
/>Y0*M
A 3M9>bgPlU
=;Y")o
+xGgLs~F
RNM9_]q
7==`z\:
Fe{R':
G3&?%dj%g(
veG;=^ftDZ0o
;u1r[`
FV}I'O
@;wf2Vh*~"a
fk"r&$
h5#J"E2
=b?-k0=*D
M# S`QoY
EZoS1:*
,~}.KX-
ip\HYxm
:x#N+w
'pUE9dO
)_-1vyF,v*R|
%ubK od
_5/v&v
CO$t2Zg
8r#3V
Ta$oq_
n-O7f:9@WHBr0A9s9E-*/7
~199YMb#/
:KZwW7
D^:uqv=
C1vmAoj*&
p\!:>~.\
B~PKVq%:
K^/&89.\
!Ka6W(
=Xy#(2
;Z#u<$;
2l-kEp8h
_K*^-@
B~>#)V%
?UzgXUIQI
5PZ?rx56
)I8$t# k
wLyQbD
R*>Fk[9rCC~rVj5
`tUGRq0
j+b/_M
4zSy8>K
G@US7U
T#3=:|NO
"AGgYiF
AI{[|"8x/e`Af
R<m.Iw
'BA{A$
1GZp9l
6-<!:C_
$f'IVd0
/I.+1a"
(f3`V\J%@?J
Eg%l{fdqo
xX#/Qi
ZdL%?Kl
2~G(K~
BY~b1"Z5lFDwX
`l,N1Y
;WD7z_xCU
CK^"i{0R
]QZQ):>
A3[]u>
~7GhH>
:X*'p2
2mLr9p
W,Xn||R^]xc
G^7!]^4
\J~uU3^
{y*{]1
R(i{ 33ku
l@prsJTa<u
IS|\3!.3
?}aAdkJ-
yo8SMpL
)Wx=@Zk
.werW 1
&8({PZYt;`
}{Hhi~eP%5dqkUg
v'g{-D8
jmwVUm
`Rpg(0W
'*gRH8
:eO6DG
d<Uqvj.R;
xXTSt3Mo
jf'[ei
[+21]A\<
P{BZG\p/b
`fR\+>
KoZFgr
[4qV7.
jr+'?h
`)xza6'
or#aOl4P
5?F8u0UB
*36}|nb
KoiV.=[g
/f'[T%
%|U)~P/yQ
B&KcS%
3w/3\-&&
"(f]aYs
+?0DJ>
lS-wf
oK$/R$
iKcDXE
;R]qxL
zS'I1[K
#R7%t&r
/KVo=|
4pT!;u
X7^!&E6X3
wvSub[2S
~Any0v
XI,MtV-OI
U7raGb
.p\#3#D
Hw^4.#
``%Q8#
Fo2!cKK2Yx/
LiB2>e
*#}_"nwk@F-KD|;v
'_ihh-9h
UnINnfr#h}U
Gv5mNs
mp}R4~
(.LT~V(M
*Fqa[\s
ny6{23E
8q)kQ?R
j:P}lwtcz
A{?G~"O^
%Mo5V<"
6t &du
Jl@:K]
Sgy+5zu
~F"cF~A+
la\\im_3
l'"E$ruu
0 ?84JBw
TM:ch9
8QK:iKkz
DD?;3O-
f>uCxt
{Ha&f*
306}oE
u[&2>fLr
'",e|$x8
mDtmru
PN(cFo3b8E
oSkR@CI
kR9rdUZ1
MIF>I0%H3l
lGlnVdO_y
:#C"#fUwwLZy1;%
7;M1jOLha01
d"kVSqcC
8xebSn
is4h s#!S9t
6D0;tr+
09"Oi~
c3{;B ;
E|q.N&'/
C=)4Y4wo
ixP})tJsZi%.+iQ
uHWIAQ9
O-@].K4
L1f%H&kU2o
AQbOjJ}8l
'\u2)l
>T7YMj
K:/[~Z~Ck
r]Xu=W_
lb4AJZ
t8Y<8kx[
NotkEU
1[8!<n:q
$Is%xI
E,P>xO
m-^'s^)
c_6]K(!549@
z#PVy=
m/VnULZXn
j hub\[N
B~C',kH
4@2q?cBUE
).Z'(NU%
.u #qx<
DKb6MzFr2!nh
K,Vq1]ZYN_%b&DR'kFo
RNqN+
p#"r>U
*.j;&u
lt\Mzi<xN*`S
^q(67Dy0
Y(CyYamyi9iql
mO9.+)b3RW`^#]
]U`e]eRg&
M]wa5Ada`p4
m}Ze7!j
1n{iX&>
b3YMw\L[O_eB
:Qbc/LE
tnWC<$!K-M8xD
i3AT~
wLUBS;d8}
:I^B>~m)
B21:<Z
B(XWcd},*Xi
l1*;yp
da\{RDe
QW"bO=a
c T6B&
@hzH)F
o9UK/bbM
mh.0|KX(xU|
6Oot#ebq4Y
9o#GPgz
6]Uj[^k
QiiR9C6
ml,r..-
C;{Y]]
0+[<
{^pBWsE
y.g>~OH/u
eA3LGz
\odF!].B
hSgYV88$*`
UolsU4Iz
q:%kI/6
{%/At:Cl
r)4v^ GFh:ub
3(4BmM
u':Vkf
;_Kgcm?cky
o$X5b:
@"L'sc<
p;:'_w
Y;:n%?
jTaGs!
1F^<|k
'P/xA:b~8f
<|>#%A,d
Pp&zyig 4
]D:S2z&q0
NBm(\j
j)Fc&Zcp6V
g=l \ele
871\piZEgG|V+[3zr3x
fo`\|D+/
V8U?G_cewkR0
?~zK-7s
:?OBN`
_@9f@*
XDQ^g
7&ou52^gn
4s0DsY
;S3a/8/
I7]PRPbB<
,eH e$WY
k4{?Invl*
8p_pif
xtcyEf
\j6"Uhn
O>*SUR
R[/)8[Kf
8Nrd~.f
1\SQ+ah}\R2p+QE2
qaC#Gm
pq0tE#";
v]{}<;='H2I
;\"@"1$
N_,BiX
)),}ip
HlSt=6
`,%tM:&SZ
A/siYl
XRw]O]V[K%L
e\Te;_t@P:\@[
;5<4=Va
[D%RdU,4;H},9
)GE'}k?_UO~$
Bl^%Z,
x:XR1[
P3Uz00
*mCc*$Dz{J!
bTyvL9uP{5v]t>U(Y'
qQpGI
|8*A Q
kYt)rvgl
<?Eu%8y
mXh-C<
q#u8a
OG/z3WrY
thu(ZK
AE-;zlq
=NpSzU
nN-$JS
|_#88\!F^wR
;&+/xwCHv;^1dk>
#ss;JA
+L+ZT9
n031[N
Z;L@q\di}av
J8M)ql
t}Yle'sU4<)
59/_8s7
0=b}5-
Rvjo:'.OkxLX>
)[$`rh"d<
uAp(RYH
B4aIyaQ
@Q*EFiH4x
'd'l?\$
z=uKz
hHkulu
s8-dQNEODj?MT
QS@qI,th@#h
__[8noQ
0,JqY
p/1 (qB<wN9
1,*^S{t@
s2To?A}
WF'g_>]
W0<BpFJe
rmYi{ 6cVok
-,'Irgb
"P+|6jQ+S?P
acMf|(z\
nA[ GWe
Z+O&r{X
y!]}bJ
ag!e}0;~
m nvi
\DsLwH1
tx5g0Oft
O7JU??J
%,SR9iJ
0xf(J@
j3pd&G
ASlwC~w
*F)%8gW
_-{ZThZ mViI"
\4qy-t
zm|PQn"p.+
RIt1!K.pXx&PdDown
Vw'w0X@I;
WaI6yV
g%-C:CWb9it|4Q
)Z+s[E^
^p*F@eD7do&qn
}WBZ0V@
;pH50a
_!:oNU)3
k\n&-@
0ub.tA/qL
RUA:QO}->J8n1AMR;DqxN
Ds}eQpLJ
.1#6"{bb@#
_,mm?F
`l(NU~H
kP^G+bg
yGYO2f
_:?]J'-Xgl
.YVsMPP@u
h~Kl!1,Y7>OQm'z
;1b.4e'
ATA_<PM%$XNZ
i,3*K#J%zKw0
$<A#YYyy
</ou:F
}ruqT&=
W%oi/&acy
}OwXBX/+$\BU@b"\'MqU7i,
DbfvMFgB>
&A&lL5K}'4+qUc
P!;oLE
yM&-MVgo
\y|.Pp4
M-%{P=b%%~29
rm6U<P|+w
j"`RWM
a!nlB^|/iI
[ RK.l|X
K^}_q@
)Mh!UJC`SqO
!'DlCZ*,G5&
<dCH<=
CMoQL
tB/PCCU;yh
v~$XH^Hj.;n<kf
Jb{la3a
YdR'jg
!4IBUgg+
7k:7j$)PR
-$G%]J
.3L3Zf
wR42b),!v
?B5rt*t
N:W"mf{k}
';?SG-
x~MEKHe
VyhA?3[/Ok
=(^lWO{
b^nG@~j
-|'Z%M/r
T+7o]"
jxl+xsH*w2vx9
4jlJE,M698W)L7
\Y{8A'Zd
e7h-k &3:
A~d-sd
fLT'z#$7
j4/_,!GJ
#{R*[-
.g<e8i
#;&DN'"
o1.W5;}C#a\h.KX
;m,i-MS-
LJeg-qMQMz
!v.T3wc25z
m^h5R}3x[
[@zFp`)|#*C
Q@_7'|),
D8i`WVqpSp
%Q"R;u
<A= )-
+-X~f$"w:Up9$W
=gy eH
~WL]wC
3)]7$90L'}Zp
+6b8@*i
1v~$(m
cjvqI@3]{DP
~14QirU
Y5N:e8zP
Q#1$Jq}{
>{!S].l
6FK,{V;8N$
Z4Lg%'
VAoHei4
6Do1|
v,Au<G
;iD>.n
<gB z2
Wn"6%p"
ME%#d{l
(dx Im&<%
b~[]!Vg
-_yY"M#l%$k
VWcp%N0i2F
2fu90 A
9}/D39'Q
,("-9,_TH1
OWYRrvC3
x+o}O4K
)uk0!0>1
;tr1W)
tiS!W<X
dY.22S|>^_
9IbvYnx0
Rz=ZnK.
$7&|!}@V-
FTDl9k
.HTQp
/GmP@n
sIibnH%?*|
\5{\QwgK+F
N`b@/{
)}Io@!
7i)[JGer=[p
a&&mbD/
jI/9gY[d7.vE
UwM7hv(
Pek!V-'%Y
&cH'a|?
7~[hz)
p)Nf^XM
Ie^S.F\\
p<:(8TN
Yc9BE,C
UHg{^BX];
VSR={OYvma(
pLdM+o9x
q/JA`v
"]3ne{sum/`9X
"pWgoj
},/Nxdy
tGHya>8|
1F2s.w2
yCrJ7t1rAd?
wKr6F^f
p._N[e3
Rf_^^uT31
Lkgc*
dj>va
`)j25$
qd3U5D
@PwYyxF$K
9kkY3if
VbT\DMKe)VoFY4
"}*J\;ss`W:#
%M([Ec
Tix[C\Q
{w3Zucnu
Sn[yj2_
Mqc4Hf
Y=u* r
GIwral
-7[[3\zp:_
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
<b%O12
VirtualA
ockenP
M"xV4
eWEf;`
|WS|t$
x(VC+WL(5
WT3!:t
$($+Db][_^D*$K
;sgt6PH
n;0&AvQkq
?uH\`q".d.
MesagBoQ!,xAS
!hecksum on~imd~~Tt
_._;+.52:
t#|K=)RY$
Ejh6P?03?PTW
[0;WvDtH
fuf\X<
]H?U8oYMT
Ps#B@;mi
?kE>+5
duBpG|
B'1gR`
W&6sM~&*% t
N%hMv=Ix
!| ;s*
$9sCPQ
}C@;s+
+HU#L!e0s
}!DAxF
PT(0EuQ^
#N?/2<l
!4X0QM'
"p)|U$0
s>{@<*P`
vEsxEKJe(0
5'? uC
-F1W$$-
Iwtxly
t5;*0u
(CgtMsb\}(K
m6Z`;2=2B@ua
r#.Pb}
5nH+6C2_&^ |
$/B_^;Dd t>E
}(,TvW
P;w(>c;&$%S
P";2O:MWQN
dNK!{PWQS
,FP'R|
)N6N\=
JRT?f@R[%
YfUWE\@
P_q62))>o
'1jNAA
9Stt"e
g%AplicatteLThp
%sof<lb v_[6i^*SDLG.5xd,a
nl 3Fil
law9Uftf
HandOp?V
GtMN-Sl
AADfp=c
`t$$|$(33
r+|$(|$
USQWVR
ZPR3C
Z^_Y[]
L!This program cannot be run in DOS mode.
rI6(6(6(% 4(3$/(3$9(
4(% 4(
?(6(S(
1(3$4(#7(3$7(Rich6(
PECompact2
Z:a[*5
z@$`)K;H
n%Y_,Seit
N1uQ_N[
_i)#P4saDB,ig
DM:=|"
7C_!5u
h{g-R?8
r( )@i
R,B|{CB"~
]vj~:b(T2
Epkz@TJ
+Oiy%q
(z}w?M
!#$kA!
<: 885$,
twZQb/O%p
4M*J-e97
%!`!D/
j`s-McI:TF5sar
("-[1h%
S{Y) +j
)(Td V~
\:1B\/c)
#|_A5gN\^:t
h8R[RA
K{.=Mf=qDor)f
.V7cfZ?>
N *;NSv
11y%7?
>5C5YM):
BkP_*#5O
9~^Ic>:;]N*'jA
wAAYew
%Z :02
!<.5Cx\E
ZEk#8q
~z9hC~
w9Ieqy<0
+g45G!Wh?
*Q}K\v
Y_= ^
\Zd=p8=X;!o
u;3C+#
dHYs1uW
OCE8{Q\=s}B
5`xi@w-{[ud
4mC)0a
jd"[ad6.MjO=Qt
'9%faEt
(F"!(~L
t-2{]_
Pm6"5`
laAT1sd,
7(3X/^p
mtYqJ=6+
}~b!p`&Y
TJ?A7g
0wo;)~j
#zEfm,WWdP&
1M9!j^y,
_viXTUw
\]!zvg
ej`swV'4uj
B[/Ye;w
Ju[5hPg@~}K&^|k%l}ha%
a0p D*j
eZ+&TLP
y(biZ27)z
+twT2$Bjy
V^[N!!K
u]EkBt>
ul8^8\!
bhyZm0$d9Y
PvL@N7
#o30ZwOC{Uwn
drsbgHko
~C9f[{$nNIj
J?XeEe
zw[OPhjy
UIamE^
6^Vcy@
b*hw#*bx,
-X^Euk2
50UHV&
?<ga7$R
1e#>vy,D
4CW("B-
qaAJf
=&bnE#i
{?W}57
HIx+,,z
m}#}v\sdn
~@|7(
L6TJK
6-ABbf"
9?&XW1/fIR]R\
8xd<PdTs[AS
j,f?3O\Z
@852rm
~'}la2W
(DeH\qB
$I9O7#I*
2#z<3mJ1
sXA3b%HC5[
^`KAD?
`,-kWI
}Kn<*kDi
(zHT~g
[ JbC[Nt{
DH7@q4;us^c
:Yk@|R}$*
L!This program cannot be run in DOS mode.
rI6(6(6(% 4(3$/(3$9(
4(% 4(
?(6(S(
1(3$4(#7(3$7(Rich6(
+WVVVPV
NJF@_[^gt$
Y-dP} f
Cfcu^}
-{8PW5|
tT5p1W
b$2SM(PRk
Vrokfd
44#H|H3
$iF $
H4#LPTo3X
y6lpgltx<|Fn
ih`iFXPDf
4#H364#
@ 8#H3$0((,3
iFHLPfTX
iF\`y6fdhll
xpFfh`f
iXPiFH@8f
HlF4#H3
4##H33
iFL D$<6C
4LP4#HTXH3
\`4#dhlH3
9rld\T#GLD<9r
F,.q|_
Qy@I^H
m+7Xyw!
Zfd3[W
4xJuw8ur
Wul8gy_
5gFH;rX>
}_AN;|b
=TGF;|e2[~
Pj -4ff)lM
,r;|5MAl$V6
Mlfqd#FT
9rdP@$
,0#G48<9r@DHL#G
x`pdhhX`
9lLp8t$LI%t
J&H@(`
$(,dVn"
td9qoXLF
@64(]/
9rH5o31
|B.1,({
"H3$(
ypdX<L@8C
#G9rxpdG
JAKC|NF
@k. G
Wmf~uPhTo=
zhoP}C\7]5L
;JhD%>siup\yw
v;t%mW`P\Uh0;i
h:',*pC
mwYg}%t{=
&H03sgVDW
<"Vjdk
g@ph0P
h!pl$mb
g'#DWD
#u9S6o
|qwnE8"h
g'avSPW^X
3WWWM6|
W@n^p?B
@gdyZaz{X}gPD
)-#>j.Pk
L5F@;|mm
1@/)p#mli?@
'n(t~$ty tt
s<e`[V|n
h4D(U(\1
opB;U?2Y
`G9ri~
h| t$l(r
d,\0T4LG
98D<<@4D,
0A>W1(btm7SN}
bkuvr4yox\.?wjl4fm\.elzsc
ihprm4m
00NyRa
9rh`X4#GPH@9r
xhP@8$
>$y{(
548<t@lDdH`LXPPTHX@\4y~
d(h lmD
WYkt4RS[]B,Gt
l<]pH\o2v
&:5P\p'KS
RrODXYZG/=?j
Ei0Eub
e-r/`zI=
QHP>[h$M.
\#n"Kh
""[%(r@X
[@9H$|>X
hEf8e:
Wo-A3?
9Et#Wv&g{Wx
2D<\cw
(u!XBt
T!NGPns`
|0k3y/y
uAh\pI
`&V@>dg6VVh#PW
%Cln\2$hSdCr
%CrPLNt`
B/YIu
56Q3W=78O
$JBFnp
~0(0iBji
y=S5DY7
t%zC2V
RY2T8p*c%(Z
u'>I>RC
=pM_af
Vq(U\|
s|&w(
4,$hQ%;
t]H3N7
U7*][2
8yz>U ha"hvC
U$&Xv@4V
j]Yc;6G?{*<
^hMD*u0;
c(%u%LdG
h%R-D[
*B!"#X
(;SqTCsIMQQPDhX
3GFMc0
\`.^ds+*
NysoN)9QB
xt`qT@N
c6b|_4a
75QnB\2~`<!Fd+
UEQSjC
[%j3"}
-M?u$t
<7:.A2dX;:
:_W[$f(n
mh=xO6:
%0DMK8I
65Wh;
hwBn.H
S/4_gP3hL
b3,v/c
DfH!q
c,S&fXHH
\OeQ[n
4l j1X'
1t23p4:5/f,67w89:.m\n+;n<e=>4
k?f@rAB
EFgCGHA
vIJ3Ks
NdOd^`P6fQy(RSk$TUi5
pVWdX2
YZf`[cH\]sE;iv
ldeu]tW
"#u]u$+%&
'C(\v])'*
+{,w-d!-6..
eSq6fTSZ
=s{bHV
0\;}tSV)1
q93V$<G
$0T@N%
;OPcPPn,_
OOFS=h
5;$Me%O=
z)-jaW
m%;V9Pj,KY5La3u
C[39}lu
oG~;t{
eJR4<BuGd
zs}|n1
.M&`q?_q
ul,EhEk
(WTXVp
P^hpDMrVPo
QPjcjY
UYW7>"u
]|_]h*[D
/B%FFF6
FFFFx|
aF1zwP,U
q$[]fO
,r*hfg5
]tuvAR
nm9d9W
oSmcm#T
u.uoPvB8t6(
Ch%57`@W
KUV~v;7|^
+t1g|9n{ $
rhr|N&+q,as]
wa6MVp[l
-kt"B[
x/tA-a
8^cyN~
2 #gP\
{"4@%cQ4A<
Uh/G9}QnEa_}ah
H")V7&J
vFF0mDE
KvAALK
K93t+8
=`7jddY`L
1/S-Di'G1Dk
F .mE:Gwg
%S[+G}
;?_1^~k
_8SS3FVh0
q?(f{6J
$6T\Ne
H@s]+G
P#2`lWuV=rQKpp
/3p\1;
0;ro}oYh!<9;
0$7-]QuW
955WyHW
9lmVu
mV.&d!a
=0rV!2
BKl'm(
,Jx0N?'l\:?
UrWg=0[@
|IF;s"
5 Q$RFQJ
#5$PZh
KO(Fk@
$!@WWS
5rejB&
0Vwu^}
l"]SfE
YNwF+h3\
7hr@<t\VfT,V
M Q]t#
YJQVC20XCca3006
Y]C!svq{
v?xH;vH%V
G<S~f4
=N@uNVJQ'5
4!tT:!,%
%lv<_
@S$3sz\3D0
~%jh_/
m;X)y_e<u7|
`Y6V^AM
+B7-+c
'd5gS|P;AZH
.V$t(4O
daXkdIy
Y[?!t ^
Ex_htmEB?v
j|PS#A}S
/tV}f9MZ
8PE7WtJ_
h3uO~&T
ADh+4*W
t+/)u-?ua
4MYlZDv
bUAWbsge
;v^|WZ
4D)"Z;!
SeDcebugPrivilege
chipyahoona8s0borland
-acer/compaq?r'tvald
rodetikw.ppt
cfmeml
#|txjpggifx9lsdocpdonw[onyn1guru
dsci@mfw32=@
NONE7CASTL
cWINRAR
ZIPHELP
IRFANVIEWMSDN4.
AASKLICK3PTE
USE6RNAMgSBR`
TUDIZs4!3CLUCENTA3_SA
K/rYNoT
LOOKSM
ABCXD.?[BUMUo|
REDHXSLA/MAFUJ
RKD[Zk6
[LAZTHWG3LS-vGISTPYW
UL7OBOkoTIGBImD32U
\kO_L/HN{[
R[ADD+T9;AF
IRADMIcZBLSKY
YSQAP'\sH
oOU|OhAh!suBcV
7'TIP;V3h
[8<F_EA":
DKWNIORKR7vL#EMO
EXEHTM
0rPHPASB-3b
O-9:At
[WOSRJF+
's+fDFO;sg
Y+Aasu0FSPA{[[N
NG!}Ba
w0TYC#C
USaPPv
Dxopkh;Ag*^f'vL
EHU&~C+
sWEB.ID
MILaC
#JowoBot-VM Cmun
+%bl{#ogs.
jeruk.\sP
kaskLbkns
a+JKx-missi"
o%J,y)8fokl$v[utbd;pnnKer'of\jKab
rw&a{[,qg-.rg
'ree-av
cuk\bX
!Swoeyen
eo%5e.f-Ew;]
+mT-Y
fum.vCsx7X|
_Ntoxd@nD4.mc
7>y-b
^r4xjai
6HJ\?
5yc04.JPGys_R
Kbr51!.'X
m775-d2\dk[Al
f`9kQVC_rd
kr!Hyhfo
ke+Tj4QV(
RkmkX#
/sfwj1rox
S1Qk#Df (MT&j#'C
CZ2IL%^
TZ?I.{Uj
1L +waNAK
sZ,[7=WvX-
rmVl k
ck LYu@
}sQR'J
Ig[-pMNKM
gdhCcVZ@ ZU5
H3caUO.XL
_nModuFFNamc
n^P0KYSss
kvPaC;
.eXcRra KHu
z3Arm'R_
k+. uVmRO
::]{sP
;h`tCRol$
\S;3v6
&ac-Spiza/)Ui9
N\Ml\W
lCPEiL\
CMD{xmOBXNoF
Opt Td.i4hagRegi4Zk
^;h.Hid>
2!mwcave:
buMS5i<wsMG/-g,
cb:A-u
OctSepAu
gJulnMay`Opr
#<FriWedMonSzvuTueco
[ BhT[6
Pl -->>VFki bThe
Fl3zIme
CD8=+sM\&Jik
Zwth7!
u#Dgume/d2#
Ot]K'Mu+'r
acPui6
I~~@kn0["b_ u/6?b{mJ
0WG0+a
[4TDwGS*
umli8m,1
ds>?2Fz]o
x8Abo,/k
[V)<.zj6gP^pT_~nyP
o;,SzpWB
> HziusJh Zbu@[K nr
};bRK.C[22] '^
K\v+al
lY{\`s
*mRzx/k'w&hYYd
zlh#fb
L7eB.i
0vchkt
s;.lDC_gCpxy\3
cZ F
{ vC.t
o{ ua#f}m
m! 2nfia5L6 mr=`bi6 kkkV(
mkty.#Wv
V7m'm,UWAk+lV29e8dUeS[hij
=_NtP_9
1C633DA.513F2E2oo0&AwA
BpDagA=AhQAC
QRQ4#FBob3RvL1BLBQz76OACOlVp x
CwvQAm
KXhvdG8uYmF0UEsBOGfIlk5sE9Dw`
DQpQSwMEaG90A9/.FfvDpP
506VWlEQs
7~,gvVyIwZmXh/oVtt0-gVsdvNR/+LaMqquFQ7+a9HC35__N/n8E0aS97E5q1Hf3Co4U//X}OM=isD/6]
cHZiGHwGwXWL
ZoHDaP55/GjrC7CUtTGVwBSxhKa!
gDsFIB~^L
~TgL8W1Jyzg4wBB>HhCzn+2j+4c
tY+fZbv99y7ltK
WK[mOJ01DxsnHFgFN1gXv+dNwf
Zl6CCQBv+3WK_
xIXNJey5zLTlzlmVo
H7/YPc
18JJA2/mIDXio4U+6G
Qh3Ar3w*jZA1SdF_%jhsMIdyDj
ScjGWoiP2z9xDW5DG
z+mB98T7NZ6u[yEJfzOX7uU1Y
GrcxxWrISaUmYcdLI
Azk/AwFqwZ78t+lYw3Jhy
j5EPo1In4dCYrP6f2M1 TbQoHAHkTqTtR0pngg5THohUqBX2t8VjjVTaIEohPqBnBwb9k4/5Y3n/
VR3mv802CyOmT2
K5KW2k2IoTVrCk9o_Rmg0BJXG/
(RgfCGaqADydk/h
FyEHBOPw1EqKRYxSrZ%
qMZIJR6pH/cExqkWo!JGNSUMbGJ
$Y"/:Sv
^t6r+unMWo41/j
OxMJ4g
3b+rVGY5xR%4G1E
^WLOy/X3P6vzeP
H*z[a5CGwK
3lID/pDF1iVhMjqP9WvFpAnQxImQjD
HtnWQiKLk.7Rx
cVH3y&94/zMzJp/dlU
y+DeGqJ;EOcgdKYFe7vR4nvc
ldT6uBB#u3M6J?k8iqT
sT0Tj8L
gxv_jzqa/pXWXq79j_F
ZDuo68.|i8Bmk
H/tKMI2l\zC8ldSKKuJKgxbxv
0qL4TxvPPQjVZZtxo7
XO5EnZ9wzjg9Z
cW_bzhfEfSi
mEw6uqo26I
PHfN9GY.lMmx7TeTzciBqK[
LV7W:RUvcAP
PZvM3HE6
7.1kn1~(
gDF6XrBDltTHVlM
bHW/5.mm14kD7cpZNc^w
Piw^5g29ZFZB
kSXnsIKaAEZKxNp
cPV28I;
~RUS9XkNb4hzK4
8+Qfb5
.gY/Vacix11r
p0jWFSkCcUn/43
xBjXaV
a`JB2Mi-2e
xkB1I9txXg8Qz
O+G^xENxPYRfcQf6JzbnDkEULyiBuXK1NxOuV
/pTU>cSMcp9V
OZGyJn3N4
3n-KfM9u^J6_@a0
m7UY5J8DGitVZrOGXWv.ZHM
6+}kLR/o
U29MdMH5cyRWfXdge
82FO7h7!zR[1*g3j}0B
U{>v2wXzB
tWj)\YC
T@V/I2RV
H*-Gk+Oq1@p,
1BV6.0/
lRSND}1
mn[cC44XuG4Vk/PlOxfmL(T"poVZ
5P`D%X2u7
hlt0sS<`jOj]UUZYK7x40
,PkdC8/}J8QoPG
FG"roUBUQlqt[DP4mt/qUpf<3
\jwqpKq
OR8w-fxOSBtlF
oW6y896Bw5V3T
MLPfa/&
t*BlraK,
Yh1C5R%
g5^@B761dl
ll0Q`E
mphK+VPdCmB
&bu7o,\3MqJP0i/pBMf0$e
]n7XuxJlVh%J@h
5>.ozuPZZhfV4q
oTFbQXF*UqIVVa2
0YBv0h
%6U9dPnca6
G1B0vk
HeJl2d1
[J/{sA5n
Z,}p3~,6Y
%kfjIh\*BC!#
0"GPBJTYq0qR
]kBa1PhDxNYN
JU+cz/-.,Ojwb*2Rwmk2N49h
Q.mrW=BUUZh\1mCczK_h
pEGgNrFv|
XkF<YROkXd
66j`ul
8poAbnd""baYbo/7
_7c55ZsibzO7_[lml44lfb[oZrf>7
Xi5HN4
VtOh[b
IQjZKmQbq?X
TyGPjS.&*IL*[j*
GL+WU*
{OvblRjqZQvOl
Q<LPMpbF
779TAjQ`G5
lCXMngp
6x9oQdUGvq}]*
/Z<HYQJ
X*k`TI
K/+0mDK8+S
?PUD1x
DBZJEaG9(u52TQa
ABzw20
uwCL4*JV
Vq,<BIaO<2l
DhV.]|EKM
nnnZDyZ1CNhFFGx
01jy|~ UWC
s*aZ>N
@5t8mT+9O0QD(8KKh6r
mdnK]Z65ixt
\76VJBRrsbzt0l(+Wm1(pbKBF_5n!
(a4R6PYv26FRLlDz
RoOPOhX)9/@_Q(Z
]=Gzqq^0QjY{pyc
iXmB[oOrf3tP/
9DFgq>
Z}OByXj
RrzSzC
JmKx4GZ~
V:6/P5DX$%
\qJnUV[Qz|H
7Pf9eoT
Zmh,1eC$
mKQbMY4eLjoKwFubWkPU
LwItz6mZV]j*
Lt$E6Vw23+ju
2@cIg3h
rkXMTn7
.Z2qciR8/fR0beb
mUZdc*}+
86CU7"u.
wj=bPj
[pT+gEI
mgf70O#Qb
*_8i{PE
ihJHDN(
DB<Zz5
r9Y8yyG*
Idqj4%D[
kSflWQ8
lpA7A69
XmifoM/
+KlgMXwP
?a2!vQ
03qXBmgf*9Ohp
dug0n{]pcJpixIuOzUXtxsu8lo*turZ@vuEPto.T%/Y3+f#8fbPxN/AysvU 7BM4W%~0/
WHd5y6
0ifeF/5GTe5/2D*QbyD9/AF*
SPbx/FPW9piu
K.TZIHke
qBbsrM
vo+arP
K4C16oy4
(+&RI+l
?H6BjF
4nPhyR
BwNk8QrUakG2J
0OZ6mmf
RFd1fVRWbB
5n"sWJ/y
.YLZjr
nYjZg~jk
Bmrxk7ibRv:Gvi1n5v
H87SpmVhLSv
[lyTL5jzQr{rw1
Dh3RL0Ag-\
O4DCwQAq
ogcQuvz7
5=9aIBjKDSGk
g,pUZBin5[`Guv{/UW+Jzv8_(+x0
e2aHt)7EWBofWCqAJ}BS0%J5a
B-QiIg-
YlErFk
Jae5UJ;T(-qF
_l1KgJO
[WkKJcD3
AdSOPm
ZR@UPX2
XX-p|tm
Mr-d;,
"/mU?Ysr-E[k1n_L56
4"C>Q%kE\i
?@+_ME-S;^41.muYk,
BbhPyL
l-\A+oT3
l~[" fuC%ut.t2/V8FU!x=
t -[J527DI
jiU_E?^a_Qp
IA(JH{`
XLSA.,F5
G-s6<~x
~mr/M,T,W
ui,78
qXF/'.
'@Y~?f(
iOvsj.~u
xb\uB>&F,
\ja-93
:zz 7o4
i_a`'r
Mc_l:kavc
hbvm6cdh
c\^g5!
71(#D,g(
16b~f
xxRy%V
J5^ViJC2
I7k(H.<pL
*pS>#Xef
BEoa!}u _ !o)f
s1/cg)
RFw.N@32z
@n!/A_+
^__j2.91~
erA2GX
Copyft
fm7FClf
SizHCaD-
vB0<s^A
r2n>HpA!
A;cpZo_;&LwRUnw
mom1ckuu
lch&$3
[k!daOp
teC-Aa
nVLCM
By\To[dea
!LZgthofDD
>.dUprA|v
(wvsprtfl-I
)D0qdnen
bYs4yA|
$`-7 -
mOsKm%O0
GPGWHU
KERNEL32.DLL
ADVAPI32.dll
SHELL32.dll
USER32.dll
WININET.dll
WSOCK32.dll
LoadLibraryA
GetProcAddress
ExitProcess
RegOpenKeyA
ShellExecuteA
ShowWindow
InternetOpenA
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
<b%O12
VirtualA
ockenP
M"xV4
eWEf;`
|WS|t$
x(VC+WL(5
WT3!:t
$($+Db][_^D*$K
;sgt6PH
n;0&AvQkq
?uH\`q".d.
MesagBoQ!,xAS
!hecksum on~imd~~Tt
_._;+.52:
t#|K=)RY$
Ejh6P?03?PTW
[0;WvDtH
fuf\X<
]H?U8oYMT
Ps#B@;mi
?kE>+5
duBpG|
B'1gR`
W&6sM~&*% t
N%hMv=Ix
!| ;s*
$9sCPQ
}C@;s+
+HU#L!e0s
}!DAxF
PT(0EuQ^
#N?/2<l
!4X0QM'
"p)|U$0
s>{@<*P`
vEsxEKJe(0
5'? uC
-F1W$$-
Iwtxly
t5;*0u
(CgtMsb\}(K
m6Z`;2=2B@ua
r#.Pb}
5nH+6C2_&^ |
$/B_^;Dd t>E
}(,TvW
P;w(>c;&$%S
P";2O:MWQN
dNK!{PWQS
,FP'R|
)N6N\=
JRT?f@R[%
YfUWE\@
P_q62))>o
'1jNAA
9Stt"e
g%AplicatteLThp
%sof<lb v_[6i^*SDLG.5xd,a
nl 3Fil
law9Uftf
HandOp?V
GtMN-Sl
AADfp=c
`t$$|$(33
r+|$(|$
USQWVR
ZPR3C
Z^_Y[]

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.