1.2
低危

1ef916b26401b2d28ec4850e33ff717c6e0333efa08efa2b9b3b7a2580ca1a8d

1ef916b26401b2d28ec4850e33ff717c6e0333efa08efa2b9b3b7a2580ca1a8d.exe

分析耗时

194s

最近分析

368天前

文件大小

84.9KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN WORM SYTRO
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.77
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Malware-gen 20200307 18.4.3895.0
Baidu Win32.Trojan.Agent.aaw 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Kingsoft None 20200307 2013.8.14.323
McAfee W32/Sytro.worm.gen!p2p 20200304 6.0.6.653
Tencent Worm.Win32.Sytro.a 20200307 1.0.0.1
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': 'MIZwSMcb', 'virtual_address': '0x00019000', 'virtual_size': '0x0000e000', 'size_of_data': '0x0000e000', 'entropy': 7.876634655464009} entropy 7.876634655464009 description 发现高熵的节
entropy 0.9824561403508771 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意 (50 out of 63 个事件)
ALYac Generic.Malware.SN!.BE619FD8
APEX Malicious
AVG Win32:Malware-gen
Acronis suspicious
Ad-Aware Generic.Malware.SN!.BE619FD8
AhnLab-V3 Worm/Win32.Sytro.R287080
Antiy-AVL Worm[P2P]/Win32.Sytro.j
Arcabit Generic.Malware.SN!.BE619FD8
Avast Win32:Malware-gen
Avira WORM/Soltern.oald
Baidu Win32.Trojan.Agent.aaw
BitDefender Generic.Malware.SN!.BE619FD8
BitDefenderTheta AI:Packer.5B5E29E221
Bkav W32.FamVT.SytroA.Worm
CAT-QuickHeal Worm.Soltern.A.mue
CMC P2P-Worm.Win32.Sytro!O
ClamAV Win.Worm.Soltern-1
Comodo Worm.Win32.Soltern.NAA@4p1der
CrowdStrike win/malicious_confidence_100% (W)
Cybereason malicious.5a5454
Cylance Unsafe
Cyren W32/A-0d153e6c!Eldorado
DrWeb Win32.HLLW.Sytro
ESET-NOD32 a variant of Win32/Soltern.NAA
Emsisoft Generic.Malware.SN!.BE619FD8 (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan2.QBCK
F-Secure Worm.WORM/Soltern.oald
FireEye Generic.mg.50877fb5a54543eb
Fortinet W32/Sytro.AVCT!worm.p2p
GData Generic.Malware.SN!.BE619FD8
Ikarus Trojan.Win32.Qhost
Invincea heuristic
Jiangmin Worm/P2P.Sytro.j
K7AntiVirus Trojan ( 0051918e1 )
K7GW Trojan ( 0051918e1 )
Kaspersky P2P-Worm.Win32.Sytro.j
MAX malware (ai score=84)
MaxSecure Trojan.Malware.300983.susgen
McAfee W32/Sytro.worm.gen!p2p
McAfee-GW-Edition BehavesLike.Win32.Sytro.mc
MicroWorld-eScan Generic.Malware.SN!.BE619FD8
Microsoft Trojan:Win32/Ditertag.A
NANO-Antivirus Trojan.Win32.Sytro.fybx
Panda Generic Malware
Qihoo-360 Win32/Worm.Sytro.B
Rising Worm.Soltern!1.A328 (RDMK:cmRtazo8NB1bJ1T8gSxdbbAZlWB1)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos W32/Systro-J
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

PE Imphash

0e836bd3be54eeeafd05573d50eaca49

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
ukiwGhLB 0x00001000 0x00018000 0x00000000 0.0
MIZwSMcb 0x00019000 0x0000e000 0x0000e000 7.876634655464009
.rsrc 0x00027000 0x00001000 0x00000400 2.9472922041417076

Resources

Name Offset Size Language Sub-language File type
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_RCDATA 0x000242dc 0x000000b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_RCDATA 0x000242dc 0x000000b4 LANG_NEUTRAL SUBLANG_NEUTRAL None

Imports

Library advapi32.dll:
0x42727c RegCloseKey
Library KERNEL32.DLL:
0x427284 LoadLibraryA
0x427288 ExitProcess
0x42728c GetProcAddress
0x427290 VirtualProtect
Library oleaut32.dll:
0x427298 VariantCopy
Library user32.dll:
0x4272a0 CharNextA

L!This program must be run under Win32
ukiwGhLB
MIZwSMcb
Boolean
Integero
StringPn+
TObject3
v[6`ysm
Irface
\dK^dd
Tna6dk?
undArray<
2 \XT2 PL
2 6 c~V
$i-G;COs
4Z]_Gsw
^2O;rl
J8n{{{
)T{guDdn
V\{;t#
URux&G
7$KvkLp7
s+An#c4
,IztTR
vtPFIFHF>5
xaS;Tu
vH 8S(@
;s[s+D
Yg:58F
~2d"hCl=E
t)W*q*1Sc
+bPUo]
;0KVW*)
s!qABu
M] !T.nl
E"1!E*q
"c3**]S@Q[|
+\0vH;=
U`1bm`
3YwA:S4t
y13\Zl
yXu1s{E3
=E7!,;.
[!t1|9
<Kl/ v;"{
8+;!n+l;>
>3Q&782
w`B-g)U.nc=7u
<zwo}
yXZG=_c(
nn'6#@!
Huv=,o
XJ8+4PX
-je[Gm
/w)f%.
kR?Q.&
9uEN~Z
Y)RB!Z
LX0tJS
zO";x+
O!G1hGK
001!R#-^
.uK?90
pP~l#b
F t-tb
+tQ~_$xtZU
w%9&Ww!
ExC[)A
c*tAN lfL
UY12+FS
$Xjt5x
x+m-?9
!$-5V@~d@2@t
gDZ[wxhi@%Cn8|M
CO8GvO
@aQYR@
b@"E@|oe@p+
BkU'9p|B0<RB/~QC/j\
Cv)/&D
dEJzEb
9;5S]=];TZ T7a
nR`%uYnb5F7
%S'(#0(
9{MUh]
F|@2dg
fp/U?f$
OFTWARE\Borland\Delphi\RTL
FPUMaskValu5"-9
2<lIu{@X3l
;97uKhM
IYVPc-
6V&v<VAAI!]!s
Xsjx]
-i+1ZHw
&U`)LZ
f[lx~YZrXV)iB
{P(, ;YY
9+su_\
^^Ba}O1
*]BN\1
/M&;I[
.QqJI%
R;MrZ
8!ugj~H
[Cao4L@a9
*p$G+ot%A
^Z7@L+
KuBf&v`
q7ZTUWV
zHZkY9
/'=t&,*
E<tq(I?
u\T;S*D
j`lwS}.
Rn]Cpth
Z<D~t-w~
dlx];~
?eA^_['
76Nv8,_QDQ
=NuG'$!
Bp8lXk7l
Q~)~$P
RZl ET
./-Rf;0 u
LA?_P/
CaAD#.;
Q`H2;K
PDPS1JL
m:v`oW
/pbaQL@
0y&H@[0
S`-Xk&J|
9})RP
#MP#0N,||*|}&N~")~%/)
@;1OWJnjQx
)pk$S6L~Hht
1hL{@9y
(P? vB2!p@
OIW?mtXS$
gtrc@QTAZ
i%>Q\vBT,
.oK-L xO
#D,;jX
CR9dya}X
]r(eTX
E Z#QT
4EtXk
dAptxdA
'$$Bd$
YYwUx{
w917S9r
`ri=Ahy%`/+]\
@E|.-.
sb8IEp
2_b0XwJH
VCLs@rE4}\k
h^%m&F;E7vtX
bZUM)MN
;i+UOZ
JO8|"GJR+uj
3gLk;+;~
cfh5q.I`8'V{
hCkRZXN
u+1dEC
Pdjm3BC"C
WOhD`D
v[u*m+Z,XC
7zS@=M
+H)^@_
kernel32.dll
athName0#A
AAnE#hw
sl$bb@
ta!#6,b
x Tb3},
Qcale&
/OC"RS
x7Y-emu0J
=W9cK%
gkQX8d
8EKDE#
St+L+$
4(*(Cu"Jr@tPF
}~7(qM
rV9,/F
2Ftl?vo
-$fkw%Mf
B@M38s
BS!wN[m;
@t72W
]B@`-X
a-7V>Y
W4OG)d
@,Wt.Y
A0ZwkY
8ec<(+
A@x,k-
2 xtp2 lhd
2 8402 ,($
#cp$pN
Exception$},q{
ppgEHed(;apZ[
EOutOfMemory[
EIn]Err
y[4rW4r
sWDsr*
EDivByZoW
!CRalngeWF
Ov]"lowsPt[PtXXc
idEVOpmW
2YeXWX
B#k`@PVW"
__(kPoind[
{zEAcssVla|_|
PrxleW
EaStack0x[4
B0xCot
.jlCkWx
6FandDy
f88[y+
SU{5UzWTz/
Safe~7 Ql?
U"ls#4!w
$F]({PK~;
TThr?dCu
x0'2v
$TMul>R
steWlVncN*izer+)0
AoDjZw
%"9't*^
[T6[7.\
WA38ZwQ
s,sF+U.G,
,fQ@|Z
b[#Tx):u(\
(R-Dcp5W"
\+A:`\:
^"8t[^_3-j30]1
~aFWf$
W/%=T't!)S}
%3 @t[CPe_\
D@'F_%,*It.
cFYs+?q
R 4M(_
e"mt<:u
G]ZYNsD<*50r=<9w9iXb
(]\GK4
lRiW0vw_M)^D]
9u-AN,
"[wGGD
u:A#R[<
N;MwS5
NtryM=
l=!b1l}&
Fp"z,8}
8~ZM4H(
)E]UJU"}6
[~iHCTF
Auakf.Jys
<D*Lm,4
|)A->
73l#}j
( M3R~x
CDHeU2v
"|`lKr8"C{
K,]Mp$Gv
9wHuF:$
/mctF;s<j
#B?w1Ko
p:hC;~
D/r8.B
^!VM.90Yt
(Nu7-5
StR$5|#D
bF^"%G
} UTEmMa
k-F-9o
\}K*a**Mx
,Xg8;m5
ddYSU0(@!tHU
A3t7G5(
ZzVcClx
vgld7Z>cgcc[
(NFJ&#
s";UEuw
W4qGnA
@@aBLNg7
_:|+G{j3
utx}rV
(HwyCC@Q)+S+;vF
GG,g3#u
@B=uTn{
IuSv/)e`
y<%o4,
&2`?l8,:
@<ea!)6H]
{ AMPM
&sLM%bv
D{)4h7]
h\h\LZlK
_DiskFreeSp.
_#z3i*
@FL`G:
oD G/D
uv[up1)%
l(!+"?DWD
;FD3Lc
0sD,Q3
G@)\_22`
3'+Dw8
-]wdk[P$+
;vXU;B$`
x4pt]8h
;Hs#d7
|Xtp8xC7t
T$dsPL\&8L41
hS9.K>
DL2$@849$(
TCustomTyped{
$I"(Z7Z,
l-J>1b`
|wC3GDk
}P-sG@s(s<Pj
0bG6`$V
-V=^Kl+j9F2
iu.+"L
@SEIF(
{@%/P]
3M-;HW
5R+(:r
*6B`MQZ
ar[?( s3^:+]
_ktuue6!Od%Z&
)8XWK[I
&}zuiVm
PaY<g'
r(E]pn
U]E,A`
[Y4}EP&
a8pk._+
$!V1ee
Xiabfam0kBX"Ws
#;}H<!j
VQd6My
c\iot5
6:LV`K
v3#4"&
mNEDW|C^aC$M
|$HAD
"A,](w
r0U$[TT
'#@*:<R
ZH0o&CFFo(
MB&yvmTX{Q
8BO"((A
w%$[4Q
`eTGS
F!P /PX
rT<@^7
@%\k:$?
rt/}l#
IfF^'W
%,?Up$
^Lf;]Hbh
pMu"zcA
XsMJ,aEg#Df
7<d`6V
VEut9`-ub3<M
EBUvt-[
xz +2'
f\MHu%
)!O&gVx
l;U2_e
?X_LDVM
HHt*?lc
H\^|llF
1RP0'F<0
64OpRfMUFYyH*<
{vgI-X
5pW|`
}K,a.ERM
P@a=Kvi
P'=t!w
E@0>o'Q0"M
P6*.vc
yc!5~TK`i5-
6MJ-8Z@+RmB
.BpHs$
OnPRoavZ
160SVB
1Buv&bx
.taZP|
]co(lo
I7Fs#>u
^j^"k:
%oetv\&P
m+4$T*
n,YZ+HA'*
oc7x'|u
n\"h5&
C9~]_^?
Cq\p8 @p
(xYBQ9`4
aJGNnE
<jf"XW\JuQ9#
76C9;|
%i4CR7
Oh!-\<dxP:A
Pz]NJx
wv{2bbY
v,^[]7
Y=XwWQ
R@0(}
\*`}AM-
!A3KL`
t*E"0?
u/Y%'lt!
u`K'JKva--
Y+v0sP
'ti%!i
TLXaXD
vY;")
2[l]L@
Q@HKaD
uuJD ?~{{{:
7v>_^v
?IA}h|w|ZGDA)Zc
=xPMd= z:(\W
KlW,FE"a
MTb0 Zc]
y{bdNE
R&jkMQ\Q$Wu
PHE*<le?
7Sa2?{X >C
4UJB3r
/Peam7
}OpenY@
6 HWQr
EClassNotF C
+mponen^[UVD7
mP@D$%AE0*{])o
IsAdapt
D+@+K3
l!#?\[l
THa{u"1#L
DPrP?APv
rFiusa
1Qv\\(g{<
ky`tCY{(S2v
l{,qE({[
T!dz#Ab
YEkOAQ@
gGupsW/P
)XB4B1E
.*Z_Q^
%HzxV}
A!aG)G
V0X-E6@
)@Rz$(
!e;xTQ6&%s
h-b$Sk85
D=[#0 6
XVTcd|U
< E@:B5e)
^)1*RP
eZXEF@l
@,\DZ{
6/PM8]UK}
D#0>U,YZ>CD9
AK@";SVO
VU[l~,QPN
<lp@S~tO
OZMGME$W`1B#eEE
t<2Ph$#
9wP('+
$%EtW$
0H&jHsv@.9
!'k?z@U(.9>*
U.74p6
-K`.wr]e8,O
uhi%^[(UUv
A3Y+bVQ
"Hf0_^
Pn'/UXu
7+AX`D<
/M.#AMc@M#
U <%hl
C Jy,@Db`
- :!mu2Fp
;bMX:CKUM8
M4YTmm
43`*`%a1I>
/0qMUsl
1'9-wdMN
E,1BU*MXr
:hq)9G2xVN2#h
j2"I'q
W9H"223AW
A@9V|s
E&+CO@
dq>*CK
"C(H[Ol
W&]kPpKX~@#*\$
ddPt\S2~E
0ZCm>H*E3+\
CN#}=!
o-)|0|"
wM`#V(
I&i`p`#
]IxB&X@^)
rPp <A(tY
)hdgM=
-|J@}e.D:a
]A] (P`H{u
U7'jwtp
O:V;tV)u
^uO)BmTG
TPropFixjup;BT`wAAX\
]a&c|`EpF
(%nPiG
G'P0&k8
EHY$CE0
od0?Owner
$!?E_8
0bEAs/
Atk Srd). 5
Q8/!5wC
JXE8:[`M
2ZdT \DKt5\FX
,u&f(QXz
0x{I@
a8,52*R;X
UK\HA4u=W=D+t0
V{6N;w
)v, B`
D|{0"4E,
FDeg't
D,L7 ^0@
{rH("FQ
8!{NP,[!6
CP]Q-}}
X0,O]'`
q288mQXl%.[Y
}gxl,(>_0
{v3_?Xs.
LT3I7H/
\!"I3Il
Z#(UcP4
D2 wx/
}qYZ7<
M;bE 6\5
.uEp;XE+-<"
/(>uF|YFC
hgUgI0
xp`HY<
D;!Q>E75&v
2KxsE^SmI
(H\Y@sWn0#PV8VEAS28`X
$A[H__&~
j\a+p,
TTZu]!n
ie[>z
x=aTBBp`
/0+X03
!4#lYEGZg
4Gv@Gs_
R(mCu2'K
c+Z`P0
(HvX9u
c>A(J6
"XH_*v
GDW@V%
}TI"S`5
U/"TZ_jVq
?X6B&~/~V
E(a (8
08E-c@z0
NC~C<2j
U'!U"V
puifE'
ZPWA$x
y$*^F;
JYKjg&
Nkc^6{
x:w?[XY
l`dT@"
dpI">m
Qq4;?}&#U!
rw</F0X
aSeat"R
F"8Vr|
4KDA8R
poV>U%=
xLlY({k}
KgKqssVw
I:t1,"
~** u
P@d0Y,>#pUh
-'6X0 >%
cY%#XA
s{!)tK
Y>%f?Zh.(
M>&w,U/
gX fdourgu`
UqQ_Ah
u~,KWbtY{
Kvu!lh
,A;$@`
tpjybu
PY}ihHs
"(B|:B
lG*3m;`
u07^h}"
("H@@@x~J{
_~T@Y@
@uDz|#
EX7]>C
w'20>R
K;/MQBB
R_F|'M9
$3LntY
tl!4<Q
6QMEl09}
/YLC0Qp
&B(:S/X
q";"Q#
O(JiY|$
!B(\QDM
-AT[\g
)zH+lU?
tM]xUR^
Fi(.P4$L
K JA9R
eftTopO
[0!euD
Epm5"4ftt
$YZ_'`
4~lQzJz1H
1Fb;-E
8UBa?4
'JBPG@
IoxML%k]}
\Q5P1q=
RCgry,
<_<!kN
Tq<J_<h$@_
K\g4!bPl
upP4<$*fOh
N#E,UK
X*~[8W
92-vlF/j
l TMVct2 .C}
i!caW@
sOJBQC,5 P
B \r(X
[kdex"
r32>%ar W
s Ep@o" 2 - At Of Th
lkc.MeG+J]kenna Jam(,ABuilt2
n Speed7
s[DiVX] L(#on
7?Hvkmo"nd@5w6SLvro|
JGFCKY3 MKg
WbZTHILu
a7Child/!(S1|o!-}c+wohk+nla
}U b9d-+,H
oo0+Websi,s#n;:"cIMcc !
vHer#+M
{U+and7_
.W dj/XP[
(wK`2~Fl
h 5.0'ME
UncaS*
7utestpt
Xa)OFirewallIUpW* h, 6 KeGNhtok
hara%2ghKG
/AikaQus
Aenai.[ilwz9n
1sstalw
e-.r^IZn"WPr
SZ7Br1ou&kh
0FTAokB!g
vs!Ul*'v
?cBUt1..?a (WORKS!!)/*
Ef-Mb:d
lVXlf-7f
8w6Y+~K
GsW#@maLINE
_CD1++}!aap.
Ts)'aZaA 4Hsk.
8v29UNOFFICIAL/2
,"0cX1LP&v-0
s`A`c|P0AK
;\*j0 S?C
Xbc2[}H
ypCXpx
uHHSKM
6g!x_=V~-"j]fE
8@kD`
w>ddHt5
'fig-i
gxUpxs=
oP\KuTo
pV?|anQ(:f3
012<6345:
A8{RX5
P &aa!G{[
k[time e
K6789ABCD>{@EFz~@
i(08@HiPX`hpxiii
!X4(0
yrw|0xw\<x
D[1R0<
$pgpW/kC_p
;k s3mWY_
7nY;@
nNn;P8
|G7D+k
I3c,TU
aAeg-r
tu.{--
X76c)tk
f'5'l*
{xnmO_nGY
OQi3`]wa/l
XMA{ct1qH9f%C
WY8%y9@!MQlB
+En'''
A!t;:B
l}u)!q
kn/,d!
EkiaupC-Iw_
c0!1Gv}la
p 06mu-WlB
8.oAbo
CYe# Sd
>"Gk'v
0R7RqtPv
+%Suw us;RYz
egad+i
D/k!XmAx
n{cCxlp+
i;s[{wz/
gmh}kId'
I'H p GK1}BP6d
"RTLA5@s}
5QH\f-*x
teCri[(6S.
iz0Virtu
;AId`v
Add&ss
(QEL}B
7Rtl:w_k
aikH $
a#b0h@
>tWA%GD6C
umCM?!
[GT~Voue
@G%5t/
%FFbQchFS
UBound
?0m.bo\d
^NextA>
j`DAT)
v.i{\n6
'OP'e;4">H$
XPTPSWXaD$j
advapi32.dll
KERNEL32.DLL
oleaut32.dll
user32.dll
RegCloseKey
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
VariantCopy
CharNextA
[(rnNE`pV
fAl*/&=y9
a$~rSb
!(q:p~
@UDMTg#w|QU#),x
@HwGJ4
N-a4:
Kj,3o#ElyPL
C)S|kAj
Q:d6Jmv
|"wzs{4XxvsG|*(
{INoK^
l$"ebhtI'
bWWV":NJ}Z%Lz.'7
6l0p^Kn\@`K
k$(3.l
b[S6 dh\
?U)-/z
bZu,<D{
:oIf.*b
JfeQdf*d
o"/{|~
zaNbytn
/d|X`,
,Hoc1!Y&{
,sn}fdt
;u=dCW9
7{`N!W^
@h/%r4m/
vN-u[0
VzXU\ECo>uSI
R'2vC^k>l
*ZS1Lvu5
Lm_-/2\
5N.>P@E"*[h
,hQw '
p@[BhBh]+
N?l3CU
20n8inTB\K
##m`Ko
/j-s7wg
,lrDZh
|bC]r&=uSo
QR7L%k
V4<B%caYkX
jUf#Y%
>c"7@gX%
B7/8Wn
&o>pY[Q
tL/j6\MY
)8&(&Y|w@V
h<}4q[j
z~FFUNzf6A
k=oHQ7c!EH
25BUbV
10vMr$,t
qP!`)|`1yAg
2_%P]G
:$_0_F(3
?#` )7L
3d5;<|~
adiU2A>4h
00*W|QFed
2#|Cs[/..N2&!}KR6
3^-r6f7
+i,/B\D
|D3*]2uc
bvV!thG
&zG^/GT
/_Ays"GeT
73>>*EbU
_;1e$W%*Ztm
#t=i(EH
~n<g5Wsz)
.Fm'HJC
DVzE|J}G]:NE&
tM&c*2
.\/aCy
=vSq\-
CUMjCy$(
X=G;8kX|@
<$!5{CX
[1S,il.
]kB5gl
m;SQ"pG
kV|Y/ps
WUM9hA^=M
$X97>t
3_7Hro9/P,l@o
IQw7GA^
7"e"&!
p~q59zeA|#
EJi5z'
E:28cg4goHrv2Z
-y6!SR\(O,N[
see)%v
^pbrx[a)S8
254GtUU
%"`W+w-W
1;K|=@vxS
66lSC}
%LuNvcz>L
X[|Kry
REO<|V
-,>c`
|c/.t&LZT
FM"bp*VYNS
0VR5#^|OoH5
Gq9FW&
YUxN|&
D<H6[jSF^[
Si-gK@[j
Ml\ii9)
Q5Z6gfT1N.W
"*v@=mDC
o!fW*l-|+q{
]A>t\(.
,@B78=
<"@j+r
pq~(cDv#
Q?"4$wl_s
`pR%t}g
]ODUj`.oP/5R
he*}\|,`ip,d86
U7<eo]P*m
i$vqBM
JvW1'#bCTDTGL&="*Q
A6V+DpL
vj[&)&
AVnYl7-]
yr|@W-4!
1*x>OBh
!Dq~/x
g*cu184N
{%b&$N
r&mNz*-Wl
BYXJ`/NpDo
$f`Z|qcR
D:(@A<4
V3OpV[
!. <X?DI
;J$oyIR
x[)l(.Q
hG5.Ib5kV""~QC%,ep
T9C,<}7{I]=6
1(]9nb
!F^iW|
A5/n#>Q
<1k@,=E
INx!iw
I0Q"1/e
S0E"R|W
<b_vMTSl=FCOA;
|B Bveu4
r2BCZ.
)qP&uA*|
R`_n+AlaFb
_*G}`)
&(Ij5AM[
<"g'x]du{#E[brm=]N5-
- [6&Y;
/5gGw/
?N(BL%
R;3+%5PeR
21w]ak&Q
)#Y2tI
{=<ph0|2
pn%M5ar
2Y]k\w
#n)&O9ZyUh)%
6|^iy;o:
2p\Sp!WFB
5sjKa~
NFNw;?=N
O@xay=;Y
.j-$Yij
}0V5/m\
peJ5%YV
{co "*]
fD0'&Z-
6w;#.*Y[`Zu$|Q
%~IRV9
2qZ,cQ
Jx3Wa<d
l0{n\{
vnf\q]1
jLbtzsX{
^<'cG*?\3
)orX#.
<=i-gi
5N@hT8f
I^Iq_3F
} wZyN%Eq
IRah[>+xcKk?u$`
9V0Y(6q
vm[{{.7Yp
%w]z`3).^U
Wq=TId
qQbM(>
PXHsi[
V!us/@BcX
&|#pcaC
~=mks+'N
=->Q!]X$U6eELq
U+#b`(|kHc
+l:l},]rYib
OwMPxP#hq+
4$L,.!'C
RIfI"]kU94@l3&
Nv04sv<
_A,psAX
)zsKw_
|dycr
$:L7A`i3&cWEA
NfucU1
#nX:'
$GN}Q``JD| I
cD)OZ$h
qHMFio
eQtc{y7J7
=TavM1eU
1z#%*%
pA`}IJ(m=
q6"701%
6s$KKXzl~Zqat]
H'i-kpk<K
a6CJf+
G:jsG*
%XAp)-xl*K/s
rS<$~gY|v:
A!J,M>
&#~!]c%
eCGxo/4
<!#%BS
$=#h&&).
^ e:vZ
scru,o
jYL 7Z
u( Y5YV
BvOJCK
w3Q2kS|}
K2R%F~/Z4
bT7Xftp+I
u89Dj<p
S4vFrj
5?Ay5b220
1!>0|>m*S
Hm|wU?2LcZ.HWX+On7?
y:zR6L8?NX~5|}(6TS,>
??{I9o[9pKx
eP.da@La.V]
@MR hz
;2N-E%
V,r e?vD+37
9a,1eQ^
E{[a;kc
O7^yrO)KTd2
`>N4hRS
$O%NTRo;9
,,|bAWA
m@q)O|Cf
tGK(J}Gi
\L?]][vk|;'"^
05patY
(x"8f^
)L1<r;<
SS|L~,sbLV
.Z&"&Eh
|0qViR
S0\(]!u9
c4l|mr^
8pj{Tz
{BAvGBP+
H[s%)n
Y;zyQ]lOau'j
/>QcGHt
J1!s!]gwQ$
-.|*H<EZS
|V"~H>k;
w.{Ia
@S{ZUuAv(n4+
%DC"!E
[Xgp HL$L8
1DC3$sZdNv
rx%x{FO2/
XtF,WzTh
0j45^Mvccqd&
r{V-#E
B0u]y06-
j{+`wqc
MiGVDOb
S?=$H|
V*<^g=y
c?{~`W/
u\pI]n
Ascjjg!
0>O&Jbl
Kw2Ql^,Vfc!%94x)RI%
<E{(t~&fqV'x]
~fGj8duzC#
j&s#9UfA
08O:rE
OjS/;S/J
TN6m$Z}=3j-(D~tJf[9
X|j5k)
6hg bKq{%L |eHlQs)
Q@_vrd
}<a)opP
f7dD`n
yn[F=B
{npCk1I4{/dlcnh
x5F?k7&-|'k@7 /4F'
T)Vv~YgUl9v
eOpum9M(&
(k1)&+
TWo+}D_&
C+en$|
-];#wVxSs1
)|K{1
's&D<]~rL
Wf2*^.A
vB3UDo/
hkJ;?&v1
nUF;t^
.>lX0<o
;L9.L''
H$TjRu
!'$E_=[x-
dvC[]mh9C+E0bUq
>gnA[1
SyLD*=I?H"
`d'|,+!S[/
Nk'O2Qmk|F!'k
c{B]lH{a}8e`
f'_!@&
<Gw@obTIS03x.|v
cH:m/@Xt7
-='rBf>4
8-sBO&
m"<`_b
jDpYPb
LG>@bm0*pN]Uea
Xxo=\mpEY
<b[+ sEv4|{
Z2LcuP
f6R48Y&u<>f]Y7
:$GISo6(DlP
Z[SCDEF
9jyiJAokt
M3`mrk
l+;E'0|{
{s%;:0W
_Z#$If
"q},4n1n:*)|
ZN-m8
ur;:.1T:
vO3|qhKku(|v
__+88v!
}u[)96$
@c"'(iV4FB^o
nw"8nFX[
z/pr6]
I,s]O<cQ5<
deFt&.`K
aD\W)wf
vjbY4,)
uO_blM
Y5u`K,T=
mtWLLWg:ug1h`v
zCs%I
uZ%9K,h
#?F<E[
'9`Zb&
>'4ID|
{5x1ce
ZbEhpQ
_r}?:P25
"kA.?al
h*1-{n
rG]TC$
YQ^Mn|do
3QMQ8/;W<guT
0J$Z{3V}%CMGZ
a*W^PwaU9[\6i/q
l]Ce><bw9O{
||F9+s
YMU3R'
eX=o\A/w3`0,7Y
#Ym]cywb
]E4h`-%S
wYfjN:Q-1o/`[!
*"-eBF
\`_a&PF]v
,%1%-j|U
Vljm+D
{~wrQ{C^,b
&XM[zV
fR:r[m\X]#$
+QPS39&Q
mA 7^J
ZC)jI9`F]
8Q%a`m
3pf||m
>A_mZ%
|?oZoH~@4p`}.
Zyg\MIlv_0
ouX%-<x
Mi2!y1\
nsxgDy
)_uv+ KzsT
Qs_~/B|A
%9n5B}X_"nf
PTmE]
ATROqf(!
AjN9<(J9ulOz>
K2iUD"G
%f1g~Q
^9=-^u0x0
VWmk&-
UX@wOZ9
O,QAHSqk
cR1.q|-V?0{F
W2W\9]
,*9DV^UWO
]A{tBfC6EOO<[\RgA
wM{omN4CHH9
M]^E|Q]
]ZQ9'Jo
A?]vn{7%]
X?k;g'Qk|
Hw{phQ
=!||+^u%/
fU}s}!
RFd7s2F0f
MIy(_e__
D$(^@~
T\,3AjQ'7g}
pjqZU_P0N
XU4wKtN6L
qGw5T8%WXBae
U1&kaC
OMjtC)e5
`&y.od,@
aikJjlpW ;f
XcNW8fxo|,z
<WUa/!q
lNR4K}CT
D$*NY7r]Hp!75th
]6\D'l&v7h(NGh<\IqW
m*+S0Qw619
fh?$F%Z
omn*b`J6
Gy2M(W7
Fh:B#e:S
>&WD}<
^~k);]$a
6*_<RW
lfDGd5
*F<$Oz!;-k
{{qx0KEjz
I<1%GL"P
WNT1]S>ieJ?as,
[-M$x@{hvGk3I
Q6:{/u
e~8VpS
C>a]|b
=cRn/F
0*_a3{ya"
5Aopf
O*B4O y
hGvF;PZa sZ
l1z^5"-AkR3b)@G{q
9"QZGc|zO
oq%$xvdOz
Tp?N5B
A2p|q\s^oAKgp:
$tGKJ["r_VF
5a/'uA
oZ1K~$Xzd]ZF/\u
9,\wn95EDt
VT8[b|
Fr.{itp|
<C'7FyjW
3g:Qi$X-
SJ}O|,[^&
ibX[MRq{2nv
Xf':c4z
DVCLAL
PACKAGEINFO

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53
192.168.56.101 57665 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.