1ef916b26401b2d28ec4850e33ff717c6e0333efa08efa2b9b3b7a2580ca1a8d
1ef916b26401b2d28ec4850e33ff717c6e0333efa08efa2b9b3b7a2580ca1a8d.exe
静态报毒
动态报毒
CVE
FAMILY
METATYPE
PLATFORM
TYPE
UNKNOWN
WIN32
TROJAN
WORM
SYTRO
DACN
0.12
FACILE
1.00
IMCLNet
0.77
MFGraph
0.00
| 引擎 |
描述 |
特征 |
威胁分数 |
可能家族 |
检测耗时 |
|
DACN
|
基于动态分析和胶囊网络的可视化恶意软件检测
|
API调用、DLL以及注册表的修改情况
|
0.12
|
Unknown
|
0.06s
|
|
FACILE
|
利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类
|
二进制图像映射为的灰度图像
|
1.00
|
Unknown
|
0.48s
|
|
IMCLNet
|
轻量化深度卷积网络模型实现恶意软件家族检测
|
原始二进制映射而成的可视化图像
|
0.77
|
Unknown
|
0.21s
|
|
MFGraph
|
利用静态特征构建图网络以检测恶意软件
|
原始二进制PE文件的静态特征节点
|
0.00
|
Unknown
|
0.00s
|
| 查杀引擎 |
查杀结果 |
查杀时间 |
查杀版本 |
|
Alibaba
|
None
|
20190527
|
0.3.0.5
|
|
Avast
|
Win32:Malware-gen
|
20200307
|
18.4.3895.0
|
|
Baidu
|
Win32.Trojan.Agent.aaw
|
20190318
|
1.0.0.2
|
|
CrowdStrike
|
win/malicious_confidence_100% (W)
|
20190702
|
1.0
|
|
Kingsoft
|
None
|
20200307
|
2013.8.14.323
|
|
McAfee
|
W32/Sytro.worm.gen!p2p
|
20200304
|
6.0.6.653
|
|
Tencent
|
Worm.Win32.Sytro.a
|
20200307
|
1.0.0.1
|
该二进制文件可能包含加密或压缩数据,表明使用了打包工具
(2 个事件)
| section |
{'name': 'MIZwSMcb', 'virtual_address': '0x00019000', 'virtual_size': '0x0000e000', 'size_of_data': '0x0000e000', 'entropy': 7.876634655464009} |
entropy |
7.876634655464009 |
description |
发现高熵的节 |
| entropy |
0.9824561403508771 |
description |
此PE文件的整体熵值较高 |
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host |
114.114.114.114 |
| host |
8.8.8.8 |
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意
(50 out of 63 个事件)
| ALYac |
Generic.Malware.SN!.BE619FD8 |
| APEX |
Malicious |
| AVG |
Win32:Malware-gen |
| Acronis |
suspicious |
| Ad-Aware |
Generic.Malware.SN!.BE619FD8 |
| AhnLab-V3 |
Worm/Win32.Sytro.R287080 |
| Antiy-AVL |
Worm[P2P]/Win32.Sytro.j |
| Arcabit |
Generic.Malware.SN!.BE619FD8 |
| Avast |
Win32:Malware-gen |
| Avira |
WORM/Soltern.oald |
| Baidu |
Win32.Trojan.Agent.aaw |
| BitDefender |
Generic.Malware.SN!.BE619FD8 |
| BitDefenderTheta |
AI:Packer.5B5E29E221 |
| Bkav |
W32.FamVT.SytroA.Worm |
| CAT-QuickHeal |
Worm.Soltern.A.mue |
| CMC |
P2P-Worm.Win32.Sytro!O |
| ClamAV |
Win.Worm.Soltern-1 |
| Comodo |
Worm.Win32.Soltern.NAA@4p1der |
| CrowdStrike |
win/malicious_confidence_100% (W) |
| Cybereason |
malicious.5a5454 |
| Cylance |
Unsafe |
| Cyren |
W32/A-0d153e6c!Eldorado |
| DrWeb |
Win32.HLLW.Sytro |
| ESET-NOD32 |
a variant of Win32/Soltern.NAA |
| Emsisoft |
Generic.Malware.SN!.BE619FD8 (B) |
| Endgame |
malicious (high confidence) |
| F-Prot |
W32/Trojan2.QBCK |
| F-Secure |
Worm.WORM/Soltern.oald |
| FireEye |
Generic.mg.50877fb5a54543eb |
| Fortinet |
W32/Sytro.AVCT!worm.p2p |
| GData |
Generic.Malware.SN!.BE619FD8 |
| Ikarus |
Trojan.Win32.Qhost |
| Invincea |
heuristic |
| Jiangmin |
Worm/P2P.Sytro.j |
| K7AntiVirus |
Trojan ( 0051918e1 ) |
| K7GW |
Trojan ( 0051918e1 ) |
| Kaspersky |
P2P-Worm.Win32.Sytro.j |
| MAX |
malware (ai score=84) |
| MaxSecure |
Trojan.Malware.300983.susgen |
| McAfee |
W32/Sytro.worm.gen!p2p |
| McAfee-GW-Edition |
BehavesLike.Win32.Sytro.mc |
| MicroWorld-eScan |
Generic.Malware.SN!.BE619FD8 |
| Microsoft |
Trojan:Win32/Ditertag.A |
| NANO-Antivirus |
Trojan.Win32.Sytro.fybx |
| Panda |
Generic Malware |
| Qihoo-360 |
Win32/Worm.Sytro.B |
| Rising |
Worm.Soltern!1.A328 (RDMK:cmRtazo8NB1bJ1T8gSxdbbAZlWB1) |
| Sangfor |
Malware |
| SentinelOne |
DFI - Malicious PE |
| Sophos |
W32/Systro-J |
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
👋 欢迎使用 ChatHawk
我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!
🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
PE Compile Time
1992-06-20 06:22:17
PE Imphash
0e836bd3be54eeeafd05573d50eaca49
Sections
| Name |
Virtual Address |
Virtual Size |
Size of Raw Data |
Entropy |
| ukiwGhLB |
0x00001000 |
0x00018000 |
0x00000000 |
0.0 |
| MIZwSMcb |
0x00019000 |
0x0000e000 |
0x0000e000 |
7.876634655464009 |
| .rsrc |
0x00027000 |
0x00001000 |
0x00000400 |
2.9472922041417076 |
Resources
| Name |
Offset |
Size |
Language |
Sub-language |
File type |
| RT_STRING |
0x00024018 |
0x000002b4 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
None |
| RT_STRING |
0x00024018 |
0x000002b4 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
None |
| RT_STRING |
0x00024018 |
0x000002b4 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
None |
| RT_STRING |
0x00024018 |
0x000002b4 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
None |
| RT_STRING |
0x00024018 |
0x000002b4 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
None |
| RT_STRING |
0x00024018 |
0x000002b4 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
None |
| RT_STRING |
0x00024018 |
0x000002b4 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
None |
| RT_RCDATA |
0x000242dc |
0x000000b4 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
None |
| RT_RCDATA |
0x000242dc |
0x000000b4 |
LANG_NEUTRAL |
SUBLANG_NEUTRAL |
None |
L!This program must be run under Win32
ukiwGhLB
MIZwSMcb
Boolean
Integero
StringPn+
TObject3
v[6`ysm
Irface
\dK^dd
Tna6dk?
undArray<
2 \XT2 PL
2 6 c~V
$i-G;COs
4Z]_Gsw
^2O;rl
J8n{{{
)T{guDdn
V\{;t#
URux&G
7$KvkLp7
s+An#c4
,IztTR
vtPFIFHF>5
xaS;Tu
vH 8S(@
;s[s+D
Yg:58F
~2d"hCl=E
t)W*q*1Sc
+bPUo]
;0KVW*)
s!qABu
M] !T.nl
E"1!E*q
"c3**]S@Q[|
+\0vH;=
U`1bm`
3YwA:S4t
y13\Zl
yXu1s{E3
=E7!,;.
[!t1|9
<Kl/ v;"{
8+;!n+l;>
>3Q&782
w`B-g)U.nc=7u
<zwo}
yXZG=_c(
nn'6#@!
Huv=,o
XJ8+4PX
-je[Gm
/w)f%.
kR?Q.&
9uEN~Z
Y)RB!Z
LX0tJS
zO";x+
O!G1hGK
001!R#-^
.uK?90
pP~l#b
F t-tb
+tQ~_$xtZU
w%9&Ww!
ExC[)A
c*tAN lfL
UY12+FS
$Xjt5x
x+m-?9
!$-5V@~d@2@t
gDZ[wxhi@%Cn8|M
CO8GvO
@aQYR@
b@"E@|oe@p+
BkU'9p|B0<RB/~QC/j\
Cv)/&D
dEJzEb
9;5S]=];TZ T7a
nR`%uYnb5F7
%S'(#0(
9{MUh]
F|@2dg
fp/U?f$
OFTWARE\Borland\Delphi\RTL
FPUMaskValu5"-9
2<lIu{@X3l
;97uKhM
IYVPc-
6V&v<VAAI!]!s
Xsjx]
-i+1ZHw
&U`)LZ
f[lx~YZrXV)iB
{P(, ;YY
9+su_\
^^Ba}O1
*]BN\1
/M&;I[
.QqJI%
R;MrZ
8!ugj~H
[Cao4L@a9
*p$G+ot%A
^Z7@L+
KuBf&v`
q7ZTUWV
zHZkY9
/'=t&,*
E<tq(I?
u\T;S*D
j`lwS}.
Rn]Cpth
Z<D~t-w~
dlx];~
?eA^_['
76Nv8,_QDQ
=NuG'$!
Bp8lXk7l
Q~)~$P
RZl ET
./-Rf;0 u
LA?_P/
CaAD#.;
Q`H2;K
PDPS1JL
m:v`oW
/pbaQL@
0y&H@[0
S`-Xk&J|
9})RP
#MP#0N,||*|}&N~")~%/)
@;1OWJnjQx
)pk$S6L~Hht
1hL{@9y
(P? vB2!p@
OIW?mtXS$
gtrc@QTAZ
i%>Q\vBT,
.oK-L xO
#D,;jX
CR9dya}X
]r(eTX
E Z#QT
4EtXk
dAptxdA
'$$Bd$
YYwUx{
w917S9r
`ri=Ahy%`/+]\
@E|.-.
sb8IEp
2_b0XwJH
VCLs@rE4}\k
h^%m&F;E7vtX
bZUM)MN
;i+UOZ
JO8|"GJR+uj
3gLk;+;~
cfh5q.I`8'V{
hCkRZXN
u+1dEC
Pdjm3BC"C
WOhD`D
v[u*m+Z,XC
7zS@=M
+H)^@_
kernel32.dll
athName0#A
AAnE#hw
sl$bb@
ta!#6,b
x Tb3},
Qcale&
/OC"RS
x7Y-emu0J
=W9cK%
gkQX8d
8EKDE#
St+L+$
4(*(Cu"Jr@tPF
}~7(qM
rV9,/F
2Ftl?vo
-$fkw%Mf
B@M38s
BS!wN[m;
@t72W
]B@`-X
a-7V>Y
W4OG)d
@,Wt.Y
A0ZwkY
8ec<(+
A@x,k-
2 xtp2 lhd
2 8402 ,($
#cp$pN
Exception$},q{
ppgEHed(;apZ[
EOutOfMemory[
EIn]Err
y[4rW4r
sWDsr*
EDivByZoW
!CRalngeWF
Ov]"lowsPt[PtXXc
idEVOpmW
2YeXWX
B#k`@PVW"
__(kPoind[
{zEAcssVla|_|
PrxleW
EaStack0x[4
B0xCot
.jlCkWx
6FandDy
f88[y+
SU{5UzWTz/
Safe~7 Ql?
U"ls#4!w
$F]({PK~;
TThr?dCu
x0'2v
$TMul>R
steWlVncN*izer+)0
AoDjZw
%"9't*^
[T6[7.\
WA38ZwQ
s,sF+U.G,
,fQ@|Z
b[#Tx):u(\
(R-Dcp5W"
\+A:`\:
^"8t[^_3-j30]1
~aFWf$
W/%=T't!)S}
%3 @t[CPe_\
D@'F_%,*It.
cFYs+?q
R 4M(_
e"mt<:u
G]ZYNsD<*50r=<9w9iXb
(]\GK4
lRiW0vw_M)^D]
9u-AN,
"[wGGD
u:A#R[<
N;MwS5
NtryM=
l=!b1l}&
Fp"z,8}
8~ZM4H(
)E]UJU"}6
[~iHCTF
Auakf.Jys
<D*Lm,4
|)A->
73l#}j
( M3R~x
CDHeU2v
"|`lKr8"C{
K,]Mp$Gv
9wHuF:$
/mctF;s<j
#B?w1Ko
p:hC;~
D/r8.B
^!VM.90Yt
(Nu7-5
StR$5|#D
bF^"%G
} UTEmMa
k-F-9o
\}K*a**Mx
,Xg8;m5
ddYSU0(@!tHU
A3t7G5(
ZzVcClx
vgld7Z>cgcc[
(NFJ&#
s";UEuw
W4qGnA
@@aBLNg7
_:|+G{j3
utx}rV
(HwyCC@Q)+S+;vF
GG,g3#u
@B=uTn{
IuSv/)e`
y<%o4,
&2`?l8,:
@<ea!)6H]
{ AMPM
&sLM%bv
D{)4h7]
h\h\LZlK
_DiskFreeSp.
_#z3i*
@FL`G:
oD G/D
uv[up1)%
l(!+"?DWD
;FD3Lc
0sD,Q3
G@)\_22`
3'+Dw8
-]wdk[P$+
;vXU;B$`
x4pt]8h
;Hs#d7
|Xtp8xC7t
T$dsPL\&8L41
hS9.K>
DL2$@849$(
TCustomTyped{
$I"(Z7Z,
l-J>1b`
|wC3GDk
}P-sG@s(s<Pj
0bG6`$V
-V=^Kl+j9F2
iu.+"L
@SEIF(
{@%/P]
3M-;HW
5R+(:r
*6B`MQZ
ar[?( s3^:+]
_ktuue6!Od%Z&
)8XWK[I
&}zuiVm
PaY<g'
r(E]pn
U]E,A`
[Y4}EP&
a8pk._+
$!V1ee
Xiabfam0kBX"Ws
#;}H<!j
VQd6My
c\iot5
6:LV`K
v3#4"&
mNEDW|C^aC$M
|$HAD
"A,](w
r0U$[TT
'#@*:<R
ZH0o&CFFo(
MB&yvmTX{Q
8BO"((A
w%$[4Q
`eTGS
F!P /PX
rT<@^7
@%\k:$?
rt/}l#
IfF^'W
%,?Up$
^Lf;]Hbh
pMu"zcA
XsMJ,aEg#Df
7<d`6V
VEut9`-ub3<M
EBUvt-[
xz +2'
f\MHu%
)!O&gVx
l;U2_e
?X_LDVM
HHt*?lc
H\^|llF
1RP0'F<0
64OpRfMUFYyH*<
{vgI-X
5pW|`
}K,a.ERM
P@a=Kvi
P'=t!w
E@0>o'Q0"M
P6*.vc
yc!5~TK`i5-
6MJ-8Z@+RmB
.BpHs$
OnPRoavZ
160SVB
1Buv&bx
.taZP|
]co(lo
I7Fs#>u
^j^"k:
%oetv\&P
m+4$T*
n,YZ+HA'*
oc7x'|u
n\"h5&
C9~]_^?
Cq\p8 @p
(xYBQ9`4
aJGNnE
<jf"XW\JuQ9#
76C9;|
%i4CR7
Oh!-\<dxP:A
Pz]NJx
wv{2bbY
v,^[]7
Y=XwWQ
R@0(}
\*`}AM-
!A3KL`
t*E"0?
u/Y%'lt!
u`K'JKva--
Y+v0sP
'ti%!i
TLXaXD
vY;")
2[l]L@
Q@HKaD
uuJD ?~{{{:
7v>_^v
?IA}h|w|ZGDA)Zc
=xPMd= z:(\W
KlW,FE"a
MTb0 Zc]
y{bdNE
R&jkMQ\Q$Wu
PHE*<le?
7Sa2?{X >C
4UJB3r
/Peam7
}OpenY@
6 HWQr
EClassNotF C
+mponen^[UVD7
mP@D$%AE0*{])o
IsAdapt
D+@+K3
l!#?\[l
THa{u"1#L
DPrP?APv
rFiusa
1Qv\\(g{<
ky`tCY{(S2v
l{,qE({[
T!dz#Ab
YEkOAQ@
gGupsW/P
)XB4B1E
.*Z_Q^
%HzxV}
A!aG)G
V0X-E6@
)@Rz$(
!e;xTQ6&%s
h-b$Sk85
D=[#0 6
XVTcd|U
< E@:B5e)
^)1*RP
eZXEF@l
@,\DZ{
6/PM8]UK}
D#0>U,YZ>CD9
AK@";SVO
VU[l~,QPN
<lp@S~tO
OZMGME$W`1B#eEE
t<2Ph$#
9wP('+
$%EtW$
0H&jHsv@.9
!'k?z@U(.9>*
U.74p6
-K`.wr]e8,O
uhi%^[(UUv
A3Y+bVQ
"Hf0_^
Pn'/UXu
7+AX`D<
/M.#AMc@M#
U <%hl
C Jy,@Db`
- :!mu2Fp
;bMX:CKUM8
M4YTmm
43`*`%a1I>
/0qMUsl
1'9-wdMN
E,1BU*MXr
:hq)9G2xVN2#h
j2"I'q
W9H"223AW
A@9V|s
E&+CO@
dq>*CK
"C(H[Ol
W&]kPpKX~@#*\$
ddPt\S2~E
0ZCm>H*E3+\
CN#}=!
o-)|0|"
wM`#V(
I&i`p`#
]IxB&X@^)
rPp <A(tY
)hdgM=
-|J@}e.D:a
]A] (P`H{u
U7'jwtp
O:V;tV)u
^uO)BmTG
TPropFixjup;BT`wAAX\
]a&c|`EpF
(%nPiG
G'P0&k8
EHY$CE0
od0?Owner
$!?E_8
0bEAs/
Atk Srd). 5
Q8/!5wC
JXE8:[`M
2ZdT \DKt5\FX
,u&f(QXz
0x{I@
a8,52*R;X
UK\HA4u=W=D+t0
V{6N;w
)v, B`
D|{0"4E,
FDeg't
D,L7 ^0@
{rH("FQ
8!{NP,[!6
CP]Q-}}
X0,O]'`
q288mQXl%.[Y
}gxl,(>_0
{v3_?Xs.
LT3I7H/
\!"I3Il
Z#(UcP4
D2 wx/
}qYZ7<
M;bE 6\5
.uEp;XE+-<"
/(>uF|YFC
hgUgI0
xp`HY<
D;!Q>E75&v
2KxsE^SmI
(H\Y@sWn0#PV8VEAS28`X
$A[H__&~
j\a+p,
TTZu]!n
ie[>z
x=aTBBp`
/0+X03
!4#lYEGZg
4Gv@Gs_
R(mCu2'K
c+Z`P0
(HvX9u
c>A(J6
"XH_*v
GDW@V%
}TI"S`5
U/"TZ_jVq
?X6B&~/~V
E(a (8
08E-c@z0
NC~C<2j
U'!U"V
puifE'
ZPWA$x
y$*^F;
JYKjg&
Nkc^6{
x:w?[XY
l`dT@"
dpI">m
Qq4;?}&#U!
rw</F0X
aSeat"R
F"8Vr|
4KDA8R
poV>U%=
xLlY({k}
KgKqssVw
I:t1,"
~** u
P@d0Y,>#pUh
-'6X0 >%
cY%#XA
s{!)tK
Y>%f?Zh.(
M>&w,U/
gX fdourgu`
UqQ_Ah
u~,KWbtY{
Kvu!lh
,A;$@`
tpjybu
PY}ihHs
"(B|:B
lG*3m;`
u07^h}"
("H@@@x~J{
_~T@Y@
@uDz|#
EX7]>C
w'20>R
K;/MQBB
R_F|'M9
$3LntY
tl!4<Q
6QMEl09}
/YLC0Qp
&B(:S/X
q";"Q#
O(JiY|$
!B(\QDM
-AT[\g
)zH+lU?
tM]xUR^
Fi(.P4$L
K JA9R
eftTopO
[0!euD
Epm5"4ftt
$YZ_'`
4~lQzJz1H
1Fb;-E
8UBa?4
'JBPG@
IoxML%k]}
\Q5P1q=
RCgry,
<_<!kN
Tq<J_<h$@_
K\g4!bPl
upP4<$*fOh
N#E,UK
X*~[8W
92-vlF/j
l TMVct2 .C}
i!caW@
sOJBQC,5 P
B \r(X
[kdex"
r32>%ar W
s Ep@o" 2 - At Of Th
lkc.MeG+J]kenna Jam(,ABuilt2
n Speed7
s[DiVX] L(#on
7?Hvkmo"nd@5w6SLvro|
JGFCKY3 MKg
WbZTHILu
a7Child/!(S1|o!-}c+wohk+nla
}U b9d-+,H
oo0+Websi,s#n;:"cIMcc !
vHer#+M
{U+and7_
.W dj/XP[
(wK`2~Fl
h 5.0'ME
UncaS*
7utestpt
Xa)OFirewallIUpW* h, 6 KeGNhtok
hara%2ghKG
/AikaQus
Aenai.[ilwz9n
1sstalw
e-.r^IZn"WPr
SZ7Br1ou&kh
0FTAokB!g
vs!Ul*'v
?cBUt1..?a (WORKS!!)/*
Ef-Mb:d
lVXlf-7f
8w6Y+~K
GsW#@maLINE
_CD1++}!aap.
Ts)'aZaA 4Hsk.
8v29UNOFFICIAL/2
,"0cX1LP&v-0
s`A`c|P0AK
;\*j0 S?C
Xbc2[}H
ypCXpx
uHHSKM
6g!x_=V~-"j]fE
8@kD`
w>ddHt5
'fig-i
gxUpxs=
oP\KuTo
pV?|anQ(:f3
012<6345:
A8{RX5
P &aa!G{[
k[time e
K6789ABCD>{@EFz~@
i(08@HiPX`hpxiii
!X4(0
yrw|0xw\<x
D[1R0<
$pgpW/kC_p
;k s3mWY_
7nY;@
nNn;P8
|G7D+k
I3c,TU
aAeg-r
tu.{--
X76c)tk
f'5'l*
{xnmO_nGY
OQi3`]wa/l
XMA{ct1qH9f%C
WY8%y9@!MQlB
+En'''
A!t;:B
l}u)!q
kn/,d!
EkiaupC-Iw_
c0!1Gv}la
p 06mu-WlB
8.oAbo
CYe# Sd
>"Gk'v
0R7RqtPv
+%Suw us;RYz
egad+i
D/k!XmAx
n{cCxlp+
i;s[{wz/
gmh}kId'
I'H p GK1}BP6d
"RTLA5@s}
5QH\f-*x
teCri[(6S.
iz0Virtu
;AId`v
Add&ss
(QEL}B
7Rtl:w_k
aikH $
a#b0h@
>tWA%GD6C
umCM?!
[GT~Voue
@G%5t/
%FFbQchFS
UBound
?0m.bo\d
^NextA>
j`DAT)
v.i{\n6
'OP'e;4">H$
XPTPSWXaD$j
advapi32.dll
KERNEL32.DLL
oleaut32.dll
user32.dll
RegCloseKey
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
VariantCopy
CharNextA
[(rnNE`pV
fAl*/&=y9
a$~rSb
!(q:p~
@UDMTg#w|QU#),x
@HwGJ4
N-a4:
Kj,3o#ElyPL
C)S|kAj
Q:d6Jmv
|"wzs{4XxvsG|*(
{INoK^
l$"ebhtI'
bWWV":NJ}Z%Lz.'7
6l0p^Kn\@`K
k$(3.l
b[S6 dh\
?U)-/z
bZu,<D{
:oIf.*b
JfeQdf*d
o"/{|~
zaNbytn
/d|X`,
,Hoc1!Y&{
,sn}fdt
;u=dCW9
7{`N!W^
@h/%r4m/
vN-u[0
VzXU\ECo>uSI
R'2vC^k>l
*ZS1Lvu5
Lm_-/2\
5N.>P@E"*[h
,hQw '
p@[BhBh]+
N?l3CU
20n8inTB\K
##m`Ko
/j-s7wg
,lrDZh
|bC]r&=uSo
QR7L%k
V4<B%caYkX
jUf#Y%
>c"7@gX%
B7/8Wn
&o>pY[Q
tL/j6\MY
)8&(&Y|w@V
h<}4q[j
z~FFUNzf6A
k=oHQ7c!EH
25BUbV
10vMr$,t
qP!`)|`1yAg
2_%P]G
:$_0_F(3
?#` )7L
3d5;<|~
adiU2A>4h
00*W|QFed
2#|Cs[/..N2&!}KR6
3^-r6f7
+i,/B\D
|D3*]2uc
bvV!thG
&zG^/GT
/_Ays"GeT
73>>*EbU
_;1e$W%*Ztm
#t=i(EH
~n<g5Wsz)
.Fm'HJC
DVzE|J}G]:NE&
tM&c*2
.\/aCy
=vSq\-
CUMjCy$(
X=G;8kX|@
<$!5{CX
[1S,il.
]kB5gl
m;SQ"pG
kV|Y/ps
WUM9hA^=M
$X97>t
3_7Hro9/P,l@o
IQw7GA^
7"e"&!
p~q59zeA|#
EJi5z'
E:28cg4goHrv2Z
-y6!SR\(O,N[
see)%v
^pbrx[a)S8
254GtUU
%"`W+w-W
1;K|=@vxS
66lSC}
%LuNvcz>L
X[|Kry
REO<|V
-,>c`
|c/.t&LZT
FM"bp*VYNS
0VR5#^|OoH5
Gq9FW&
YUxN|&
D<H6[jSF^[
Si-gK@[j
Ml\ii9)
Q5Z6gfT1N.W
"*v@=mDC
o!fW*l-|+q{
]A>t\(.
,@B78=
<"@j+r
pq~(cDv#
Q?"4$wl_s
`pR%t}g
]ODUj`.oP/5R
he*}\|,`ip,d86
U7<eo]P*m
i$vqBM
JvW1'#bCTDTGL&="*Q
A6V+DpL
vj[&)&
AVnYl7-]
yr|@W-4!
1*x>OBh
!Dq~/x
g*cu184N
{%b&$N
r&mNz*-Wl
BYXJ`/NpDo
$f`Z|qcR
D:(@A<4
V3OpV[
!. <X?DI
;J$oyIR
x[)l(.Q
hG5.Ib5kV""~QC%,ep
T9C,<}7{I]=6
1(]9nb
!F^iW|
A5/n#>Q
<1k@,=E
INx!iw
I0Q"1/e
S0E"R|W
<b_vMTSl=FCOA;
|B Bveu4
r2BCZ.
)qP&uA*|
R`_n+AlaFb
_*G}`)
&(Ij5AM[
<"g'x]du{#E[brm=]N5-
- [6&Y;
/5gGw/
?N(BL%
R;3+%5PeR
21w]ak&Q
)#Y2tI
{=<ph0|2
pn%M5ar
2Y]k\w
#n)&O9ZyUh)%
6|^iy;o:
2p\Sp!WFB
5sjKa~
NFNw;?=N
O@xay=;Y
.j-$Yij
}0V5/m\
peJ5%YV
{co "*]
fD0'&Z-
6w;#.*Y[`Zu$|Q
%~IRV9
2qZ,cQ
Jx3Wa<d
l0{n\{
vnf\q]1
jLbtzsX{
^<'cG*?\3
)orX#.
<=i-gi
5N@hT8f
I^Iq_3F
} wZyN%Eq
IRah[>+xcKk?u$`
9V0Y(6q
vm[{{.7Yp
%w]z`3).^U
Wq=TId
qQbM(>
PXHsi[
V!us/@BcX
&|#pcaC
~=mks+'N
=->Q!]X$U6eELq
U+#b`(|kHc
+l:l},]rYib
OwMPxP#hq+
4$L,.!'C
RIfI"]kU94@l3&
Nv04sv<
_A,psAX
)zsKw_
|dycr
$:L7A`i3&cWEA
NfucU1
#nX:'
$GN}Q``JD| I
cD)OZ$h
qHMFio
eQtc{y7J7
=TavM1eU
1z#%*%
pA`}IJ(m=
q6"701%
6s$KKXzl~Zqat]
H'i-kpk<K
a6CJf+
G:jsG*
%XAp)-xl*K/s
rS<$~gY|v:
A!J,M>
&#~!]c%
eCGxo/4
<!#%BS
$=#h&&).
^ e:vZ
scru,o
jYL 7Z
u( Y5YV
BvOJCK
w3Q2kS|}
K2R%F~/Z4
bT7Xftp+I
u89Dj<p
S4vFrj
5?Ay5b220
1!>0|>m*S
Hm|wU?2LcZ.HWX+On7?
y:zR6L8?NX~5|}(6TS,>
??{I9o[9pKx
eP.da@La.V]
@MR hz
;2N-E%
V,r e?vD+37
9a,1eQ^
E{[a;kc
O7^yrO)KTd2
`>N4hRS
$O%NTRo;9
,,|bAWA
m@q)O|Cf
tGK(J}Gi
\L?]][vk|;'"^
05patY
(x"8f^
)L1<r;<
SS|L~,sbLV
.Z&"&Eh
|0qViR
S0\(]!u9
c4l|mr^
8pj{Tz
{BAvGBP+
H[s%)n
Y;zyQ]lOau'j
/>QcGHt
J1!s!]gwQ$
-.|*H<EZS
|V"~H>k;
w.{Ia
@S{ZUuAv(n4+
%DC"!E
[Xgp HL$L8
1DC3$sZdNv
rx%x{FO2/
XtF,WzTh
0j45^Mvccqd&
r{V-#E
B0u]y06-
j{+`wqc
MiGVDOb
S?=$H|
V*<^g=y
c?{~`W/
u\pI]n
Ascjjg!
0>O&Jbl
Kw2Ql^,Vfc!%94x)RI%
<E{(t~&fqV'x]
~fGj8duzC#
j&s#9UfA
08O:rE
OjS/;S/J
TN6m$Z}=3j-(D~tJf[9
X|j5k)
6hg bKq{%L |eHlQs)
Q@_vrd
}<a)opP
f7dD`n
yn[F=B
{npCk1I4{/dlcnh
x5F?k7&-|'k@7 /4F'
T)Vv~YgUl9v
eOpum9M(&
(k1)&+
TWo+}D_&
C+en$|
-];#wVxSs1
)|K{1
's&D<]~rL
Wf2*^.A
vB3UDo/
hkJ;?&v1
nUF;t^
.>lX0<o
;L9.L''
H$TjRu
!'$E_=[x-
dvC[]mh9C+E0bUq
>gnA[1
SyLD*=I?H"
`d'|,+!S[/
Nk'O2Qmk|F!'k
c{B]lH{a}8e`
f'_!@&
<Gw@obTIS03x.|v
cH:m/@Xt7
-='rBf>4
8-sBO&
m"<`_b
jDpYPb
LG>@bm0*pN]Uea
Xxo=\mpEY
<b[+ sEv4|{
Z2LcuP
f6R48Y&u<>f]Y7
:$GISo6(DlP
Z[SCDEF
9jyiJAokt
M3`mrk
l+;E'0|{
{s%;:0W
_Z#$If
"q},4n1n:*)|
ZN-m8
ur;:.1T:
vO3|qhKku(|v
__+88v!
}u[)96$
@c"'(iV4FB^o
nw"8nFX[
z/pr6]
I,s]O<cQ5<
deFt&.`K
aD\W)wf
vjbY4,)
uO_blM
Y5u`K,T=
mtWLLWg:ug1h`v
zCs%I
uZ%9K,h
#?F<E[
'9`Zb&
>'4ID|
{5x1ce
ZbEhpQ
_r}?:P25
"kA.?al
h*1-{n
rG]TC$
YQ^Mn|do
3QMQ8/;W<guT
0J$Z{3V}%CMGZ
a*W^PwaU9[\6i/q
l]Ce><bw9O{
||F9+s
YMU3R'
eX=o\A/w3`0,7Y
#Ym]cywb
]E4h`-%S
wYfjN:Q-1o/`[!
*"-eBF
\`_a&PF]v
,%1%-j|U
Vljm+D
{~wrQ{C^,b
&XM[zV
fR:r[m\X]#$
+QPS39&Q
mA 7^J
ZC)jI9`F]
8Q%a`m
3pf||m
>A_mZ%
|?oZoH~@4p`}.
Zyg\MIlv_0
ouX%-<x
Mi2!y1\
nsxgDy
)_uv+ KzsT
Qs_~/B|A
%9n5B}X_"nf
PTmE]
ATROqf(!
AjN9<(J9ulOz>
K2iUD"G
%f1g~Q
^9=-^u0x0
VWmk&-
UX@wOZ9
O,QAHSqk
cR1.q|-V?0{F
W2W\9]
,*9DV^UWO
]A{tBfC6EOO<[\RgA
wM{omN4CHH9
M]^E|Q]
]ZQ9'Jo
A?]vn{7%]
X?k;g'Qk|
Hw{phQ
=!||+^u%/
fU}s}!
RFd7s2F0f
MIy(_e__
D$(^@~
T\,3AjQ'7g}
pjqZU_P0N
XU4wKtN6L
qGw5T8%WXBae
U1&kaC
OMjtC)e5
`&y.od,@
aikJjlpW ;f
XcNW8fxo|,z
<WUa/!q
lNR4K}CT
D$*NY7r]Hp!75th
]6\D'l&v7h(NGh<\IqW
m*+S0Qw619
fh?$F%Z
omn*b`J6
Gy2M(W7
Fh:B#e:S
>&WD}<
^~k);]$a
6*_<RW
lfDGd5
*F<$Oz!;-k
{{qx0KEjz
I<1%GL"P
WNT1]S>ieJ?as,
[-M$x@{hvGk3I
Q6:{/u
e~8VpS
C>a]|b
=cRn/F
0*_a3{ya"
5Aopf
O*B4O y
hGvF;PZa sZ
l1z^5"-AkR3b)@G{q
9"QZGc|zO
oq%$xvdOz
Tp?N5B
A2p|q\s^oAKgp:
$tGKJ["r_VF
5a/'uA
oZ1K~$Xzd]ZF/\u
9,\wn95EDt
VT8[b|
Fr.{itp|
<C'7FyjW
3g:Qi$X-
SJ}O|,[^&
ibX[MRq{2nv
Xf':c4z
D V C L A L
P A C K A G E I N F O
TCP
No TCP connections recorded.
UDP
| Source |
Source Port |
Destination |
Destination Port |
| 192.168.56.101 |
53179 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
49642 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
137 |
192.168.56.255 |
137 |
| 192.168.56.101 |
61714 |
114.114.114.114 |
53 |
| 192.168.56.101 |
61714 |
8.8.8.8 |
53 |
| 192.168.56.101 |
56933 |
8.8.8.8 |
53 |
| 192.168.56.101 |
138 |
192.168.56.255 |
138 |
| 192.168.56.101 |
58485 |
114.114.114.114 |
53 |
| 192.168.56.101 |
58485 |
8.8.8.8 |
53 |
| 192.168.56.101 |
57665 |
114.114.114.114 |
53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped buffers.