1.4
低危

1a5a86372c72d2b215f58f16de23b9720a185f96a0c447f9e94790690f336668

1a5a86372c72d2b215f58f16de23b9720a185f96a0c447f9e94790690f336668.exe

分析耗时

193s

最近分析

371天前

文件大小

151.5KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN WORM
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.71
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Malware-gen 20200522 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200522 2013.8.14.323
McAfee GenericRXKN-BX!64AFB77BCAC8 20200522 6.0.6.653
Tencent Malware.Win32.Gencirc.10ba42cd 20200522 1.0.0.1
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': 'UPX1', 'virtual_address': '0x00012000', 'virtual_size': '0x00009000', 'size_of_data': '0x00009200', 'entropy': 7.72403245865094} entropy 7.72403245865094 description 发现高熵的节
entropy 0.33181818181818185 description 此PE文件的整体熵值较高
可执行文件使用UPX压缩 (1 个事件)
section UPX1 description 节名称指示UPX
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意 (50 out of 58 个事件)
ALYac Generic.Malware.SP!V!Pk!prn.796542BA
APEX Malicious
AVG Win32:Malware-gen
Acronis suspicious
Ad-Aware Generic.Malware.SP!V!Pk!prn.796542BA
AhnLab-V3 Worm/Win32.Agent.R336849
Antiy-AVL Worm/Win32.Agent.cp
Arcabit Generic.Malware.SP!V!Pk!prn.DC277EBA
Avast Win32:Malware-gen
Avira TR/Dropper.Gen
BitDefender Generic.Malware.SP!V!Pk!prn.796542BA
BitDefenderTheta AI:Packer.FE964C2B1E
Bkav W32.HfsAutoB.
CMC Worm.Win32.Agent!O
ClamAV Win.Worm.SillyWNSE-7784290-0
Comodo Worm.Win32.Agent.CP@42tt
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.bcac85
Cylance Unsafe
Cyren W32/Trojan.TOJT-8212
DrWeb Win32.HLLW.Siggen.1607
ESET-NOD32 a variant of Win32/Agent.CP
Emsisoft Generic.Malware.SP!V!Pk!prn.796542BA (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.ANJP
F-Secure Trojan.TR/Dropper.Gen
FireEye Generic.mg.64afb77bcac85bf6
Fortinet W32/Agent.CP!worm
GData Generic.Malware.SP!V!Pk!prn.796542BA
Ikarus Worm.Win32.Agent
Invincea heuristic
Jiangmin Worm.Agent.ws
K7AntiVirus Trojan ( 0051918e1 )
K7GW Trojan ( 0051918e1 )
Kaspersky Worm.Win32.Agent.cp
MAX malware (ai score=84)
Malwarebytes Trojan.MalPack.PES
MaxSecure Trojan.Malware.300983.susgen
McAfee GenericRXKN-BX!64AFB77BCAC8
McAfee-GW-Edition BehavesLike.Win32.Dropper.ch
MicroWorld-eScan Generic.Malware.SP!V!Pk!prn.796542BA
Microsoft Worm:Win32/Sfone
Panda Generic Suspicious
Qihoo-360 HEUR/QVM18.1.638A.Malware.Gen
Rising Worm.Agent!1.BDD2 (RDMK:cmRtazos3CET57NPGNXtbqsfSQRO)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/Agent-AGQR
Symantec W32.SillyWNSE
Tencent Malware.Win32.Gencirc.10ba42cd
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2006-03-03 01:50:37

PE Imphash

bc5994e55cbe4fadd0cc6ce15d753e0a

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.jxmnr 0x00001000 0x00011000 0x00011200 4.895677616276734
UPX1 0x00012000 0x00009000 0x00009200 7.72403245865094
.exjvk 0x0001b000 0x00001000 0x00001200 0.729007578086693
.lpkez 0x0001c000 0x00001000 0x00000200 3.9638687291035044

Imports

Library ADVAPI32.dll:
0x41b08c RegCloseKey
Library KERNEL32.DLL:
0x41b094 LoadLibraryA
0x41b098 ExitProcess
0x41b09c GetProcAddress
0x41b0a0 VirtualProtect
Library MPR.dll:
0x41b0a8 WNetOpenEnumA
Library SHELL32.dll:
0x41b0b0 ShellExecuteA
Library USER32.dll:
0x41b0b8 EnumWindows
Library WS2_32.dll:
0x41b0c0 gethostbyaddr

tK+|&u@
g@lCk(j?%`)
.jxmnr
.exjvk
.lpkez
MnwPGuK@A}
7{E^`N
jP}YoH3?
.3D wL
-@H]X?
Ur`qe!
m[FSR`$#y
a\e5co
=LKOtR
]Z R0Ge0
ggBR!'$(%duD'b
*i+h [h]
Qt@\ZDDGK
]I#[f!BTZ)=P1ZLM]\U\v+&+
;l?Y7cRf
^pS&_h4!&A9r
jXZGD;HT{
M)N^WMVh>d
XGwpM>;}H
!j.([xQ
%`]!*'W1
T.m1QGNm'
[X/>Y!
govNZ81
s)tIKt
`82p3Wi#\:
?t>Yoe2[R-I-(\
'MRr/ES
2fuv|r!l
> YV #
YN 5%vf+
@`>=j:<$f
|jW3?S]
^nTEJs
[RPk|.=}Qi$cyYL
.W\rz!(N.Ab!x<]
^'~?(#P
ou80y\\=
IT:b"L
o3RjC+MS
bpFhMV
mdxjSkVk
O!DH!w
a6wv)M1
BMT@y83tV,L
xUD;OvtW?
qw|0*aM
5;-bvI`
./ksF6x
}J@}Ylc`Y
DV4WEfH
["RN,vS>^6} N
)@>2La&->U
IYbI).A[o
)%cBp"
f1Y7RH
U!2[7|f
vNtc{y3\
W>qshVU
7d"5Vwq'A
oaG,*
L1XGq6r6lZPc
T7YNI].-yB
p:AY8M
COtZq1
Aq#|EA
Inh[7P
";hTz7L
WF"!lO
A0Nc,c
CE}y`5VVQ
o:Y[J}:&gb
4^fd;y
XtnpiwP:g
:4n-G<
Z 1lOJ
fYYzFIcH z.
z=Z$7P
zBCAfP
%JPb"I/ww(
mt@=u#M'JTI
&X^IL=v"y
[7]ra,}5U
X\534V
,GrR>8g%C8
,BD4q#x
Yi\)~U
hwqE".
n-1#2 k
_Iw3N$
5J?c] ||3VzQKe]
^uKkSd)Y/g
Wdt'h;
x~L`MOG)A)B
336P^\1~s\G
;M'pO3
tS3%2/z~e=HW\}
O-Wg9aK
3*+&)Um
wj)WU?0
6gWjq<".
Gz1LGtx
0`t]lb\
-%V"wz}zg|D
r\lwGF2$n
,P<`.9
/(`_s4&&4Gecs
~aw%"VO2x<#*R/t1
B|qWre(4>'
!_nY1Jg0
fa>j!?
cI6a/p
V\f-1rJA
ZZrzM_AeI8y`
Z&BR@'
OCQ%oPRmGizKTG;mt0
BrauYlP
?:kRz'R'
j#??6Zp
),)HUl
:z"[r&B$
Q\8Gwm[v2djdyB
^b*)C?K^
F1ZW_-x
KembR+
:W,Y2E_
i1!2&z
e95/W@>
00L!=W0
?Q~BUQ7ZQ
^>9]nr
[V<m`~
=_U,h`>
'HBIY$6+28)5##1OXW
l/{Fku
pioJ%JS--J
;]N%+%
i>lyS
R:'9g g
AAI<[QNDGR
C0*::}<(VKS
#n1^PT
D?9sU)
~{m5-apB\J@l
*"'p5Z[_
^}b#w[
2}F#WIa
`ua8j-
yH=1qgzl
h3YE/8
AbJk6]
pJS?9:#f/
hhrolyfRoL#R6l7~O"
FGt3pYYs
qT;UA6
t&#~HgJt(}
g~G.gY
]+R$8"{
GQqp+4sCq
))Oq([iP
`$|.w;
i^Rr~q0?
&_r70#
1 Yf`@jANqF
^&yV4uSs
;Z.23)Jy)3%]FX
m8GktKuF))d
LQe1S*|
_+p Rsd
WXU:3by
Y5{=hWtBr
;X7@ZE<(w/A
G[h#>X
i7#Ozu
pEC"\)j<9jEz
_-hRB5
>MJ#z_0>z
'MdtE5
s1\%F}-YkH}y
yX9r/z
mt?[)m
.&Mw3O
uG32f]
7z5s).
.Uh;Q]
/Tpab1
!e^D"HyR
T&'`G
3mtWpS
1A`9"2
+ZqoP*
ED`#bJ<
^;<];y
4Y =@p[&7Y
_~sw6w)~
)WTo!~
KX/fn()6P[\
spTW|y
M1)ADB_uf`=zi
/{v.>mN
.EyY(PP
s>9yaY7eV1
5maiy/
B2yAiZ
!Z1'_:
274bY}D2
5M}g$O
|wu47}Y
6n+xbJ
?~|2f+#fP\`M*YE
1gN0DN
k~82E#1
f~2`HrE5-
Z YhZu>u+\2o33&H
p]HY*An
|{R_8+
qM?yk:^3:Vsw4
Y'P `L>
np49unH,
GXjqo=\E
!sT)L uP8
!@m<|@Pu9S
-bBBFU
v[ncH3
Ok#)o),|
)O2=5Y_
_~8KNWN
9Mf;H5HYTH96
"[n3xQ(*z
6@TM26Uy
D+'^w}
LlTe[k(Q@|LLk
V/V>LR
21PA;63|
Is'(Ga
+E]at
mJSjCn
Wq5qPj!
M>$n1Q
Dm\[Kqq=
={ [),-
b9nbkejx"KQ2R&Z
[W"EosjM
8bfzyT
Kb'~c#aM
Fe]:CQ
8Z!Q7c
5NTl@P3
{:AV[L\k@7
Q(gFs#j
<'r(Uh/):|^o^
'{@K G
ELwt+t%
}40%yO
iow>M|c@d
aH_uI!
?UR1f~
WlhH4#l
;eS_*c9`%
Z#A"[yU]8&
>hJ(kk
[glE_YM<[
bfE5b5
k^}ExJHM
G|H,4>H=[C2xONI
6FA3;e
`:F2=.f~
Atc5/[n
|0~PCYAq
":hDF `=Mfl_B
vg^V7vg
vzg}&+_$%m/riv6
*B~%mt2#XU(
QK/*cF
/d:1N(mi*
`G{a|$pvs6C]
kMClJ)B
dFWu%eDVd0!Oug
ES[Lmy
Fw{AUSqu,OG
-M7@;)&F
D*[g9<)NSO
uw6&/3O
VO*E'|9>
E5_(Dy
-}#K5g
.l\9XX7
"g@|(QURTEL
(hXJUPEy#[
c"$alu
TT>z&;WUl
]Sn_sm(~dcYawm
f7`7%q)Os
UEqP&|*yDQ?fu|
RplX]P
Ab4uzHnL)D
ygJF6u
GgYJ|mP
$yERJ@k
7W@_)s
B>Qf6oeP!
5,KwA`K
nJ_[zTz,B.W s&
='G$/V3:
d:R?6<q;
|t-WOO
H_*a6d
K d{ 5wqaq/
~Aa)}]Mp|Vl
7j6~"C
'P&{w2r4
<?-?1]
%!*>(E
A# uzUG
QLm,dn~Q
S^T*Br}6O4MTP
DP?%H6m#
cf8uT>-=`
CD]] 0
BUrX6QFK6
:=jyn[X
>qFD=IL3dA
%iYr;i`U
Bh.v<cssU
R hw'U
9(P&4)v
!XNOx!M7
2QBqm]]
w3Qp*]
&sqL/R
S4W2J{;%?[9
bykTb.
2A0dY.gMmj
`H?[Zw
/tl~|x
Cq*%0Zo 8F
an CnMUY
LgP)a:
ZEGd@L#
h!U)-9
L?LY#WMZ
mr+fr~
D1:|six*
\t~M22bPGq^T
S/:s}PB7~z_
K_vPa"
x\S%+\
Z>2l&O_
[&nA7|'I
&)/ GYwKYlw
L00JU;
dA1UvY
YHa.eKnd1O9
:K|sIAo
lO=qnS
VtxhZE
>7[Y:`7
ztd>;_
RU9~:T
/w-/Cu]O2Q
YH#K=81
l:.%J*
DsjpM!.:tw6N
;\LnM>f\
8u1| ['AAG^ lG
hE-rWc%
g'CuHB
4M# ?~XC
U'x`rTH^5
q6+iiNj
pu_FoO_)Z
!2Po8C\Bz"F!\O
(yTk,9Wb\R
`W *S>
/q&!dj6
1=g|Nr
9Vm"z^Ky
p:/e)M
,@.&#aZM
"3/"t,D
/2n@"x
sVr! N
:y8j/KM}
M9+v1U%
JkZ4JmN|Ue
lM00]T2#V
LmE]_OB
2i:~x0
yDS+Kr
";!)R}N
9_/G h$ |_jU%;r
V;9=W+Ng{
/l'RoXA~js8
qgQmt HAY*)I{$xN~
H`b8UvA9
9|~6^ZMR$y
]Q| ajP
U6/]$i
%ujTBG/`P
-T2?2=ZK; GE
>8<(6ag/ImQs
j}v@h'
Lkx:X1@\
,o'd]X
Org8Ap3
/8#nQ[
j.%eDk$o
?!5@2E
C+02cd
y0Go*=&aZ0m#
q&%C0z:
Lf#A`Pw
0HmLtm
)yOS3d-<
X`SP$^
&H&#l@t7.dl0>
.O=I:"c
562:Qq
9F<(d<
s%249XA5`;
V2^'~c
5Wq Y'
5bcl8:z
~3-[8K\$c
@[H~0 }s
R2'X]J
$53Wws
D1e*xsE1;$5BP
Y_w{!
Tg<p>T)k
gX~@3Ne
wRIJNZ
F03EtToso2{p,GHa
1wCq%iz I|
P]he{Z
*sH)c#;e>=
Z8Es0/
,zMrV!?u
k#8"="
|S'hUe4> :
KnR%1z+Qy|_g
=d"I6* r"PJ}TI
$<"@>a
ae7\nVi
_o:Z4?
VPGF%Kg`QO
VtkV!*
+}-8h,A>Q
>M'q^c_0;m
Gd9{5j
+}p=P~@
;SOjkz
iI%&eXFshLr"
F=TE%/
.5M~uU^MU$c}k
syZ_7S+eDRtz
Urq-yzffhI/
:kOn[e)
p./mj&;y
crHy<o.
6/1ba>K
I\z^4tD`"aE9L
4Smlu+B+
J%G^>/7
yu`Rv!l9;
`'q%gCZf|
?FcMq.>a.7Ob/YkA
.sP)"BwL
&s$-`N
Ay>49T
4<>kW|_Q^F>
tZ[6`L}53_
Wq Ft~
Ai(r&)!=
u%trVjc1
3E,6Q\$7
tT}"<r
=9TW +qA
'(6FB6
N#MT"z4U
U> 6IK
%leb.W
IgXuQ$OiYq
m.'UM;oKnrP]
m%=,_/0:0C
yE~& .
Dj<@DZ#
:J]Rlg{Z
T=]14!@
VkkFT
Hw>95ve
('J%<s
Sk`LbpI./i
IWWUR34~-
M4KHJH
8Hxdtne%
~srH="=g
,+%>Y ^)YS-yz+
IL#s\x k
PDYC3\
T<c-6>L"}g}
8}!9Ea
5)R&+D
&O^8A_
,^_w\+#7I7
j@y%zLI4
iT,qlK
h~53FcX/ZQycp
~|(=z|
6Y-.qW
w4w3dw
(RI{a"j,Wa
*Nrp2#rQ~U
~ZI. ?x
"?RgLFrrMtBk2u
PPSBu%q
"AfT3S
cu=c.7[n
$M?vMe
+d!Y)B
6T7Ig(
jC7;I\
oIV!Zd
<@D5\o/
6bg9Q1z
eZC}_%
Sy5jPAww+
k8^<z4R|PQ
8,AKO,
bhnt7i(}ENj
FON}t j.Vr]
]uZ'{gJ
+X_)xUf
e'9S]xwm:
LU`]i:'
6d:Z`
050ad+
./^0VKAI
cJlc^S:
Oh,>4!
Pg[@[Y7
-A&'\6xG&
P(}%Pw
rY,Pou:)7D9;OS
{E0yLKA^7+
I,}CE|y
>2w79.}8n{/q.
2I/|n
d':%T%m%
r2!AMg
i^Q-KB#
+&0/"7dj
a,I&e7
V)q8h9
<rlJxL
uW^,75"lQcr@u
<$L"_*
,bRl<r]xP6hu#w
3djFy\
j"r9Q)]R5g}*]
<gN"I>]g
2dH!Xt,
zd'3CIeKg
f4oR&E^
f!"M.e0!2lq_%#0/"WE%$A'h.
I>cF?,
QNH/yJF3I
[@W*%6":}
qv;8X)-1gJ(
Zv$Lq$
5P7=CQG}
n6)v -
gj/.]VV'T;G
P>P!*z
&/"21J
1a#0:e:
W6u_G*
iH kjw
2)zjMeei
?hV*Z*
:sNmW
KC`ND^jo
(BA~U/Y/
4;9fLM"KlJ
.C(X-q
.xb``|-
C)KkoG
KA?a-v
|Jza|YP.%aS
LYA8nPOmK1<=
m>x2Bei
#iRi0*
C- 47h8;
$)w:A-^
F]/Up1
\J!_*hn,+cdt!'n
-IgX,~y^
WR{=loU
1>\C7C
eN!'0"n
q|>q+6
L3I#\FI
lK;e>ls]@w9mXe>~QF
i2:IB,:
^ynh*b
?!?P7}
H*'td"V
-_IpV;
QA-WXql
$-E!Q@
awoBr\
Vl<5@@
VJv%$(h&L-7Lc
rS<bx,U
b3DlUF yT~
|L_web`Z
|=Kmxd
srVDoRi5y%X>1p-<x7~>feH
Ni$&IdB/n:
c&"!nOk
"jEmC!
x6DIYK%+
2E"8/"K"d=hx
)X"sD:cY?
FlP-HYJ
 5%Mzb0o
TF!!HKzN'
\.EGRO
IuwJXQ
7g39|v.~G
$1P9uFFSh1w
UWVS|$
t$dD$\
T$L1;\$L
t$t#t$lD$`T$x
D$t#D$hl$x
D$t+D$\$
D$@d$@L$@
9s#D$H
t".)D$H)
T$8L$PL$xf
D$\l$TD$X1|$`
D$`L$D
9s`)L$4|$4
t$4D$H|$t
D$`D$t+D$\D
*BT$t1
l$8f))
D$T&))
T$TD$PT$PL$XL$Tl$\D$\l$X1|$`
9s/D$H
9s;D$H
t$(Nt$(uL$0
T$,|$`
l$$Ml$$uP
)D$H)
$L$ d$
p4$Ft$\tYL$
9l$\w_$
BD$tIt
GPGWHU
XPTPSWXaD$j
U%z?@e`@
ADVAPI32.dll
KERNEL32.DLL
MPR.dll
SHELL32.dll
USER32.dll
WS2_32.dll
RegCloseKey
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
WNetOpenEnumA
ShellExecuteA
EnumWindows
Y<9O_V4#
,:@>" :I
7&)"DG5D
E+4,=CJ2:$@/">?<$D
@%0?&6
]]*-0S&
!0O h|
|(/.c;yT9'
(p&=y,\?
8\2H##
Y'K .O
%;._f*;_<
:[!>@'T
di07N?
w30{&eY<
"B0.r/
6#=x;$t*
5i%f2i
0 1h.!WNY<O
8T2@/
*nf#H\
1!;Ni'};
`!?,U8
M}G7Ty
zCm8*$6E4
?Lu01>19&#<
;21&B[
/$1$3(
as2P?'u
1A~{2B0
Zp?2C
}a;A)c=g
'%4B>r
C/$.,#y6I
39>' U&{
1E=)0nC0$Ww
"gu=++
w50>Q0{
/eR?;c",<W2
jI,5"'
r!)/1'U&3|5X
N>UE8~0/&X
5@.4623
.{Z=l"=
/N1\l>
3'8Y5LJe
o$^'%-T~X
5&[U(*p<
,E.G2B3)E&a\
D5m1(@N
J,K,S$
$aK%0E?/N+
L/i*4d(\582?
L9{%f@5WY%S
c0n (=k
&8kH96(>Gn
eK:/T+
~."+1vEQL4p>.
|1v&=)N^2
]~L,q,qK4
%%qAX;4G
F/*#w"
~)Xz+}!.
7Z'f!%
!c"VL<7O'
8$).;*)
2@;)Q/
B%'w4th
Sq$n#4[?.
.[4:B5c?
kkr'*=#s8
6V0Em!j
x8Y.gw
Wf,^<Tf
6!i3};>
0'* cZ."NF?
q<+A::
/R;]W97p
L=TH-=
q!%/w*
#!{,U7
zj_-uz
!>Uc_Vz)5Pq
A?o1KA
OH"3*YI2l=
D-?&+.
r/.$7&.
C+${(Cj 5@,A
9a.8<
)ZF7$Q
>d=P?WRj
>)y8"o
8g)1;o(
2:>VFm.
aD?#/PV
;tX/=x
$5L{:j
.m|K:fR
B4Be"iG
|,'1sG
^\;M68(e
@,L%E_
s<0t(
k!7**<T
C[eC"c
s1a2Gq
w#8)t+
bPv<06&(j*
"~&Q0Og
9"?Jw8lv<+
#DN.9*
NrW3q6bs,9P
y:&d99:
s \#Mz
y,'I4'
Hj 73.}
<@e+@y
U+"Uz5-)@
4:QhC8
v7?:.q
|T#3v9'
F#n3/=
~C.-9o),7%
Yh?4$q
w$p4b
)-tw+2u/
>'p-<13$+
$/&Sv,V@n0-
Z1KE!
4?5t<M
EQ<2*q`
[xT?rP
B7+'#.Z
GsR90><n
.g{(A/
(n@'{6
wQ6fa)=
x-5&,'iWM!],X>5|
_?)R7=p7
6y?:*]T
!j /=(
5x/zO)T
4T6OK/N,
R=4k8t
S)'ZK2o
8P$7V5&J
w+$`8GtH;B
.7N \/(
#I'+c,l
.Q1i`{=
3WV2:z
`: `2+
Ez7|!x+>VV
h3D~"}(
Q$%o+R
].92v317
7[/F=`Ip
(q7#F!O#
-#1!4F$]*")
Z:_1#+!U
"+ME8J&
Em%1$#o/
N3(q<3
L-C5Z[
V:?=a $
m28<@>fk3
+'*1EC]0>%4#!
xVL:=M9(
,+.2g}a n+>{
%QcV=T7/r?K
#=w'{
=]m$,(
v0D66t-uh&3+$
A$+x(
1?^'&6l!=oq
fI62<l4&`+0
g'4U1-SI
oZt3$$5Mh
(-%"2)+
H6[kP98Z
>h#?"
6H#{]
|y7I9v
<21/l,
u.J5-,ir/n
c6(;:=3
+V>(=@
Y!D8$6 G$q
$NCY&
b!=_}0ll*x
w;;#m 0
c2.E=sI!f)
6<)2=:)n$w1(=
]X8x`=
i{]%Q=1H
,?:4K:~
/Q:&/+i
x;'/h!Q
2DI(#
9=mv,v*
55\8*~
al.?"!W
L3`x?
\.-#o0
?$?j:;t
&^+~4Hu
*L,SC*
)Xx%7Z;+E08d=dw
wjw/n=1q6
m+g%o2v
b>'Y;:|.Q^
RU>}9,
q5=-|
A>xs3{
uY$m4
3p0V!/?&
59J'5f?
,:Z%l!
#'f,o=
Oq,=>_
=N3Jb0
V.Q7u{
"+j-#M=M
\\*M<XV-
(/f'/7
&%"4\O
@%>_9Cf
Kj*+(4>
\1II.|q9
F+Bn8*
8O<j+bR
c 2n&m'R
;(K30;>}
u9=y>{
{D1=32/g!Nr1!5IW
b4w%1E
}/+J58v
i*p4M6!85
/P#-2[
&S%^'["
8m.!G #
)OP>*c
5>(H6g5v;:0WO;
fC?E;8:
,Y/xC3
)T"-%c
=K!<<Mx9
:Im:2.
Qz9U6};
9;4A1X
x1&j<5
8e?`1HG4J3M2m9
; .tc/Z
=)+31/
ro5#2y
w.CHS$
m,~w:Q~3&q
$Kp<0B %f
'V9NI<3
*0N!>$)$I
36f>{*
/"RP&=+Z
|;.nb:,
4>h'j]+]>
@#NG"3p
$3:#W&~:M
%RX**o/
.B<+;+L
{5L6Ky
0j^;;
[)SJ+ZJ0
:/f4+
b&1%4pc9
}:z:].D
=l;2n?w.
oT8bu+
OE?AyH#-}
A2!y$-
d-a33]
o+'[3Hl
[EQ(m#
f?{7 /
/w":)d0
0e-P1?
M,v"29?38s/pf;
2[%)- o#
ec%?#!}
$!Hl/&p
r6!;47m<
J>*T&C
)9BO?<
%836]D,<k27WS?'9-67
)w+IL68g<S"
&?;Q8e
/M.=-m
47!:LG
9j9-"h
:J'zDq
F7q|'z<)v
*\p_(
=82&y\e<
cH=]5Pe1p"r
^7B_3C
e&mU>ti
7q|5`?%/k
.77W*(>
>m]'6Z
@P&f>/A@
=<$,V9hq
1;(L#'
6K<dg.
@'?Tz7N
Hb>R++Y,R
B|"a1>
,j hZn
$+><"M
N-.0!O>8
1UNv:}Ef
Ok()Og4Yd
My*I#>25*b(
2-'+DA
$)5l?u-
#g6X>,K
-v6&"?.
:)7U\
3*1r!+&'
ur8=&[8):<1
6%.;4G3+=N-a
8N0%\=koE
$,WI&[/$
I^T*q"3Y
1g;*(.
,5{ki
r'2,Z#|
)n1W#$
l?R#F
H5r &R
158*-`{+{r
Y-}64U
(Xx<L
l0P21O7
Ml'$ 2"$*(%3
+##S##=!8
E"7<L
;\6 )$$|7r(
~&.+:)>
7U"+<c
vS'<"7'91G5*2
eb/6T>0fnv.k
/G4!22e
x-$=A?jQ#T
1h*n-Qzm
F }"
E2=F]*q/
F!5q2"o
479E+Bq
?=8NXN6
Q2<D-02
t 8U5#v(&
1*F8u V
EY*3%H*2=zk9\
!;xX$@0.E2
%*U55iQ
Zu<L;*_<@?
t?*Z!<
e50f1w&
RK5;Q7=
{L;0G5
w'rt5>3
U`)FJ+H~",Ul
;9]- B
705bS
N.(`.<zx
lY:4e'=Fv
&J&*\)
,<H;y
X>Q$ad8*(4
4')Q6@=$
E,P9;t[
B03<#,.G+m
<((G6Y;)P
6^X<7-#k
tG.sj-d*[+%
d;.I(g02T
j.xv0$"{
nY."<>P
TS:"
(c91=4"5J,hn
,QP=6o
VO0S#5
;<9{6?o
u4~wx.Mh
8O2b[<~r:;0'
?d*-,,4
Pt#Xv&?.
l">#Z&m+
#+))Y#;
.(KIR"34+
C6G!B]&
h3U 3^
$6K:*e
g?-G7/R%\*ma$
iw4Qu)
j?x '58v+
TD~#]9*%ha%wi
9qX1qrT%
$N`3/I
3?z*`x`-
s=].X<d-k
3?P;o\
9l4(-(Vq4
Gh$h;&6I&
pd2PY:A36
$&^0KZ
/L`;>c
%V;rP2D'
B!&7.k3
@!.w*!n_
T9",>k13m
>j[+,T?iD
:;F_?j
"b-'35=+O
8'z_-X
FQ7p>P>
U$$-#/
3r|&'AI<;#
a@0)k
.cIu:/*6
/7%8?K,%w
\:)-iM\%k0
%-n_0/gA
si7G9k
|X-v("
q,<(_1J9\
1}#65{6%
=u%4rW
U];'(Y
"OR$gs
)2i'Jg
;73_{
!#o;&M
*5ZY"'*^7|
T3P3<a
0s9*K#
"0e:g2*[k
<;17(vd
>x0cz0]j
j0)~6`
:`p15;
i7i3"}
zl3h;Dk}8Os9%z
r&o?-@-2
y0RD4,
l1+3{)
7Vg1q7
#4'Cx'S
(j+y2!}
'x$<=&
3I(i_L(
10&?#8.{2
n?q2sD
><0;dD
wm$7V/
w0{V; ##
!x4-K>
41H8_#F#
,Z/|/:c
;x'ot1y6h?bM
4\H \>o(P
|!or5;/f82
]$@/+
_%P'$}
P[7Zs&a
u.\ ER"
' 88,%
4(_|/'>
J{'RF4
Hz$M~p3*v
059>"j/7
S?FEf
`>x1)o
9M$3Al
sP%N1M7<
Kn>Vx7
%T"g+A8,H
^x43Z#
hm [?)"Y97a*3
:6-"W_
=b;)`,
*dM#iq"
)p5+t!G=;4#
/69$"n{
nl* m%
*-Qk:)p7V
F.2hQs4
I:|":}9=
D7E.4
`Vu/qh(F
d=A("0?>
l26 4bOA
2d#_>'1
C%8UAt'
-D9N!9*$&A7/
<t*u2y
&$6F9Z
5c~8B|4@
]+%}8^
,0U*S)
2sW/gV8</
3{'566%
2nP/l/F
w >8A/
1'<!IA/gt>
W)^W/"1& $
D?0-96
; :.N)-8
|k'O)S
=!;y4u
N!X68V&2QD
JS.$2_
"d,=A$&
8@6m3+w
%v0H&a{8CI
37*3 33)N.
m<.vR:)
8!tx0^9-R
1Pw!0%m
(j-k;0
> w4G*e
"J-pH=T%
/T:<-
:0]a+_*(j ,
C;~|6`q
?'$6.d7
I$lj&b
-NHf#}
yZY.X(
V({q<i
C:<*e/H
&E6<H]
)7;s9{GO(e>
* 1IS0
Sp<(#W('S
<&)+'d1
*:(U|4x
Qf1(t@<2E
^73:3i9
'F97$e*}#
7|k399*
~g3l1t
"};uKH
!N+O9n-
p:v*Jj
yO'C+/
.0^2Z95
;'Ie3d
8_8Ok]
<e5tb%
5(Y _#gI0
6-D5*2
(5,,Qh
$8G`>07w,
=98+ia/i|>
=$&]Y'+M<
"8$!>:g
T5}|'fZ-
3;'9m<
r-p};~P5
0b!0k2#
^+jW/k'
5[4hed
>`8Fvm
k,-?8)
c~,y)?_1!
//q2H"rJ
:W0sj1
c:U2:8V)
L)E(?t
n6.+*W/x
&k3Y=7Z/m?
'I2D7|
=]22R,s
?i70ne
O{J2H'
J2[o8#8G
'K:%Z $?Y
b&'8By:8
IL6+ZN%tL<GCk0IT
dl5c4;7
0Nj-jT!1K
u/7eX8
)Ev6 K
j>"2(~`
68,-wu
T.d-O4
d$>8hT=
|*"`4Z
(59X8
v*pGR;x
l]A>\Y(Y
\?2(2r
dy1b]4+LL
)D>2%S
6<[C1m
>V+u+7&
#4'W+C/u
O?%<z2W&2j
/c$C=,)s#k
=x5#"*0
'0:"?>R
)yN"/>F-H
(dh))
J)q+p#9
j!)=P1
T;XN47:.(b
O68z;0
<11x+:2A
^,MP7;/}
9L-+dk
@*'.}-^`#
'MS9m0
'F-0[
`?t66{\(}i
4Y$(Qu7k<<
O<J1 "F"
wo'gM5:
Gl }K,/w,
E-FjN
?*<2vI"
E95:N&
?8`~F7O
?**q$22_b=
zH3YOq=
l7=K,#C
&))O)M.]
-%EF&Q'
@4*.+nQ)
Dn%nZ4f
g8'8-k250}
d,$&nG=5Qk0<7
,.(M ./720
kX8Wy*
6U:5st+h)&
; pvK
~G</C/
JP1K{>l
bdv2&o:zUH#
\)e#}99
8O2?3D9
6-4cK7nx93
K6#;~'
;*9or2
j.V7E--a
9B-6@}
`R9:fu&
3'O.b|
%>\+W<&
wK,P j
|~M6T/xp
=~0N8:
\*]o% &6Q
#1)%+"F/
R0zba=
Fv,Yx;V
q;?(9h
>l(2B(
A[-?`I
\>/N0$M`;X3
ol02&+4}
"&@~%43
z"+f*v
;,1H!!.;
h5&$H 7*2a
"f2E)*
-GH!$Nl.8tF#`,
nR*g4kT
*H="b9,
]HI<;
0>ba/G<
F!=N>zo09y
4MD.U4
LW8MZ0
K{)=i
^8*WcY
31l*d*\
0*m"=.
"}o)k+
.GI+$]:Iq->w*
3z=7$1p8
c&r%5)
k'D,w5|
K6\59B
)4[w7D
QW."qT
C(iB,`
-~?F^o
a<U|'l.L:!bk
7}D"Ob
:m9V;u
A#-*3W?
:((a8'v&%)v$)
14r[.%0BJ
>GJ#f~
,N0|.{q
@p/!(a
]F6,NG
#)^9 N
P!z(|=24:&&L
&F:2{t'1
4@6##>
L4"Md#](
5Wu:h4
P9vtx!
"*`7S6y
!'8(Ps
.477C+$z
M29->u,
- 4J2_G^!2m6b
C8NGf)oOB;3
:PXK.r
"M+%U|
&.L:!#
+r;m+')~<=Z
q+2#?t
+C$1@m
`+EiZ0K
9t_1M.3
u4S5U#
;e@'7s*!o
2?GK3:3
<%w}->>
Qy..95
Dp00@;
s'/h"Vp
. s/G$=
Z=OO%#E
u)C-!3
C!<"(5f&&S
[,?f9H
^8*L>
R<,,F3X
="5+:@
w>5e9Zh\
77R1d?~-
]t)|g:8
/>y<]A>
A^O,H^3
$tB4eJ
7]>^H'U
Lb&K/&
&{M)#*
6&;i?[r
/1aS3ZR:8
2.R:d1r"
$2=45{&i
:d$E[;
1U=&w0,M9p
~>)M'#
:)>"TL
!?L-o?
|.9*Y*
X(Y/U;D
q,&4'b
,6V/'*
c3'KR%!
o2u!(Bh
<g),7*'
.P60#n>
(u:+eT
+y8=K%W
|%')6"
/]^>E=
F*(q!/`
h)RN%*
85~J&_
6D{<h58
_:Pe!U
-{/m*C2
a%-o2P
f]3.F=@
8kK+dh
/7d1C7%6
.*`))17"
5]+n]>0
]8f7j*?,,=]
:gE {v4
O2j={8d>^0W
\$v3"[X;;"
T<u-w>2Sd:R](
!;l,`0xi/
5t0qJh
O:64/9
{;;5>7.X\
=~Ld2a2P/
Pr(by_
B)''K9
;@<D/H$+
!K5x<2G1
6:&C**
z 5E*\
K U+.ph3!Q
>D)>B7n:
<YI6D!
>vB7qs`
!bt8$/,9A>~$
n'}:-9
!%-b&/-
X7-?I$
7%L)5$%
)B"3.]
1#wG`+I75
C;~-8!X
6C2{(&.
kmH-~<
-|b8E?
12l6i%
#-j>q
B~-,0~8gYx
L%GI1n#
&#.8#
);>_[0
h$ Ql1Q<x
9/5/<5n
|PY",>
#y|%V#+
L#;%D,
$ZJ.2C,53r
=mu$AkX>p
Wa}!09
r,@18a
.#Z>zq7
a9Sm+E#"<_,g2{3S=)`
cR?<~,K
&!&X4 v3
,]m'rK+cb
m>4hv(v|
QH'T{-
jWf19g+
R-`_D8p2
=>x'E8t<'q|
%Dcn/}eQ
[,J YP:
!53-XAw
P7x6<oW;Ol?[v(
&;N/y,/b
3@5uM6
"M .Pz*j'?$
s(C1!o
p0\%,%[(
09r5S$.
*9{!V
f87uT M
s9w?%
3n1y4m!
L!#s4BI6@
sh3GS'
U853__!
7)sJp:0
yK><5
)U/S.)
;4:7i%'m
,WQ1fQ8x&^
ov7,Kz
266I~E&>
:v2%*,^
#)]#QF
h7"bX1
<m}"F8
j$//p45X>
pF(p'9
-#YMv*!X
hq'=u
Pez2J9g%b-V9`|=
1+\5*<[)
76V4,\e,S_h71Bv.;
@:7k u
{KdqK
x1>6RX<R~
3I/]t:
"b(Dk>&.
aX5t6:
25F%XKO
1u ,D_*A
:&<4-=(&
L}9&J ?%.t[
']+BY085v
E#_0S+"
[%16=)g
.e&GU[2c.]*<_
g]*'Yz
YA,:s>)
|'2ai'1`
Q9xx6J)R
h:!>"X
g!2_r~8n
!2'!4>1
F y?3R
)\d)&#;%
^w0]$A
v?)*8!p
+778d=
.kn5HK^,C:
5Sr%Ee<.Q+C8
P#{=#7[K
D,s<L7
>3<,J8e
]&9"5+r4{
q8|9<v`8Q
?? qie?
\?D7;f&
T(G%9d
.z%I=b4
36Ax%-u1
w;2#KE)
W)4/;:
^j8;$c-
^>r#-N
k!$tpa
Q*+..2='W)d
|$:S<5
=fEr94w5%(
s03=l`7
]5J$=>
7D,XZI
Yq+O0y
Jmt;V>
,7"b
A'A;-es
S@!MK4
$.%,@?#&s@(
T#P!#C<
Kza%+O
tx1W"y>
8)>$*C
d17~/D<R?Z3
t(-)-W:
wJx.:n
$Z(U'('#
h$,%ln
9:Y:,96M-?Q
#/?N]O
OQ-4K9
I;;\l/2c&+
)g,r>:
+%98I.2"]>BW
m$7-a(GY
*o9im&<P){
g*0(] QH0|
'W+; 0<U,
)vm8F.s
7DVY/;/q
>hJ>l~
3]K,-?
9Or6y.G
+.0A+,P]/V
;1C|/x$F
)t.Zz-
Q:2[9.**z7tc
s+7t20
&?)f|0!d4{
&>hi8<H'g2eg2
*l0k:#)
 I=t0B5xO
9gB#d2
+ D Ft-3%8iv
]D/jD4z5Q|>>d
3:%:,2"%j
KP.9f
=Fk=5zY
O}?v,
^5?(`6
Xi'<4?
\R>P;-
l0Yn$-
Hz-;;t&4
%U6s'C(
{|#?L{b
6#e6E!n1
"0u!I3
2>95=:
|>{R#r4{
sd),L7gc->|"5
'w:A7TP~X6
.,61M?W.
x;9hg"
@V2Q9
b'!F&v~O5
tI626
zfs9}-
2*i!Xn39
)=\c8J0
$*.H%C)
O]2l>MT
*K=,=+7>'
@b&$q,S;:#e?'-
$l!aX)
G\a8<rQ
De0y<ce1
!1W>)k
p5%%!\i
!wN+/$u"
jb,>+Q
%;fS-v{"
Yw%q_z'U4
l}1+.M<{
\)Xs>9_
Pr=/uj
\9a ?5
0~'.\J
6#6E6sV
e?Eb:)/mn2Z'n?
ns_^8
8]r?7 )
R>j&2x
geN)C`?e
;C }7F">p.|L
HzcS9N.>
~G+}8\%N
D*7 R<
-4_zQ/2
J; 'O;
!8h'!r
)V<2,M*uu6
#&33+,7;<
%%%&D0qK8.
9B87a4%'l,ra
=t$L3$Z-y
K?SI<2
&OU<W.
H+<>?c
0^, #'g
fT)nP,5
d!Q433
2I&c|!]
>?=(*p
Y3 (l'
Nu9] 2
5?0Q9$8
_+y1P
d=q'T$
0A#+$ f;
N'gv8L
#!Cik9I
[$[f-
5gz5ZG
"O1)<:
xM6P"G_
7=)>+]2
2=40n-
3}4R-U
B#7h{L*
R<)@ W
"q5bI0
N16De=z#9o
#O8* 1V/
85CZZ8_*%/p
:%:)Hk
7Ly17B#
$^!<<{
-k$0cK
(O}$6g
8r:*:5m
=-e7{gI
j?N3+vo
)*&Ug+OY:
38`e24N
4H)5=2
d]$4EO
61-Fx.uko
9u1$uO
Ha?Jk8#i
B7$6CK
wc"Ly[?=6*
bU7'i9
[=8qP,M5T
nb.d"9
tF%c($?vj)h
l&|#q,<
0+=G;P"2n
,.R0G>@
ap=";P
>})&]!]
tw/"LN+EH()"j
$cb& 7*S
fd0<W_<
p U.t^+y
3>5jZ7"0p
N8s;u
e#Q).8
D7`&;Tk-j'#4l{-*4
+Q"9c0%
=o3o7/
(O>ogA/
L#-ca6/
[h28{/@
'kD2,y,
)=+0+e
q+<i-7=
~&[+9?*3
,/Gc"d
D:xb5O
vf$:k#>i$%,
h.]+X1
\) 77;5t
R*|Q!|
4}NH&'
?};=Dh
95Ha'
=E.:N\+?X*Y
d"+d4
#|0m7=7
@%F%x/o5
63V6ta#
X<'qD&Z
V9.0'aB(
:\8G$2
cDq/T9[-&M
(d=^c|
So{!;?S
)=]-Q(A
f#BF51
KF:(c2Z{
7TUW:0
}m7.w*XO,9%JV
2N6Up
B.TH.~
f4,e"#y
F A6'M>-9v
?a+<I
2{|r&^.gmr
uz1R9j&n[.
22=J(
:"!(#k$
p>m`&]=#
kn$c00
L94,v`?5/|
p11/+'oU?Q|,lz.%]l
b 5Z(9>D
zC==2-7_
f-bW6
(-9_$72l
dU#'%Yoj
7#Q)z"
+4;5D2
cO#\Z"$~:)
*'bb#
;R1<tKu?
"~3i6V
/d+q$6
( 2R=b
Z!6};fX:
GfY?{M (j[
,X'n8#7x
2|9=?R($
0 !\4g
Q|`/1*
Vg3`5-
"9-6!Uk
3Od6h{
a$Vd8B
7O=TV1N
H&+,8Jw
J&;J=0-$,&2
/J$+@y2
Kye,4[w50
e|0'&0
B;I/j(
vZ-T4l
l$$5>~
q"|*}5D<+3h0e
c;- \H
;V+)Nd+oX>F~
_D5O@;
#H%J.PI`
P)o@6'X
O%a3&C
WJ*I8Gh!19kt,r!
2i226'Y
<]3\%/nn4x
4@.0`,
;-T)?a3V.
J!p2!u?
&'7e31#A
u39("):
0Sd5^t
1:B'a
q18-/%f
<'q%m0
v936C:
t{/gqd
>T0[Nd
$W?en"
^BK4T
Qwc"Ro
(<&C+vT=.
S+B( g%O
m<7"@"U
~0Oo%(
~>M,5>F
l6;s}2z
/Q 7j-
;$R5C
*<%@h6
v<LE(^
6*@m7SJ
UI+c-BTp
Gj!`7^ mL&-
/eg7$?"(
6!DK.k2
g%La0130
1<]-$?
2 )qN?x:!sB:
Q 6R>|$$~
6q#hr=
4'vQ-pQ37
5w|#D[_3
8_g*%bR
oo"z)$b}
N<VX?+
(9O2#
t6n7?t#a
^23(
K/8s>Se91&
m)&'s:%B
IV9!&s
(ZVE#M8
|%.r0C<;(
st E1;
q4k'<gs
=`?l. !
,C+,RI
Q!2+:-
%A)1\Z
7:j)}+!r
0/Fx?&|2
5|rn-XY
h/A=`/1
:Jqv>-Y%1
c72534<
p#y5h
!:H9+_
N.&7<r
$()6>l
(|+L4{a9
Lh4z:%-A
U&'5K.
@@<{,@5di
*I+'m22
fr*s%^!7N0"a#g58WNr
8<<z1-0{!!l8
)k /1N
Qr$<e1C
#w^w,,%(d
j ]#nf$
V)H%*.
.Kd9Ry1%`4
Y+g!U8(
"W2/)E9
'()I"7
`4-r6zCr P
\Gz>_)o >6:
}(k=?&
e76%4S
K/('u_
Qb7ass117
a4S((BU)?
,1O0U`
.,((6#.f
<W';c=0
X;)?,kI
*#1\,{7'
s"Gm{)3:%
J9Ez+,
i!;QT-eRP
w?nC-a
6]t8F;q
Y&vH'>"M
oR8+\\'/.b
<46_.O
[$Bl2P
%-e1@+7Z+>3;
^&iM7]%
s16*aL
:T0;cg
s2f@)"
SY.=k1Wr4k17K4
=:5+1=6^#6
%E5i*d
l0s*]~=
/k%%=6Q
V_,5[.
6q)bl95
<\q($0_ 7:T
p5o2yT
5Mu6AP
8)m6L;
><w+EB5
n`1<-Go'
c#7$[7eD?
Cy:.i3
th$'i*fc
w>7kk[
=X>{1(:|\-O6
j;/D*{n
X+vB :
qj-85'
.K0?>}zP+
,YI0 N-I

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.