1.2
低危
59 个模型检测该样本为恶意！
重新分析
更多

1aeb1756450077d761dc7bf7a6cffa0be37045a720548b75265057f9ec7501a3

1aeb1756450077d761dc7bf7a6cffa0be37045a720548b75265057f9ec7501a3.exe

分析耗时

193s

最近分析

364天前

文件大小

68.4KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN WORM SYTRO
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.77
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Malware-gen 20191210 18.4.3895.0
Baidu Win32.Trojan.Agent.aaw 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_80% (D) 20190702 1.0
Kingsoft None 20191213 2013.8.14.323
McAfee W32/Sytro.worm.gen!p2p 20191213 6.0.6.653
Tencent Worm.Win32.Sytro.b 20191213 1.0.0.1
行为判定
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': 'UsllVGnN', 'virtual_address': '0x0001a000', 'virtual_size': '0x0000e000', 'size_of_data': '0x0000e000', 'entropy': 7.877729583739481} entropy 7.877729583739481 description 发现高熵的节
entropy 0.9824561403508771 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意 (50 out of 59 个事件)
ALYac Generic.Malware.SN!.F55260FA
APEX Malicious
AVG Win32:Malware-gen
Acronis suspicious
Ad-Aware Generic.Malware.SN!.F55260FA
AhnLab-V3 Worm/Win32.Sytro.R287080
Antiy-AVL Worm[P2P]/Win32.Sytro.o
Arcabit Generic.Malware.SN!.FDD7DCFA
Avast Win32:Malware-gen
Avira WORM/Soltern.oald
Baidu Win32.Trojan.Agent.aaw
BitDefender Generic.Malware.SN!.F55260FA
BitDefenderTheta AI:Packer.885A9E9A21
CAT-QuickHeal Worm.Sytro
CMC P2P-Worm.Win32.Sytro!O
ClamAV Win.Worm.Sytro-7108652-0
Comodo Worm.Win32.Soltern.jet@5a5fyj
CrowdStrike win/malicious_confidence_80% (D)
Cybereason malicious.79843c
Cylance Unsafe
Cyren W32/Trojan.EZRT-7247
DrWeb Win32.HLLW.Sytro
ESET-NOD32 a variant of Win32/Soltern.NAA
Emsisoft Generic.Malware.SN!.F55260FA (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.ANJO
F-Secure Worm.WORM/Soltern.oald
FireEye Generic.mg.6f8ccdb79843c3b0
Fortinet W32/Sytro.AVCT!worm.p2p
GData Generic.Malware.SN!.F55260FA
Ikarus Trojan.Win32.Qhost
Invincea heuristic
Jiangmin Worm/P2P.Sytro.o
K7AntiVirus Trojan ( 0051918e1 )
K7GW Trojan ( 0051918e1 )
Kaspersky P2P-Worm.Win32.Sytro.o
MAX malware (ai score=82)
MaxSecure Trojan.Malware.300983.susgen
McAfee W32/Sytro.worm.gen!p2p
McAfee-GW-Edition BehavesLike.Win32.Sytro.kc
MicroWorld-eScan Generic.Malware.SN!.F55260FA
Microsoft Trojan:Win32/Wacatac.B!ml
NANO-Antivirus Trojan.Win32.Sytro.eakbir
Qihoo-360 HEUR/QVM11.1.DA13.Malware.Gen
Rising Worm.Vobfus!8.10E (TFE:1:rrK9Auqv2GR)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos W32/Systro-O
Symantec W32.HLLW.Electron
TACHYON Worm/W32.DP-Sytro.Zen
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

PE Imphash

0e836bd3be54eeeafd05573d50eaca49

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
SdCsWJxh 0x00001000 0x00019000 0x00000000 0.0
UsllVGnN 0x0001a000 0x0000e000 0x0000e000 7.877729583739481
.rsrc 0x00028000 0x00001000 0x00000400 2.9772483985450444

Resources

Name Offset Size Language Sub-language File type
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x00024018 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_RCDATA 0x000242dc 0x000000b4 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_RCDATA 0x000242dc 0x000000b4 LANG_NEUTRAL SUBLANG_NEUTRAL None

Imports

Library advapi32.dll:
• 0x42827c RegCloseKey
Library KERNEL32.DLL:
• 0x428284 LoadLibraryA
• 0x428288 ExitProcess
• 0x42828c GetProcAddress
• 0x428290 VirtualProtect
Library oleaut32.dll:
• 0x428298 VariantCopy
Library user32.dll:
• 0x4282a0 CharNextA
L!This program must be run under Win32
SdCsWJxh
UsllVGnN
BAADyZ
Boolean
Integero
StringPn+
TObject3
v[6`ysm
Irface
\dK^dd
Tna6dk?
undArray<
2 \XT2 PL
2 6 c~V
$i-G;COs
4Z]_Gsw
^2O;rl
J8n{{{
)T{guDdn
V\{;t#
URux&G
7$KvkLp7
s+An#c4
,IztTR
vtPFIFHF>5
xaS;Tu
vH 8S(@
;s[s+D
Yg:58F
~2d"hCl=E
t)W*q*1Sc
+bPUo]
;0KVW*)
s!qABu
M] !T.nl
E"1!E*q
"c3**]S@Q[|
+\0vH;=
U`1bm`
3YwA:S4t
y13\Zl
yXu1s{E3
=E7!,;.
[!t1|9
<Kl/ v;"{
8+;!n+l;>
>3Q&782
w`B-g)U.nc=7u
<zwo}
yXZG=_c(
nn'6#@!
Huv=,o
XJ8+4PX
-je[Gm
/w)f%.
kR?Q.&
9uEN~Z
Y)RB!Z
LX0tJS
zO";x+
O!G1hGK
001!R#-^
.uK?90
pP~l#b
F t-tb
+tQ~_$xtZU
w%9&Ww!
ExC[)A
c*tAN lfL
UY12+FS
$Xjt5x
x+m-?9
!$-5V@~d@2@t
gDZ[wxhi@%Cn8|M
CO8GvO
@aQYR@
b@"E@|oe@p+
BkU'9p|B0<RB/~QC/j\
Cv)/&D
dEJzEb
9;5S]=];TZ T7a
nR`%uYnb5F7
%S'(#0(
9{MUh]
F|@2dg
fp/U?f$
OFTWARE\Borland\Delphi\RTL
FPUMaskValu5"-9
2<lIu{@X3l
;97uKhM
IYVPc-
6V&v<VAAI!]!s
Xsjx]
-i+1ZHw
&U`)LZ
f[lx~YZrXV)iB
{P(, ;YY
9+su_\
^^Ba}O1
*]BN\1
/M&;I[
.QqJI%
R;MrZ
8!ugj~H
[Cao4L@a9
*p$G+ot%A
^Z7@L+
KuBf&v`
q7ZTUWV
zHZkY9
/'=t&,*
E<tq(I?
u\T;S*D
j`lwS}.
Rn]Cpth
Z<D~t-w~
dlx];~
?eA^_['
76Nv8,_QDQ
=NuG'$!
Bp8lXk7l
Q~)~$P
RZl ET
./-Rf;0 u
LA?_P/
CaAD#.;
Q`H2;K
PDPS1JL
m:v`oW
/pbaQL@
0y&H@[0
S`-Xk&J|
9})RP
#MP#0N,||*|}&N~")~%/)
@;1OWJnjQx
)pk$S6L~Hht
1hL{@9y
(P? vB2!p@
OIW?mtXS$
gtrc@QTAZ
i%>Q\vBT,
.oK-L xO
#D,;jX
CR9dya}X
]r(eTX
E Z#QT
4EtXk
dAptxdA
'$$Bd$
YYwUx{
w917S9r
`ri=Ahy%`/+]\
@E|.-.
sb8IEp
2_b0XwJH
VCLs@rE4}\k
h^%m&F;E7vtX
bZUM)MN
;i+UOZ
JO8|"GJR+uj
3gLk;+;~
cfh5q.I`8'V{
hCkRZXN
u+1dEC
Pdjm3BC"C
WOhD`D
v[u*m+Z,XC
7zS@=M
+H)^@_
kernel32.dll
athName0#A
AAnE#hw
sl$bb@
ta!#6,b
x Tb3},
Qcale&
/OC"RS
x7Y-emu0J
=W9cK%
gkQX8d
8EKDE#
St+L+$
4(*(Cu"Jr@tPF
}~7(qM
rV9,/F
2Ftl?vo
-$fkw%Mf
B@M38s
BS!wN[m;
@t72W
]B@`-X
a-7V>Y
W4OG)d
@,Wt.Y
A0ZwkY
8ec<(+
A@x,k-
2 xtp2 lhd
2 8402 ,($
#cp$pN
Exception$},q{
ppgEHed(;apZ[
EOutOfMemory[
EIn]Err
y[4rW4r
sWDsr*
EDivByZoW
!CRalngeWF
Ov]"lowsPt[PtXXc
idEVOpmW
2YeXWX
B#k`@PVW"
__(kPoind[
{zEAcssVla|_|
PrxleW
EaStack0x[4
B0xCot
.jlCkWx
6FandDy
f88[y+
SU{5UzWTz/
Safe~7 Ql?
U"ls#4!w
$F]({PK~;
TThr?dCu
x0'2v
$TMul>R
steWlVncN*izer+)0
AoDjZw
%"9't*^
[T6[7.\
WA38ZwQ
s,sF+U.G,
,fQ@|Z
b[#Tx):u(\
(R-Dcp5W"
\+A:`\:
^"8t[^_3-j30]1
~aFWf$
W/%=T't!)S}
%3 @t[CPe_\
D@'F_%,*It.
cFYs+?q
R 4M(_
e"mt<:u
G]ZYNsD<*50r=<9w9iXb
(]\GK4
lRiW0vw_M)^D]
9u-AN,
"[wGGD
u:A#R[<
N;MwS5
NtryM=
l=!b1l}&
Fp"z,8}
8~ZM4H(
)E]UJU"}6
[~iHCTF
Auakf.Jys
<D*Lm,4
|)A->
73l#}j
( M3R~x
CDHeU2v
"|`lKr8"C{
K,]Mp$Gv
9wHuF:$
/mctF;s<j
#B?w1Ko
p:hC;~
D/r8.B
^!VM.90Yt
(Nu7-5
StR$5|#D
bF^"%G
} UTEmMa
k-F-9o
\}K*a**Mx
,Xg8;m5
ddYSU0(@!tHU
A3t7G5(
ZzVcClx
vgld7Z>cgcc[
(NFJ&#
s";UEuw
W4qGnA
@@aBLNg7
_:|+G{j3
utx}rV
(HwyCC@Q)+S+;vF
GG,g3#u
@B=uTn{
IuSv/)e`
y<%o4,
&2`?l8,:
@<ea!)6H]
{ AMPM
&sLM%bv
D{)4h7]
h\h\LZlK
_DiskFreeSp.
_#z3i*
@FL`G:
oD G/D
uv[up1)%
l(!+"?DWD
;FD3Lc
0sD,Q3
G@)\_22`
3'+Dw8
-]wdk[P$+
;vXU;B$`
x4pt]8h
;Hs#d7
|Xtp8xC7t
T$dsPL\&8L41
hS9.K>
DL2$@849$(
TCustomTyped{
$I"(Z7Z,
l-J>1b`
|wC3GDk
}P-sG@s(s<Pj
0bG6`$V
-V=^Kl+j9F2
iu.+"L
@SEIF(
{@%/P]
3M-;HW
5R+(:r
*6B`MQZ
ar[?( s3^:+]
_ktuue6!Od%Z&
)8XWK[I
&}zuiVm
PaY<g'
r(E]pn
U]E,A`
[Y4}EP&
a8pk._+
$!V1ee
Xiabfam0kBX"Ws
#;}H<!j
VQd6My
c\iot5
6:LV`K
v3#4"&
mNEDW|C^aC$M
|$HAD
"A,](w
r0U$[TT
'#@*:<R
ZH0o&CFFo(
MB&yvmTX{Q
8BO"((A
w%$[4Q
`eTGS
F!P /PX
rT<@^7
@%\k:$?
rt/}l#
IfF^'W
%,?Up$
^Lf;]Hbh
pMu"zcA
XsMJ,aEg#Df
7<d`6V
VEut9`-ub3<M
EBUvt-[
xz +2'
f\MHu%
)!O&gVx
l;U2_e
?X_LDVM
HHt*?lc
H\^|llF
1RP0'F<0
64OpRfMUFYyH*<
{vgI-X
5pW|`
}K,a.ERM
P@a=Kvi
P'=t!w
E@0>o'Q0"M
P6*.vc
yc!5~TK`i5-
6MJ-8Z@+RmB
.BpHs$
OnPRoavZ
160SVB
1Buv&bx
.taZP|
]co(lo
I7Fs#>u
^j^"k:
%oetv\&P
m+4$T*
n,YZ+HA'*
oc7x'|u
n\"h5&
C9~]_^?
Cq\p8 @p
(xYBQ9`4
aJGNnE
<jf"XW\JuQ9#
76C9;|
%i4CR7
Oh!-\<dxP:A
Pz]NJx
wv{2bbY
v,^[]7
Y=XwWQ
R@0(}
\*`}AM-
!A3KL`
t*E"0?
u/Y%'lt!
u`K'JKva--
Y+v0sP
'ti%!i
TLXaXD
vY;")
2[l]L@
Q@HKaD
uuJD ?~{{{:
7v>_^v
?IA}h|w|ZGDA)Zc
=xPMd= z:(\W
KlW,FE"a
MTb0 Zc]
y{bdNE
R&jkMQ\Q$Wu
PHE*<le?
7Sa2?{X >C
4UJB3r
/Peam7
}OpenY@
6 HWQr
EClassNotF C
+mponen^[UVD7
mP@D$%AE0*{])o
IsAdapt
D+@+K3
l!#?\[l
THa{u"1#L
DPrP?APv
rFiusa
1Qv\\(g{<
ky`tCY{(S2v
l{,qE({[
T!dz#Ab
YEkOAQ@
gGupsW/P
)XB4B1E
.*Z_Q^
%HzxV}
A!aG)G
V0X-E6@
)@Rz$(
!e;xTQ6&%s
h-b$Sk85
D=[#0 6
XVTcd|U
< E@:B5e)
^)1*RP
eZXEF@l
@,\DZ{
6/PM8]UK}
D#0>U,YZ>CD9
AK@";SVO
VU[l~,QPN
<lp@S~tO
OZMGME$W`1B#eEE
t<2Ph$#
9wP('+
$%EtW$
0H&jHsv@.9
!'k?z@U(.9>*
U.74p6
-K`.wr]e8,O
uhi%^[(UUv
A3Y+bVQ
"Hf0_^
Pn'/UXu
7+AX`D<
/M.#AMc@M#
U <%hl
C Jy,@Db`
- :!mu2Fp
;bMX:CKUM8
M4YTmm
43`*`%a1I>
/0qMUsl
1'9-wdMN
E,1BU*MXr
:hq)9G2xVN2#h
j2"I'q
W9H"223AW
A@9V|s
E&+CO@
dq>*CK
"C(H[Ol
W&]kPpKX~@#*\$
ddPt\S2~E
0ZCm>H*E3+\
CN#}=!
o-)|0|"
wM`#V(
I&i`p`#
]IxB&X@^)
rPp <A(tY
)hdgM=
-|J@}e.D:a
]A] (P`H{u
U7'jwtp
O:V;tV)u
^uO)BmTG
TPropFixjup;BT`wAAX\
]a&c|`EpF
(%nPiG
G'P0&k8
EHY$CE0
od0?Owner
$!?E_8
0bEAs/
Atk Srd). 5
Q8/!5wC
JXE8:[`M
2ZdT \DKt5\FX
,u&f(QXz
0x{I@
a8,52*R;X
UK\HA4u=W=D+t0
V{6N;w
)v, B`
D|{0"4E,
FDeg't
D,L7 ^0@
{rH("FQ
8!{NP,[!6
CP]Q-}}
X0,O]'`
q288mQXl%.[Y
}gxl,(>_0
{v3_?Xs.
LT3I7H/
\!"I3Il
Z#(UcP4
D2 wx/
}qYZ7<
M;bE 6\5
.uEp;XE+-<"
/(>uF|YFC
hgUgI0
xp`HY<
D;!Q>E75&v
2KxsE^SmI
(H\Y@sWn0#PV8VEAS28`X
$A[H__&~
j\a+p,
TTZu]!n
ie[>z
x=aTBBp`
/0+X03
!4#lYEGZg
4Gv@Gs_
R(mCu2'K
c+Z`P0
(HvX9u
c>A(J6
"XH_*v
GDW@V%
}TI"S`5
U/"TZ_jVq
?X6B&~/~V
E(a (8
08E-c@z0
NC~C<2j
U'!U"V
puifE'
ZPWA$x
y$*^F;
JYKjg&
Nkc^6{
x:w?[XY
l`dT@"
dpI">m
Qq4;?}&#U!
rw</F0X
aSeat"R
F"8Vr|
4KDA8R
poV>U%=
xLlY({k}
KgKqssVw
I:t1,"
~** u
P@d0Y,>#pUh
-'6X0 >%
cY%#XA
s{!)tK
Y>%f?Zh.(
M>&w,U/
gX fdourgu`
UqQ_Ah
u~,KWbtY{
Kvu!lh
,A;$@`
tpjybu
PY}ihHs
"(B|:B
lG*3m;`
u07^h}"
("H@@@x~J{
_~T@Y@
@uDz|#
EX7]>C
w'20>R
K;/MQBB
R_F|'M9
$3LntY
tl!4<Q
6QMEl09}
/YLC0Qp
&B(:S/X
q";"Q#
O(JiY|$
!B(\QDM
-AT[\g
)zH+lU?
tM]xUR^
Fi(.P4$L
K JA9R
eftTopO
[0!euD
Epm5"4ftt
$YZ_'`
4~lQzJz1H
1Fb;-E
8UBa?4
'JBPG@
IoxML%k]}
\Q5P1q=
RCgry,
<_<!kN
Tq<J_<h$@_
K\g4!bPl
upP4<$*fOh
N#E,UK
X*~[8W
92-vlF/j
l TMVct2 .C}
i!caW@
sOJBQC,5 P
B \r(X
s Ep<ode ~G
2 - At Of ThJ
~ Down
7_.exeG'Jenwna Jam(,ABuilt2o
o\Speed7lk.o[DiVX] L(#on
!R,mJK7?H
o"nd@-SLrro
{%0JGFCKY3
WmkQHILuL
%Oat=7/Child/!
S1|o!J
}c+wo+nla
b9d-+
+Websi,s#"_IMcc
Der#+MSN
w0U+and7_
of$Dy#
W dj/XP[k
(wK`BFl
h 5.0'
5DSLX/8UncaSX
'P@)t
autestF
)aOFirewallW#'U& 6 KeGNhv
4nvi,E:. -87
Kj@/AikaQus`
enai.+
wz9}aan1sstalwX
e-.r+I
[n"WPX
SS+FBr1oud
(nu c
HxETAokl!tBg'B.s!Ul*.5
+foCDj
?caBUt1.O (WORKS!!)/*[Ef-Mb:x)Y
GsW#,}[LINE
CD1++h_HXp
4Ts)'B0aZaA 4Hsk.8Mv29UNOFFICIAL/?
z5dHDn
;\!_nm
o8+'c
OHH{$AT,1
@|%\%6
Fmr3`e\z5
E^zaa\`c`C
+~]|'! KuQH
\{ 85X
9\\Cur
.D6d)Ik
Wu<{a=0
"N8@zDem-Xb
GOg<"-*v
S%l?u6DgX
NV%Hv@"8o
z\G'figqi`d
b=(Ru/
; 0GIq@+h
H,7E012<6345:
@dhax0C084
baKL=bHs!F
^9@"LI
j; rSU
D$QlTU_
time e
6789AB
CDEFz~
ii(08@HiPX`hpixii
ej2 A#
w|0xw
!Ox?yryTz
Pli:(O
AY;_mohR<@o
>$pgpW_
@n ;';@
FU%JQUTU
UUUJFQU%
O]7a%m;m
aA})eg-r
?3yI^ll
Qi3a,X/l
iG!vF7
0{ct19d\6fC6w
5l+![%
+%_!-ay
ck0EpK
oM8DOW0l
y90PvHQl
+En'$l)''<-K
Opbt}nmC
lAAx5g
/)6vHv
#)kn/!
E=`0sp
E`0kiaC,f
cGv LH}laSMdd
U1`0w
T7Erw-
#Om$}1
Qbw@h-D
H ;lAns
w"S]Juws6Hd;RU
gtH=gA
F)#?Dh
D/kqet
{cCp+^2
amh}kI
%pe}dP6
Ini-@o
"RTLusEP
K hTb(UX
mn05QH\f
*Sleep
teCvi6S2[
@iz0ViPErtu
aAllocaoc
('To%s?
(v{Add&ss
;}omm@n.5
UnhdapC/
ZYDirdocR
6CE{;`
umCM?0B
s1T~$cVoue
g6w%(lFF`chFSdcL|af
GeFraUBound
.|p^N<tA> a
DAT`o)U
'-q@psw
XPTPSWXaD$j
9u\1~B
advapi32.dll
KERNEL32.DLL
oleaut32.dll
user32.dll
RegCloseKey
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
VariantCopy
CharNextA
LkXk2pQ'5
/[27S<e
y=kI,p
~HrOG08&tKCO5U?
9q'8u#
Ez^V5Z>q
3?I|0NYD!p}O
)>*;P$
`v<:d[
5P7qy X@.(
Y6RwQa
BE~k=9
LX1PHk
c{qd>tV+
6HbREW)9XXt0ycF1\
M+Kb1!
s8J3\@
Cy:+?K
GJmSbK
mk/MljYK
;m7?*E:`It}`
)miF?{sW#l4
BC5yTsVd
4Ay <::
m'j*>>Q
LkXk2pQ'5
LkXk2pQ'5
/[27S<e
y=kI,p
~HrOG08&tKCO5U?
LkXk2pQ'5
/[27S<e
y=kI,p
~HrOG08&tKCO5U?
9q'8u#
Ez^V5Z>q
3?I|0NYD!p}O
(W>$V09.s
d^CZ[!lL
+`j6js$z
JWUr@QyQA
/?6y<L
g{aV\]B>
UMZ=>
=?BJwZi
I.t,L[8 1cO"
F+J'']X
;yeF='bi
+LUkch
QYHF9j
z)tc,lfL-
=oBvA~
A7@J?_
jXjfeaL
%SXwJa
pyG+yL-
O;+*SA
mqTJSg
OAE)sCq
M0<U"<Kc
cVo(J/52
k9+=~`
&weKbR5H$.H
>1"s&6|Pj2Z
$5MX,xr
iq&,IHG
Sx;=?}K
^E]r6LX9t$d5
Xw3@Ntka"&1p+U
F,w >A#maN
/g}OpYG
;USbekCJGz
.2R3*
=tI`A9]_P}
whupu0
aG<d_V"7aw
6V(ia0y
7:>2u-fV
AQdE;z~
%|^H$ r5Dqv
vhsXO?
;Da4s+v
h:F67~_
-<LW*[f
vlwG$T.4h6R
(Zm!Ef127Sb
P0W+71{
6nU'Ss`
~3B[I:>3
iG(@Vq
gS^m6m'TcA
LkXk2pQ'5
/[27S<e
y=kI,p
~HrOG0
LkXk2pQ'5
/[27S<e
y=kI,p
~HrOG08&t
]$N/`Z
He'=YX<L
G$*4bz)X?
xYpNr,J26s
hnQ2O9S4
u+u,J(S<j
T\d<HSE'
Xo6(/n-o
'qoi<{
xEda)r
o}[mqu<HCIm
'+s}Z[F
>nrKNPw@"Ix\]^NN
O!vq[=
j>5t#
?ZO^%W
z}hg|<<-
t`Ms j[xf\Rv)+
IK?157OQ
A-BnJs
{]3T~a`y
[[afAaU(
% ,eq%n
(uxf<<5a'
}(D1^:43
2@q'D4O
IV!cxEf;aQRJmoS1
8v'*T@
AT6#A#@o
6EWIxqZ
,,q<~/
{xF|#,
3CigmP
1,l,N
]Yakv\0,NhZ$
-T,QWf~#HB4
-(051Z
sW5k;7gn{I
%Hda^i
@5qFJi
HE FC/3\;^~F'a
E?o/72V4u!
T4Di23|JuuB4
toRu2Q
6I/'H|
%t,]Pgy
$mtlWlR9Z
#5=em@H4cBW
xl]W@R
OHgtjA
upgrXUn
a$[U=]
Gw'JMB
Zu~y-YT
G5![03w
4n!X-T2
v$GHwE
0f$t,[|
r9f!2$!6Db"$
}l; m&&
'^;58l
VTYc0/
mu(}AC}RKX#
[TSRlPy
V?_UzO/
*r:$In
K%3}e^
?d_ljH
$5?*Q^
j`=>@
F[e3jR3
/P_/^B
<y/8> Bm
98xT2"1%m
Aj;R`7_Me
P .dTj
ydc,2/
vFN%P'[+($af
%l/\s?
)T%iqLe
#oCGF;4
(2QqNC
(G-Vpl
xiq<Ih
`*j[770
`FQ|OvTN7[
+bDbGR+`
@T#gJ+<N
9'p+f_;:ez-Z
~OSNxP
2:63V8w
zz"Wm@cu,C]
$Fv`#}v
&JVrYd>`F
kkH#o#
T,4nw8-_s}l;Gf,
U}=gAc
-<~ARTmnQ
X>X!aC*?&V
DVCLAL
PACKAGEINFO

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.