1.2
低危

0fa6b91eff931b853f18b6e0ce71930ab4be837670baf36c9d8aeb2d9f263fe3

0fa6b91eff931b853f18b6e0ce71930ab4be837670baf36c9d8aeb2d9f263fe3.exe

分析耗时

191s

最近分析

374天前

文件大小

90.2KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN BACKDOOR DELF
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.81
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Worm:Win32/Mydoom.ea05863c 20190527 0.3.0.5
Avast Win32:Evo-gen [Trj] 20240402 23.9.8494.0
Baidu Win32.Trojan.Delf.j 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20231026 1.0
Kingsoft None 20230906 None
McAfee Artemis!75EF279505D0 20240401 6.0.6.653
Tencent Backdoor.Win32.Delf.wa 20240402 1.0.0.1
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (6 个事件)
section {'name': 'CODE', 'virtual_address': '0x00001000', 'virtual_size': '0x0000a000', 'size_of_data': '0x00005600', 'entropy': 7.992235378339067} entropy 7.992235378339067 description 发现高熵的节
section {'name': 'DATA', 'virtual_address': '0x0000b000', 'virtual_size': '0x00001000', 'size_of_data': '0x00000200', 'entropy': 7.537443661508319} entropy 7.537443661508319 description 发现高熵的节
section {'name': '.idata', 'virtual_address': '0x0000e000', 'virtual_size': '0x00001000', 'size_of_data': '0x00000600', 'entropy': 7.871666928051274} entropy 7.871666928051274 description 发现高熵的节
section {'name': '.rdata', 'virtual_address': '0x00010000', 'virtual_size': '0x00002000', 'size_of_data': '0x00000200', 'entropy': 7.582096724860129} entropy 7.582096724860129 description 发现高熵的节
section {'name': '', 'virtual_address': '0x00013000', 'virtual_size': '0x00003000', 'size_of_data': '0x00002400', 'entropy': 7.596943615976609} entropy 7.596943615976609 description 发现高熵的节
entropy 0.9705882352941176 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意 (50 out of 63 个事件)
ALYac Generic.Malware.S!dld!.C44D850D
APEX Malicious
AVG Win32:Evo-gen [Trj]
Acronis suspicious
AhnLab-V3 Backdoor/Win32.Delf.R257860
Alibaba Worm:Win32/Mydoom.ea05863c
Antiy-AVL Trojan[Backdoor]/Win32.Delf
Arcabit Generic.Malware.S!dld!.C44D850D
Avast Win32:Evo-gen [Trj]
Avira TR/Dropper.Gen
Baidu Win32.Trojan.Delf.j
BitDefender Generic.Malware.S!dld!.C44D850D
BitDefenderTheta AI:Packer.3B2C2E2C21
Bkav W32.AIDetectMalware
ClamAV Win.Malware.Delf-9627806-0
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.505d05
Cylance unsafe
Cynet Malicious (score: 100)
DeepInstinct MALICIOUS
DrWeb Trojan.Siggen3.61286
ESET-NOD32 a variant of Win32/LunaStorm.D
Elastic malicious (high confidence)
Emsisoft Generic.Malware.S!dld!.C44D850D (B)
F-Secure Trojan.TR/Dropper.Gen
FireEye Generic.mg.75ef279505d05b6e
Fortinet W32/LunaStorm.D!worm
GData Win32.Trojan.PSE.1ALBKCE
Google Detected
Gridinsoft Trojan.Win32.Agent.bot!s1
Ikarus Worm.Win32.Lunastorm
Jiangmin Backdoor.Delf.hzu
K7AntiVirus Trojan ( 000010291 )
K7GW Trojan ( 000010291 )
Kaspersky Backdoor.Win32.Delf.cst
Lionic Trojan.Win32.Delf.tpLp
MAX malware (ai score=84)
Malwarebytes Generic.Malware.AI.DDS
McAfee Artemis!75EF279505D0
MicroWorld-eScan Generic.Malware.S!dld!.C44D850D
Microsoft Worm:Win32/Mydoom!pz
NANO-Antivirus Trojan.Win32.Delf.fnpcbp
Panda Trj/Genetic.gen
Rising Backdoor.Delf!1.64C1 (CLOUD)
Sangfor Suspicious.Win32.Save.a
SentinelOne Static AI - Malicious PE
Skyhigh BehavesLike.Win32.Generic.nc
Sophos Troj/Luiha-BN
Symantec SMG.Heur!gen
Tencent Backdoor.Win32.Delf.wa
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

PE Imphash

3c0e70bfa5f73f1f1cef484e2bcb5bf8

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
CODE 0x00001000 0x0000a000 0x00005600 7.992235378339067
DATA 0x0000b000 0x00001000 0x00000200 7.537443661508319
BSS 0x0000c000 0x00002000 0x00000000 0.0
.idata 0x0000e000 0x00001000 0x00000600 7.871666928051274
.tls 0x0000f000 0x00001000 0x00000000 0.0
.rdata 0x00010000 0x00002000 0x00000200 7.582096724860129
.rsrc 0x00012000 0x00001000 0x00000400 6.753357619284395
0x00013000 0x00003000 0x00002400 7.596943615976609

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000150be 0x000002e8 LANG_ENGLISH SUBLANG_ENGLISH_PHILIPPINES None
RT_RCDATA 0x00012448 0x000000a8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_RCDATA 0x00012448 0x000000a8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_GROUP_ICON 0x000150aa 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_PHILIPPINES None

Imports

Library kernel32.dll:
0x414c2e GetModuleHandleA
Library user32.dll:
0x414c36 MessageBoxA

L!This program must be run under Win32
.idata
.rdata
8\plJ
{{~nZc
9HGuX+r)"
xT{5-l;^`
y.%mtB)DHV
5)VBdY
t;jj+iOi%
nj`.J[D
,"V:&Q>|KE`
nST(>v
!*QqM5#
]Wi[m.0P
PJ8Sn;La.v
3pyG(Tv;L=dxjp
rdK'p pQ
">nPccB
W?qK{_|
F<[Qg%
VTOoU}
r'a%=xF;
Nzv@UG~
/(>)Xod?T
/G@1w!K]@
Z{CDkZ$
37; WpA
&T;$c^_v>Bq
OdtG=yK
@w7ON2~7{
c&N1%4
B(N&U(gO.Q
xYb4~6Ys
1P\1S
sc~%Pa=A|94
G)Ek|u'8^/
YY &p!`e
;~c!,?y3_
%"L]GS[B
T n.AT
X\IkRl
Ko0X]ZH>K
$.a1X_w4'k.
:OgKcfp
@~3?rP+l/eE,
QZ_c}Wid@
<4fKN@h
;:.i%<FS
tv{%7/7vz
A/b'P<a:[AOL)>>0
(~)<.u
-%\UU8)
@'!Rfi
SiOIg'
RzP=\ ?o/T~P
w#6IBV^3f_
"(]x-@@P).,
4v&@m6IQ#
\mvD8+
:W~/>H,
`YJ"td3
3@'@{KFe:'Y#q_Q
^T"_z*
V#Sd:?rc
b{kZK<
NPcBsP
70eJ5X~{O-4J
$e([47t$
] >g2j
_p's;4*iG?mJNX
Td2Y9TN:v
z:lxXq
xj3eJ<IJ
9C_/W4m?+M<V"zJ
76(SY:
AG%%sO|;dm
$)8heVA
\dmY&0
NiG0[\s
]*}6K>j`g
^0t$DB;`6>l?-v%E$N U-tf
y-"'Z:
O,W6C'hF3|
{s5k){
)dh2]+
D .b[1fV
3>|X`NZdQF;?%>cWh,.9
}"P38*fO
ZeY,7JB
vt;vwHT
l (_\CV?
Xt%W,p
aHAkf,#
* !s2`WUmR
6j|f[gk)h
$G{!6y}g
b"7S#NaLr
Lv$9^
9.u2; zZS
_rtNCfa
$brI~u@2(q}')H
ZDFenI
`mZRj;
Bz:%E}
7n}@49
p,6Tl6eje
U2KWD^4
V!grHg
$`t|F6z:
: %kh<F}WAcTvcQg
0HiA<k`<rdp}G!j
p,.-ZE]
a3<_bw]&
qH\zn!x
*Mj=gK$U?/[j)
dKLot>GP_K9I2V
>H#T^=V9?ki
PbPhX
Cs" uuQ6+$K`t
gDvM\~
.MM[RMRG[~i;g
qUsVPEd/
r;zfk"Ye
K~#$18-q
M12;-
0)}P"N'T*NR-
$-vog|
,5Gvd#
8d`bl)!
!5{y9/-b
UCbPK1>bx
r2fh1q
FEg[8<#
~KW7%e19IN
^@|?7u!
H9IQl_N4
7s:R7NL,KS
,&Y '`E
$7lp5G9
aWJfJwp
_-yJ5tw
p'L*qpQ
6,K@|[l6Y
K]^|7R0=
l\fS6QIjdnr0!qQqHSW
K%LycGu
RK^f@{
TW7fKD
@]Z"-?
4gu[3u[vT$~
n:{gNMh
)W+M S
5'U.+_:k
.5?/ BA=.2M
3-+:cv[[M
f~@07i%v
S,dxnQJ
:\,P@Ccst
KQ-wzN#}vC
JmsxP1MX"b%
%iSmOU
vfuUt}^
+wtp(f]
pM@=p)&
~S1%%aQdV
)vbM,D
F;gB7}jy|T
MfybNS)i[H<+w
Dov)XE
4Od4,`[oc]b
TU#,-Z
]NO|j&
$Tjms_'h=4
'BTzL&].
l.5yX}VzpJeg
,ndn{%
IeE-Ibfe
D"=XCvbf4>m/x7}y8>
< fX1?k=79q
BMA^{LRG
N }~l;
],PfO_:c
qhM}`\
Y5q:+=
kB`k+}e
Thn"WN
E o`J$.
$pAOFtG
0Cp{@GW
#sVh"3'aq
(y?+r}d8$2
QriL~@
r#oE:SI%y(g@{
_s]7[G
v4f.XO
K`!A%
rz2L1!(E
r!Qp]iIx
fu.,[%RShFp66
#G/#W
4|f8\|5T?>b$X8
qDRcJ&DV
1C4 O;[K@
gWS=O.dctf+
\K#H#n veo
dJH5vY}&85%V
W~3 L'7G@(t
[NWaeK
#M8>hyt)[5
Q4kco!fOMta
<5BpDh=
b:rKi)6DZ,_+
3sNZ2@,a}S
xNqz1eF!BG
QlQX-Ee
d^X[
;g|I[V
=->X%J
/)|*qI8
*o@0nt
4#_NIP
(R;Lx
NZJ8qLU
9(0L,?3
'9Yt;W|LW
QqX9.8Q
{g#y9a:
;oGP1'-U:6gnpL:
t#/4Qw3
& 6HycW
nM'e7A
)jdhiIYo&
|3ih#^
@D}`;i-
o.6QpQmPE% cZlZu
70o/7B
<D?](UwtcrU "
{F8V/dVED'*
><Bck9
o4ju~vkK|
lwK'15|Wx
Ep4x8L _p
?F}OG_=
G!FK8=
a0I$@7oY_yiKM
op.TNL$/*/'b>f
s!$m!9P[`
{1.UM;
sAm-qLa6
=`|mgl
W,,RoI
x*Qx/4
^zCo;X
E%yU|r
_VC dy.8HH]
%d$pZ
HSW59CB
:,kC1?5A4m}
SH=N- , l
`$,">:
[!%!;+]z~
I_G{qf
?fCQgn@,9;d=
,/z/buX
}C)P')
FAc$t{)0Y{"(i
uLD|obeV
{|b]"d
|%-g2H
UC,[<qal
Y?d*||B
4\;;2$"
2[4zu;O2|
WDbj\u@\ib[t
*^vIs4}%N$
DKUdj*6
..<NRi
P&-'_z
ItN=\s
|?xCBP
H\gd96
'yaJEO"AAN
)!9<Bg
^+h7Cfw<G
7/HQ U&Rd
eLNUOa
[b,_K8
d~R#Frk6U6n
X"nH^|-<Tl71
EX>mA,rb>Kou9$G?0I
bDAm|O]
bi%w )7R'+!w
2%&Lc~
(#Cp$d
@~=ADZP}IF}KBD
FBD!%Q:Z<z
+x&h!W
HM&AgSQQ_^
AO!}w
lOm-eH&wkc
'?0?F2
@uGyJ:=bHw*0;:F5161s
X[+@O]b
|!g9UKgD|?
x (Pbv
jDiI6.&c8&
llz 0f7}Ooiv
?vR{98
qId\Jq4dg
*22\tJ
@&)k<-
nKKi2OT1
c4aQ_SG?KDV&f3
~y;cis
lODtUw%{CZ:Gl/<fk[tXIRG6oI
)>WTsRT
R{xT^`
6+i/+u~S
0dzshrOxut
_a[5P
OV]VM+H>
_~_9ElI?FmL
G`MvBIS
Q!w{yLQ*~
=d:GO9
a_9(cl3
v#C{}nD8
gY66@S
&\XJ$I
~FeEY#
RDL:_p
6E"2P9l
l|9[W
K@AnZ~
:tRr|\'
l&{_~F_9P40;x. ;w5zC'
txgI'0
,"!<`jrQ
g|3J$.
r1H.dZ7sg
A>teG~
q~^|)^A@ <
,j_<ui K}nRQF{;f!En-?
[89M;4&
V^*R(nk
h;uVR(2 Cm
2kobW"
L}e^iD
NHip$e
A|E7TGy7B@';@V
lb{FNmMC
+zT58O
OBt"`]9
{B2=Kx
VD%#!byC
iq`61R
gq~caF
{R8E`>]b
b9#dI+
?_BwtT
4>\q6-
)`f.K+
|a\V(,)
!?g&!+g
Y=Ip2:
;swl/;1)jVEm]q]
6v/G|2i
trO:mZ@-
gCgtd%b},
5S,GP=9
Hg)W:;o[+
#lP`KW
KYqfin
[/lq4cM
+bqyt;t
ipdl^djIx
>WN*ra
cal7K-s-
dX/$9
Hs%y\b
yR=@2Q
3ECUWV
!!$yzx
&W5II*@
Q^i ?h*
IK$if7;~(>
M*:wVY
~$^,EZJD.
/P|{j${w
3o2^,zZ+\M
R{<TN% sWbZXz
5.U2KcqGs%
E&W2V%SKf$XOa IL
SpSkZ`
Bt|q$|-
Cd{tts
rO<75s/P
U9z8Y@k/6&<
=q"$xB
(y&fK`
V|x[VT
HRKCLkR
t__C>eT%E
BPZAc+{
ixF:47Zr
S;>^`j
Qrt"CIh`
bxXQDJL
w&E4]#
q2txp[6O^
\.qd!#
1O[,x9e0
v@!#{Nf@@
:=d,=2Z
C d)3E
nGJctwdG
fu&X-o
q"<=HP,
]->Srljz/r
U<E5L\
q3Oul1z
PB1uaH
O6l{VC
h}Gjm
w$/t:TI1Q!=
,<+p4M_D
$]SGkNq
*&Bkd/E5Y
2T|gwP7H
_v?flM\`
CxuN;,Dsm
wuEPo[8
0+%.!r
b,]B4<SAW4[M
dHv9o+
z]7B5L
7bS`_&
T0kxeY
jQ=/i
n|?EWkal|m,?
.MqiiCk.
%=.).pxa2J
zZei3@6MSts9:Gb#
A%H>pI0
IF,fyN+T\
vWBFrn
[o*$;yt
UC[e~O
$ H|."
[N;bZ8:7;'9Rpl
8"no'C>Jc
k0k[[zm+fP%
*Z XS,
K9wD7|lY3sj
GiwMN-J< c
<BPck9
l^Nz>v
!2)3Ep
6h_ZG/)m2a4w
RY[6I'Zv*75"
g-Qt+]
i_*=_9kT
=YwvArX,tra
V>)4UYD?fE\t^y
ySJ>P5
u;*q!f>
;&&iQ$P/
uE9"w\
S@XVhS6
D";xO4u6cs
gvhF;0
Fu'm5o
|"+'kM
r@\h1m
Iro}HB
xe0tE}i
lf5Pu^2gw3,+
Fh@xn/(0Sc>]Jb%
5gH6T'
!n*{P!
[%eViJI'
U,=3c(
,T^AC`#v
sEx<>1;
tQRp^33gxGgXE
u'"N$Z51saJ%GwPVw
=^E00B
c{(T`a$
zPHb;4]
3-|QtLo>
3Q!rB{6gHKa
mSL}_Uz]
$ H\c0b<
BJJ-;+'
{2.Zdnz>T"
d]O!oT|D
|:roazX'[sfm4y
7LraH]j
dZt@'$2
Mz*M&{-Q]
8.J^7Gp!rL
S{eNgi[@
LCd'bg6#
{<:y&q
DI>nip
C*ShlAP7
+ockvpMY
aFu3nc
boV>!MyD>N
xBIO$fc=?&<W
X.b|2zUi{gG#lih!jP7]9j
33es#Lzy
Ac-YUEIA+YdeQNmw'
iA|8RtY#
+d!JS?
J0}UR
@8je9D<W
6r,&$l
[9}*UV<mXt08iP
DPGP?HrTrD
M{UouM
g!t]4{
vl+^LW^Yk
K66-Q\$J&vZ
A\#N2!
6{>=64
tBO\~|o/vjVSh8(#MnXVT1\
ATc@G:kg
:b'|vhtv&|
WRG1`v/
0KrFTSuU4
tM2u#vd.:ljGza N
T>5,BD
SJz'"6#
M.c\'"fG
!n+m1b,
y7LtB~s
RdVCQa"YmVVk
XZebx8
oIFv4d(TaX
"T:T. 286DV<VPBDJHVhNhbTV\ZJ
fLn5Q8x@.p\'~\?
@QgS6dXA
"-}"!Y;G_Y(&
H0JA=4dWZqr$04Bl
rC,-0fYG
e$9 Ff
m1&pLZDb_Ge
[ar6!j
gIi@|2
b`-bc'z
18>0?vHfjJf
hq<q%!?
Er}Ey\
c6mQTf
F%vU+R
,sOj=k
H)%~ji\
Me>nosj:+$1F&+%H^/
#qVEf(+k+*m!
[%G4d~Q>
lq-JWe
P]M[=7(e
S&s?'/
7q#7!QS[
%'c-jZq_-q
Mi_jtW
W~`v|Fx}
g56~^Q
&i]/F\[C
v=kT:[2oQ
=@DA+W~|)G>
>>:v!r2M$
MF<w:l}I
?Cx*rg,K~TM
=>#$h\
whVB=B
3&%._N5
E..if,hr
'h2c<1
%=1{~DvY
a=#IDU
$aQ*|'.D
Z=hylltY
F9fKL#
`f:]sa%n
d]NV>Cs7B0
_Vwt8z
^:5#tL
%Ej^@%TC
_2ugrW-l
6:MUiL{c})PW
5|4;28r?*2l<eY
k4E/Tf
FOXj[R
U})vly]
`KPStqG?NrFXhOr
#BLxn.*
`m64J{
C&f&r:
2 {.LXg>
ROt;{rC:H6v_-
k=/4OzK
KUE*EFMTZ
p(O!&1,Gi88$+
P? cQc
^qh7HM
&pL+B*26
Jw3TI|X1
dke!\eS@os
|1,Z5E'L:6
8;JdHm
v;"^c==
>GO$=!&
/vPR;0:
,LwA7'
Q^P_{pw!mG9
LaUKzK
z.~t7w
.6.,?B
N$AMjN]\ GCa6
8!C0$4ELj^
v1w'Sg
0xI:uf#V
u6Pr,;\~L
cE'UiCB
ox/+t[
>T.:x7
F.m q3X
D)-_rL8$P>r42
aF,lF,
=nky12
E0s'u{3eu
k?$J;=L{
qB>f5Y
?hswN-gS
kernel32.dll
user32.dll
GetModuleHandleA
MessageBoxA
uhPD;ywpY}&l>
i.BI{7<#v(nH"P
Z9Z<"sens\~
L==Qp*d[0
\;+Lw~sC~
tbjxNZ(
Mr![jm6O~2
6PI& $NZb~
bqdrRZ7
A=nMkx7.
zF&&Lfos@~
hcdxXU
Z7%Pj~e
|:=yho6F?^d`c=Q
>}I! Rcbb
<^!ubnO
F4-Vj+
t-H30"
Gggfv@
&vvggd
wwgbvt
1wwwr"gf@
1wwwr"vv@
wr""gf@
wr""&f@
ww"w""@
1wr'""@
3333;31
333333
sp`x`laE
jrYVK\~NA8XvC
W}vy_jmx
LL@GGNv
8Y>cPH
^.~_T@\|p
1qx0zi
-i7g~jw
.9'n#\{?
?" wBQ
?hD^v[Q
a{Hjev
jC?UQ67
lIb9oa
M'Jg%|
76r@q"-t,MiX
4LWN1D-N
$@-*{
>3uwZ6H7W
OzOXr4V|7i?Q
5';+FV
3jNqz2(X'!
_i0oT>`"SbXm
#vocUdi
@FS,_-*
:--KWrw
Ku'{q}L
)ye(Y)bVt
|qxf+0
K'(6*sq,*n
$cc6];A
Xw76>#w|
BoH^,_
u/?2~(
4ja74JLf:hT[H=/TZ
pu{,0CU:
p.9t"u\6x5vq
gTG(1@T[i/3
&>*[j:<G_1H%M
)x-e9|
?)6sUtP;n
rPfh/3Au
hx_iyd
WzfFIp]8s.`
/Ie8B}?}>F zCN"VCS
7YQ(GP
=14e('3p
EV[/k*u
6)2t=%
-]`F`E
u&oLz^:
FXozq^
Qt>aP"Sm8Du)uli99d
H4f>Mb
mfAL=F
n+8?J`S
0nM"W5Xz
^/SZoqM
:m*OsP
kZX2f.
<Oj@O.
@^;7"<hCX
G=^9FE
I;'l+r7
UeEfi,
K9yo1N.|.
\zZ)1V
;%\}y"4^
*XfP&[PN5
u&`1"hA%'
3~wpNb@
ElYrxsBgCQ0
Iw5Nya5
MO92mw
`#IW,W
eEa+Ge!
]<tHRU+%
Wk>0R]$<{
%@GaTmbD%fpJ'f9A}kH
B?R;b@
:jm/N%o?
D~:=h*
M_;Q@2Gg
%!A$s=;
l:njD,Wcp
mq{W\ZGeaA_
3Gu-}?By
6{bw=I-
h[><Sodf
W]{=Bg4
XH}|5lz
V41l4{
'1%mj6
vr_=k9
I|knTT@OF@}(h0}Y/9s
vQ4%>$R
!/AxdGYD
dU9|CJoW=
-FsrK
Ry+fq|sLZrVW^B
z4Rye .
%G~<vyKr{%-Z-;
rca2l&
q&uam@G7?LI</
Y$m%)DiPxb
>qA"Q)Y=
2h""5uKD#.I}UN*K
B/Bb'dM
be'!l_!
u@~(Dm4]FPTr
I7p,{i)05T`H^l8,^
oSjnnw^
*NDjOad
Xw]h5L`5|T#0
,s_9xJQ
>x%A%2J"Wt
vLS9CE,
u~.ko0
l*);gT6
[jd.n +J
2II;&,[OTG
np &.o
HBs#5E
B)d^pK=Vom
*1ke9;h
qlY:y'Yu
3nP!r^^
,3Hdi2
JYdF5V~BNr
4n{Xck
tv{g=
~()Y99.&
J/8{bQ
E0P. 3Ib
Qn3?t1h
/H6$wY
-|m.FpnBk3u
k~_f.iE
)n.j"z
7Hdu{*
d'"[A.
P)9Q\_cRY
Uh'':@xmd]?x
\i-p%
Fs3`)(
Gqs3gEN?cLv
Ssd"4
>3+F<bj
B c[p)
}dF(fS.L3ES
DYK)IQ6P
MFvmO.yN
S71?,h
ncp\ih^>p$F
@s5V%'
*|~B<(:@7
!H.a<O
MO=[Em-g>/b
b!]Wep
x$Sc+A2xpT/S
<b}f58
W#Ym!0
9gq?Dz~'DSpf{x)
`iz2u]npu
PSC0O@`
cT`$&hU`?pG$@
3Mw2j-
L>_XZ~[
+~: HY6\NA8:vLl
T12wM+!(
DF~2\~
=0jbdM
*NGt*!2
t6kiO*@
x%&qx$
M&j7HH
0{[}>D6__p
W@$I|F;
^:~=c!aS,
18#x/PK
4%a|H*Z|O;
qfA@vI[
n'#|1!
-N5BF!(?
1mzon%%MD)XEO&[+T
<cGpQ~
v]7kb~OG
MURLf@O
S,m'*s
UyS4C^0
Omzy7Q
R Id<Syv|
PL:Xu;w_
2knNOY-"X#08@hS
hW,<zTZzo
B67{x:)
{o(n9lN6tI
sa\T,c&q
'0cPhW
&DG]K1Cg]BVV
(qu8$Zj
uk26E@5[
A>G?sp(
MdHEu/
qh,Jm'qh]F
E?-L~>iz;
V,,rA
,:VaCfKUmG
"o0(.:
W2N/wW=8^
bX_X`C
]Hwpt6Q-
UG&b&1
3f,Xm|)K
zV8`;1
nh`fb<
elCfBt}
nyXP?T8
FbF7=~
*$E95jY'^R
;rt"g7|
?3<N}5
pSClTcz=
bpiV.t1
I*_6g.
gp$u8\,`mm
V\n'I0_qbAmF a
}9kp6XQM?_8
eM,]s9#wvQW
)<@vwhc}
^$RTqV+&8
4O>*i^}@!
_t0L[hY1(kRD?=OW
!FQw<KK!.Zo;lqS$
sCa"PJ
`hh[-|D
GZ$T8&f#3v
6O#9kt!D
5BJR6T
>Q?w_c9
&DSzn<lB
xj#Y<?d
>]mbrQzAM7^d
[UcW#5KxPFk
5 x^tFl
Wd,<`yg
L?ta\Jo
/)z2|7
$1wQc3ud;,-6kl
'iRm2AkK3F*j
_!)tQ,l$D=
bwf[T)]Nv"
.}P/#b,5)#Qv:cXa|jb
l+-_3-XmCk=zs
<R:#b
>3T6!h
9ryz_Tz
m~b<Ny!@
zH<0)!
B,Xe$Y8D
'b#;=P
V!UXm0T+^E9%fkZOt>
(n/3HSx7
J2 QEC(
NEuW@,Seu(3
y}g6)_m|+
RZ c&r
GK:7)s>Alc4[,
584=bxHcu
VnY~ySN;D
?lY}hcr
,9qgvLp
6*KB/*@W
J|q?iMV:o"
wKp:9bqu
l+2!Y$%
9qsV?m2
hj/>p2 ''to=rD
>]TYnRX5|I
R>Hxg"z
N<{aH2
#:T@[qS)U
_BjNFgQ>t~
^v..xus]>wFJ,j
4i`_`t\o
 [1V
b/"KP/iT(y
:/I$sW.
Ck+ i%b
c"w`d%#Y
KyBQQ2u@,%
QnL0*KY
w]3ms>6=d
CQt#~04weZg{
kBP)HP
@?db0 W5
xC*W3d |JN
-3Azz1E2-Ua6)
1TSLCp2[9
R37mF,
F_7U(S
G]<_@cAM~
i3H(.~N!
5@j(#,u6vA
@:{*.ut9`WlHnIegE
SN:0^4
e%l>U4
_78UNl^
[7&'Zd
<I8-W4TH&6
xz7\*@hS*OMh
=^@N\tb
X!o{DL&
#Wh75:Qct#
5Se-\k
Jg}3L;.S
O&R8rgE&-[b#X?
uJDp0.ZYT
fSv'$j;\
2yI_j%&
PtKZ@LS7
pvc&z\,
`EBOI|
DpZ_iU#P+
ZaIg{*
H+"xPMzNBzs##A
L&n6+!L~D7
:Y-hGm^QB
; CU_|
SiJRqmXpxB'
*Dv\Fi,
{W^JVl
]P^'1l_"
~d+t}{9BV"^
pA)WL2y4
,>]i5v$
3{^S'0
aziHTiW
$|=^U\lHp"zLvQ
%_Uu0#.
4bs`eWF
Ta^Zv`>fU_
P)DD4E
2?4yO>7'
' _d.MXp^
%YGRI\Ye[
7|{*s]PTFw
hdtX82
S$eQq5C&Bd!I
a,pfh-Q
_-CUoJl:5:V
[mDA8h;
I/9&Cv
@V`53@12
DwT^n5H
!wK:@8#pu >j
=$SQ&E
zjJxd.
YT)10;-
7LUn2Sb
pe<"wh|-h
;PtZqI4
Wv!!DGi
]Me.7fqmKdXlqe
+eR,d%V9:bT,ECuBp/v}M'e<
g;2*le
35Wrz\Nt[\@
Zm*,b P$
+TOa<`
iC5fvr
Y/0"c)
1V%}0OnR
CZ7DAq
2RnLw|<X
V'S01k8
1k:D&v
oD"Yd+
?\Ex?d
l"(D-I
~c:3l\
BWO``*
-Nn[o8TQ(
ddCu-|YgxxgD8.xh
f.L]rj
D*I7bA#[1M_
tU5fmQk~EPb
Q5 nf/A#
&2svQYx
V';+6/*
1<EL0>
Azcmik>YkO
!h^U:FjZzw
#Lsq]#-I;g
E:@S>d
E#:O_(=u
8~`?:iw
et?$DB
@4&1zU;wG
JlCib\w
9MUE3f
od9&uG*ho;<6
I1:R+m9cPJ
skUd'sqG>K
%V/]]O'
3l+=F&e4'Hj;4b#9z
zS W`<0
K%TJU)ZD
.kJ*e 4
)\q7htQ
W{O!p4
}lU))alX
,OVhG"*
u*'mM#ow
D1<#wF
g+R/p-7
^p>&s3\
uk;iU_
p(+ZA(/j
jfFB*iVX
<uWCp6pZ?hf
<Rjybua
^dN`bYs?`4ra`Xc~Se3^@
~IDH.]@eN7GwN
rHyDk0V
z6FNtHkcw
I&aEyf
w>;&-=3x|<
Zh&bl?
`l9J9ub>f@
lurViZ
i&u&#7Q?a
UpK&<\Jj
Phmx;}]
vqh6d/h
eyljH
,F{LL=HQ4O
si%b3.
pJyzt#
UE" YUp
dTaJxVK0da
XMI-J/F
zGHS-O
;V]'NCy
o::_L_
WM5w^g"tQqOY{;K3
+{#Cr
f`csTX)e
(Uagm<P
{6])P<PW-cC
s!+K/,E
BoBv0`? !
?ZCZam l|0
r`U)zkOY
QFnDGE
[L/0L$
n4eI;*m
D\/#aH
"KPIQ=Q\[
$|3BM1X
yD 5!W{Z
Ix@ nVdt6'
s[~i/}L#
AS+k[Gv0];<fOVR@ToK:c
tsJFK#
U<qaFHmC/
Z-s3GJ
@3c<OR~lR$VM
_o>5nI
JBEC
O8ckq%$:
|^[ooPiMhc
) Kx=a
<xS!S[YH
ONJ&a7fEGn
uC5bFmE
OnCJ+5h(,
J:azl;
),>vPJ(i
"Kh|}@;#Og
qh>^rW8Y572
F/pG_f\g
,m;r&g{&`e=Z
c#I3B
%rF)'pe-
B{Dp?&42kiO|
.i&+9)
EULH3(1e9g
Mmr}(B_EcY+'n
ai262Sh$
=^l4+*4?
i'^|+
!|<YiC
1wvk{-h
K9KuIq
*IUj`\
U?(,L /~W/
\HZ/f7kd/
^y[/d1
90)x)oB"{dA
C]_F[9`p"=X
pD,/y>
q3'cSE
o7@\k7Bj
W(J]O~,
J_#9@ O
s-'oYRuR]#MQ|v
W%;?\B]^h?N${{2dXq#
QUELv@
XP45L_b
pz8KjUr
CpF^4S
o>dyJ6N
DY%9Jlq
fMQp>xI\
Jfy@FD$
2`z^]Qr}
+2*{}
3)pM[9
?PUY>Eg1p(f,fzrYL,`
.M;wT!$67[GT&R
MBZAT-L6|0
Nl8;{-[
SX",n1PXBpij~
Iyqn.+]1|'*kd~cj[$*
&o;1OD
T-S>}m$V
$G<9V=E{_,)
<\J|d2w_
+#QZmcHLUJVAE
}='!za
=jjGt:
.)!_u1t
}.F!FY
P/3o-P
.${/&xo9
fN=*^y
gZP"8o
cxp!>cx&
c#-oU^
M/>"OkA
r\a;B[W,
V]LBk;4Mik
lgJUXD
F8 :\KINz4<w
ssb0SAhkb|gv
7NKq-2ojTI~6
|0RBO7pVR@C
'[35cmU!
,CZETXXk/
!R=NK_
'^0rd
_w`6"dF
?\/\NMdd`c;b?,
4@zL*:I
Qr]3Zo-
9nR'2rGo6
&"Q&''*X[
QG=:Iw%YSKGF
-RoEnjgT
o1)?3+
J!`83*
F4hb$8d"B
i.OKck>Jr#Mx!
DC9\Vb Q.%-
0)_q1EsN
zLGW09
b]:4$$R[
NDBi-i
4<%3O0
(]2a|,wC>
<_3.C%
WHZ|cZZ
it,"yDefh:PB?t\*f
]{fYc=ZSj>uz/u78
e9&D9n
qz\jzHUB`%
Bb{5hO'
8Ej"_|!OW
e1C_E9s()RohEi
f0rU4-
%10C/"{L
::R'WOq
+Bjy?w
P^B{MOwi
kr799S
6|W*7Je
1:'|Ic7
QU:[8]Q
+u"|~O
R.%g0,
I\$R'Q6
PXXY\c
J#v8_9M"]0}w
$2qCW"9D
(1LeNub
tH,Znhxq\+
}^Ksh*)?
@,Ou9=[,DZ
m|C>qGb
K'a&Y&8
S")S2KN
DO5KQf||er
3etrl,T
#{cy(1jD1v9
~A5l c2JKuX;R1
H|f{wSu[],L
JR{)S
#;),Q}z
3g+\6)R[[EDr>
WnjunW9
U^_;D~
\a1o7Up>
ZRZ?syO
Bu>;459#
poH-hG#}[IZ
CbL@bH(3
OCM7to[1Z/
s6\[8`
}H+B`waL.T
,nS-i7: 5Dy/
wepX%N)3=
c YcK:d_
u5,zFLo
(p6f5.qOe2&?
Gb(];u3''wL~
y84=J4
fB)5#
&KkW#,5K!
RH):-H
H8ry#E
%Dcm7>#
,<QLZ+EY;1
h;wxm,&`W
}x9%+
gF:G^}=
:QB"-cN4
J/%|qZ
(Vih""_
xq}_7Q
7;\D&4o(
jQ 07\Ja?
D+X2=mva
oDN9M\
<}]ij!<-
jnZQb4a]
Y0`!<'sZ:B[ur
36+2]B#1%
wiIq1Z.f6F
hSNYH;K-['ddz(U}7o8@`P%
yMg~(VDjA
/l!'ASYr_S
Hu_@H?G
e5#2#33ub7
Vp?:k2
'*BZb wVDfG%
PG5$qD
"{^xctW
AW2 3
O{Z)0W5T
l5`9Rr4u:K
5P_-6W
8G0#ZVp*.
-)[KE!Y6
_bS5=b
t]cku;jG3
|Zr*z|@g
>lZ6-oDG0(
.bXGg"eAw*d'a
DfF4{x
+;vfe%fL\
b9]<i|_!
"q#=Mh@=xv
fbC.bX
|i/5f}
7A:vnA
YoXujp+Gn
qYPbTj/
m H,&i_!SL
IS"u()G
#EXuh(2
eu6>7*A<9i0B
OH~ZO0k$D
@{Dg+=koZqF
W; &9IFYv5&'`1
Idu&D8H
EI.hc<$pAH
g!gqx!/Y
vQ`e7:F
kUJv,svv]
QVp.[5GV?TpSk+k}
("\Xo
[;E{"e,.
;[0SfJOV"KVH!P~v!
T*8:r_
[I4FbVL
H\Q>q
r"+/!qAW
AV115X4
]w(DT'
JZ!AU7xt^O
!f0C0CMcHc2kz=%
2I-bE(@bWNgk;d3
bPoY)d
V1ay@"
C1bi"\Kg
D3$uS:z;H,
V;%e"+?:q4
}9%CRIy
{Jf@t#M#
T} n3x1MZ,T6
n]I5g
!lAoxgQ
CW0xMI=rv2!
Vb|jRE
c<"($u7
h2[>mp)
L^^L!{
>UWkL=`+
fEYY 4|,g~/
S9!Q,n,
QqQy%4bc2`Mrfu,vq
%=^;FL:LW
P3}q?+;W@
I6/d}&
Ic.)tGjx
8l51F0D:yF"4
:EIQm%
^T$O4C
p$_*p8
N#E?p&\
'c(TD7
>kq"?0jB
h.'2(
6#POh@\
<^>l39GT
8r5G(:}
<Y9{]TT
nu$HS0xL
1EU[kG}Bx5=
R:<W&v
VM9NTM&^
#x3JJT
g:S_m1
_GZa;5'?vG
tR:z]jv-#
JstK~0@Y
"Hz=Z
X;/g9T
!%FKVX^
/,?GJ1-
H={H`$^ ~%WX
lQrh%nuT
Gh@M=x
{x[+ShG'N
=k#KNd:!y
uM:]5{;.v"Fif
`KBGW.
8XDTvTiCp2
jU=c$x
~$\VLa
"/pNgXV@
WSJnZgJ]K
%RXsQ(
N *>K!qFPmtEc
{S,;E5
er^;x>4
6s7_f!{djZNx{
6SJjhLm#=
H*N]2i
r*j~ziP
v0laL
J\.WwsJ
L-aHI|7NY
TCf@-W
*U[f!i
{rEaT~
UY: V78B2z$
iRkI8lbD
Ty/,ri/!,
!ckwKoC_
%[;;VBz8!Q
T369hR3
(hedr;f
qtSMm
9dQbV{G-
U-u6W8
w6~3GW.t
ujGv]y
j<*<mfc:;:Avw2U
]Ea1&uck_>>
H9{b7O3
pRkk+e^Ef5R&5
ofS?2^1
:l)u9^(
:&As=O[>}/
xt<<!%P
)1I$_9
pG`ceJWRsd
2i/`:'
%a4,.r
`u'x^qU
B3mLn+D<xX^
Y([])LJ
16~/F8
of@;UN
5/!*"4r
[gf;Np
myy(}W[
{~ 4i5>J7#
_)dBz>
e\ot3l6
[hcQPBqMgO
k8wz;J
@*1X\?u'uhb?
-K[sK1
4jgFmHI
fspVEgS lht@9
%1m%^V?
1T;jUF|h
^55f~(
D8+KX:|g
T%A$c;@
,UH%glc`
7^.#yYWQcEy
M'U$MW^X
0q]/xm'T9?=Lh
)0cRo}
^S.o_QvTW>\+S
FRt<:V`VM(s;zXb4g:
8)CVq>
xz9P39
)g1 ~GfLb
3A>C+)1
mUjZEX6!B|
e0`z[u
NkN\L?(nZZc
aL@Irphz
s%_%ZS
s,u1$>
\k&[x[
(H+q[E
N!K2"9{83
t%NK@p
*cJ{@o
8MH_K0)J
Dbo-L=[{]C\`x[=}'CXu
iBo>HM
T+%]c*
@As7]5,
qp|$:gXE(!
kv3EZ.%
:J]8Ul/f{U_' Ner
P-=vBL|
E)h6\5%
[7KwmRv\!|
(,[4RYDQ9
]jQ7`bc(
=.hu:O
*Zr]o)"pH
kLfxKt
v*Xsu+
'/A63w
9KGXG(
%9*-AI
C5"vdm=
msLf/1
cq\xYi*
JS `)'.
SD*mTQc1
YP^!efsM
Y?4Jc+JK@
AQ'RtFKn
|x=a{V
~?-(DrbLjA\y'W.Y]s
%UWOm?v_)(`!
$qWKT;
nrreK;"f
RROLf9;uvMB'dc
I*g=P_F
&13(G
G3QGZ94
R,qJ w"
-K/4!PCQga%
Tr`B)|Z&aS-
~BnH%"
'#KkW)Lk_
jO{1it4%
Ey(}`|
qXAtL2$4
NB$OqZ{3n
gpdTx:T1
:__*_E5
g..1mi^NV9td
v7wdj303
W8gR8dL
>\9De[
MSjK3OA-hF
6,8Yl^3u
L*Mb>lrS
2iOgH)ksJ
'qZuu9)u
hM3avb`D/x
lauem]
KnFp4n
3m)}[ry;h
L(9_yyk
4U5%id"n
tQdoj.
q>@]e/
'HBZOC#\|m"SqR
Zh@h#eUP%I
~E}!cKA
rBr\Ld{q-b
IenqjI
\dGuNX
"$J?.C6|
-jWnOM4i
`|?nQv
`WsaTQ
E(XLV2I|ad
wR%LLv~m
7:o^f6v:&
KEsl+
-?b<j#18Ep
(lOk=5}_
S'6//O5
fV<?Yve/`Wc
]+z3vEo.P
3pC)e?qF
rN\,m#1t^l
Bh'.b}
}$D6[F
?3V.m~G
0,|Mv+k
vd(&C'?dE
4YePf%
I]l_*|\
b@QQjGp
G75B1]M
Y`\K5kk5i
&97`[kiv?5 Fxk7
)>:4fMPH
o]HbXX
he7-|,E2lV(
*={l32b?,uo<n{'E{=?xs
Ja4!z !Hk^5C,wB<
G6C-NO2EQ
^gGyp|1
Diq83k
!ur?{wFs
7(xiHA\:)
r@G){kd
C9x|uD}P
Z[pi9$I
`[Zd@kj
-ub?1tGR.DS
,y=B';
+?>BDz'5dXD
_Q~T$\B
a?(zih9V
jn4b-'dAv9/
*9X[dX#nzLFy7"!cU
-1|KUb
mk$%J#v^M>{
eK9U~zbq
=_7MS
gixK*l
-!o~\AWz<+ K
&\YUQJ/
0Ks0GG
/RzJ TAhF
lJDb8Lf>(ne
m6zcWr<vXm
OhVGa"PF,<
Q3TX$e
~?T!-8
H^L_RY3pAtfLk6
9tt5C!
=9:z>ESA1ko>[
Bve-!)iS
9G\0w@
O!RR9~
9Eur\/
AkhFW|,]["o
2pO1gm]
VWpI:4kdDZ} cSf
4t]58QzC
x<!EF+}]r
qsll"?( 2Rh
[qlWN>ro
qFMH6;#Vt
|rbx_{)
0FK=lM#q,7a!"}2fIJ
@/y;2.U
,f;g)ZN
o3#usV3,[
9^%'[L:o
R7ryuW
k]`;d1^Z
X{/CJr
vT9{:A8rn||C
$q,[#;
|l%?wQ
'&UJf0
{Z>!as$p
.Eh%>"{0a
Q0w/8*-
Rbz9pG
%jSNUy9c?
E+.w$IKZ
TRv1*[LDl#P>
!\/d+|
B J@-yr
m$+|*Dy.FO},JZ
<rsO$3o%hR
*!COevie`
PhC "Sn+l*(
/?7>R/
ITEg08
,<\S-]7
"Sgtx)
<x2tr'
7Q)b;+x
42v0*
Q"Ar|[
57hu?UD
3y{-`f9.&
WV,'xX,B
''LC;y\=
pVX:-5tJv%MkYiDY$v9AJ
s)aEL%k',]t@~3!i<Fr
lOt*f(
zU/Shpky
r)jJL3
A6kvpA
4INI$p&a1\
OBLg8@{b
(V[r8*Tdc~)w=9#|7
kj,]f]
R+@g>fiP
H!]B0`
6!n~F+5/KeSuCY|
T<yd|Y
eE:+O.j:~"5
s~&?o6h|
UJlGMH
/^"WTTsf>w+
0'u0IiQ"o 7
NW_h3b,y
#$)|]I'
KPO>z}
INl2t'
6[<}FbQ
e_jyr
neu*"Jp
*Wd'u'OTM\T+n}
M8k4u-?=]ZJt?j
}|'95
O>:F<
'bBbK"0{R?E
6gY0,01Ue
tEe+p1Fy3"
_<E]zfZ85~AZ46
q'U{Z|Tn+0K
#rOc70Y
?M& sdn
*bv|Fj 3!x
)q|c3%T
(q/kH`l'o
!@5/Kx
#>ZZdva8"h
7fkrc_Za4G
_KCiW.
fx=z2^{/
gJ{{I]
DVCLAL
PACKAGEINFO
MAINICON

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.