1.2
低危

11baadc01b9b3ac6bc26a4167f23f65323acbbab14f9080308015dc1417c93ee

11baadc01b9b3ac6bc26a4167f23f65323acbbab14f9080308015dc1417c93ee.exe

分析耗时

193s

最近分析

385天前

文件大小

91.8KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN BACKDOOR DELF
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.82
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Malware-gen 20200605 18.4.3895.0
Baidu Win32.Trojan.Delf.j 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200605 2013.8.14.323
McAfee Generic BackDoor.ww 20200605 6.0.6.653
Tencent Malware.Win32.Gencirc.10b07aad 20200605 1.0.0.1
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (6 个事件)
section {'name': 'CODE', 'virtual_address': '0x00001000', 'virtual_size': '0x0000a000', 'size_of_data': '0x00005600', 'entropy': 7.992235378339067} entropy 7.992235378339067 description 发现高熵的节
section {'name': 'DATA', 'virtual_address': '0x0000b000', 'virtual_size': '0x00001000', 'size_of_data': '0x00000200', 'entropy': 7.537443661508319} entropy 7.537443661508319 description 发现高熵的节
section {'name': '.idata', 'virtual_address': '0x0000e000', 'virtual_size': '0x00001000', 'size_of_data': '0x00000600', 'entropy': 7.871666928051274} entropy 7.871666928051274 description 发现高熵的节
section {'name': '.rdata', 'virtual_address': '0x00010000', 'virtual_size': '0x00002000', 'size_of_data': '0x00000200', 'entropy': 7.582096724860129} entropy 7.582096724860129 description 发现高熵的节
section {'name': '', 'virtual_address': '0x00013000', 'virtual_size': '0x00003000', 'size_of_data': '0x00002400', 'entropy': 7.596943615976609} entropy 7.596943615976609 description 发现高熵的节
entropy 0.9705882352941176 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意 (50 out of 59 个事件)
ALYac Generic.Malware.Sdld.C44D850D
APEX Malicious
AVG Win32:Malware-gen
Acronis suspicious
Ad-Aware Generic.Malware.Sdld.C44D850D
AhnLab-V3 Backdoor/Win32.Delf.R257860
Antiy-AVL Trojan[Backdoor]/Win32.Delf
Arcabit Generic.Malware.Sdld.C44D850D
Avast Win32:Malware-gen
Avira TR/Dropper.Gen
Baidu Win32.Trojan.Delf.j
BitDefender Generic.Malware.Sdld.C44D850D
BitDefenderTheta AI:Packer.3B2C2E2C21
Comodo Backdoor.Win32.Delf.ste@4wua2l
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.5b379b
Cylance Unsafe
Cyren W32/HLL-SysDlrSharer!Eldorado
DrWeb Trojan.Siggen3.61286
ESET-NOD32 a variant of Win32/LunaStorm.D
Emsisoft Generic.Malware.Sdld.C44D850D (B)
Endgame malicious (high confidence)
F-Prot W32/HLL-SysDlrSharer!Eldorado
FireEye Generic.mg.8e3a5915b379b506
Fortinet W32/Delf.CST!tr
GData Generic.Malware.Sdld.C44D850D
Ikarus Worm.Win32.Lunastorm
Invincea heuristic
Jiangmin Backdoor.Delf.hzu
K7AntiVirus Trojan ( 000010291 )
K7GW Trojan ( 000010291 )
Kaspersky Backdoor.Win32.Delf.cst
MAX malware (ai score=88)
Malwarebytes Trojan.Delf
MaxSecure Trojan.Malware.300983.susgen
McAfee Generic BackDoor.ww
McAfee-GW-Edition BehavesLike.Win32.Generic.nc
MicroWorld-eScan Generic.Malware.Sdld.C44D850D
Microsoft Worm:Win32/Mydoom.PB!MTB
NANO-Antivirus Trojan.Win32.Delf.fnpcbp
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM18.1.B245.Malware.Gen
Rising Backdoor.Delf!1.64C1 (RDMK:cmRtazqaALC9BQ6BQIxhGBAO8Kpz)
Sangfor Malware
SentinelOne DFI - Suspicious PE
Sophos Troj/Agent-BBLI
Symantec SMG.Heur!gen
Tencent Malware.Win32.Gencirc.10b07aad
TotalDefense Win32/Bosbot!generic
Trapmine malicious.moderate.ml.score
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

PE Imphash

3c0e70bfa5f73f1f1cef484e2bcb5bf8

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
CODE 0x00001000 0x0000a000 0x00005600 7.992235378339067
DATA 0x0000b000 0x00001000 0x00000200 7.537443661508319
BSS 0x0000c000 0x00002000 0x00000000 0.0
.idata 0x0000e000 0x00001000 0x00000600 7.871666928051274
.tls 0x0000f000 0x00001000 0x00000000 0.0
.rdata 0x00010000 0x00002000 0x00000200 7.582096724860129
.rsrc 0x00012000 0x00001000 0x00000400 6.753357619284395
0x00013000 0x00003000 0x00002400 7.596943615976609

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000150be 0x000002e8 LANG_ENGLISH SUBLANG_ENGLISH_PHILIPPINES None
RT_RCDATA 0x00012448 0x000000a8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_RCDATA 0x00012448 0x000000a8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_GROUP_ICON 0x000150aa 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_PHILIPPINES None

Imports

Library kernel32.dll:
0x414c2e GetModuleHandleA
Library user32.dll:
0x414c36 MessageBoxA

L!This program must be run under Win32
.idata
.rdata
8\plJ
{{~nZc
9HGuX+r)"
xT{5-l;^`
y.%mtB)DHV
5)VBdY
t;jj+iOi%
nj`.J[D
,"V:&Q>|KE`
nST(>v
!*QqM5#
]Wi[m.0P
PJ8Sn;La.v
3pyG(Tv;L=dxjp
rdK'p pQ
">nPccB
W?qK{_|
F<[Qg%
VTOoU}
r'a%=xF;
Nzv@UG~
/(>)Xod?T
/G@1w!K]@
Z{CDkZ$
37; WpA
&T;$c^_v>Bq
OdtG=yK
@w7ON2~7{
c&N1%4
B(N&U(gO.Q
xYb4~6Ys
1P\1S
sc~%Pa=A|94
G)Ek|u'8^/
YY &p!`e
;~c!,?y3_
%"L]GS[B
T n.AT
X\IkRl
Ko0X]ZH>K
$.a1X_w4'k.
:OgKcfp
@~3?rP+l/eE,
QZ_c}Wid@
<4fKN@h
;:.i%<FS
tv{%7/7vz
A/b'P<a:[AOL)>>0
(~)<.u
-%\UU8)
@'!Rfi
SiOIg'
RzP=\ ?o/T~P
w#6IBV^3f_
"(]x-@@P).,
4v&@m6IQ#
\mvD8+
:W~/>H,
`YJ"td3
3@'@{KFe:'Y#q_Q
^T"_z*
V#Sd:?rc
b{kZK<
NPcBsP
70eJ5X~{O-4J
$e([47t$
] >g2j
_p's;4*iG?mJNX
Td2Y9TN:v
z:lxXq
xj3eJ<IJ
9C_/W4m?+M<V"zJ
76(SY:
AG%%sO|;dm
$)8heVA
\dmY&0
NiG0[\s
]*}6K>j`g
^0t$DB;`6>l?-v%E$N U-tf
y-"'Z:
O,W6C'hF3|
{s5k){
)dh2]+
D .b[1fV
3>|X`NZdQF;?%>cWh,.9
}"P38*fO
ZeY,7JB
vt;vwHT
l (_\CV?
Xt%W,p
aHAkf,#
* !s2`WUmR
6j|f[gk)h
$G{!6y}g
b"7S#NaLr
Lv$9^
9.u2; zZS
_rtNCfa
$brI~u@2(q}')H
ZDFenI
`mZRj;
Bz:%E}
7n}@49
p,6Tl6eje
U2KWD^4
V!grHg
$`t|F6z:
: %kh<F}WAcTvcQg
0HiA<k`<rdp}G!j
p,.-ZE]
a3<_bw]&
qH\zn!x
*Mj=gK$U?/[j)
dKLot>GP_K9I2V
>H#T^=V9?ki
PbPhX
Cs" uuQ6+$K`t
gDvM\~
.MM[RMRG[~i;g
qUsVPEd/
r;zfk"Ye
K~#$18-q
M12;-
0)}P"N'T*NR-
$-vog|
,5Gvd#
8d`bl)!
!5{y9/-b
UCbPK1>bx
r2fh1q
FEg[8<#
~KW7%e19IN
^@|?7u!
H9IQl_N4
7s:R7NL,KS
,&Y '`E
$7lp5G9
aWJfJwp
_-yJ5tw
p'L*qpQ
6,K@|[l6Y
K]^|7R0=
l\fS6QIjdnr0!qQqHSW
K%LycGu
RK^f@{
TW7fKD
@]Z"-?
4gu[3u[vT$~
n:{gNMh
)W+M S
5'U.+_:k
.5?/ BA=.2M
3-+:cv[[M
f~@07i%v
S,dxnQJ
:\,P@Ccst
KQ-wzN#}vC
JmsxP1MX"b%
%iSmOU
vfuUt}^
+wtp(f]
pM@=p)&
~S1%%aQdV
)vbM,D
F;gB7}jy|T
MfybNS)i[H<+w
Dov)XE
4Od4,`[oc]b
TU#,-Z
]NO|j&
$Tjms_'h=4
'BTzL&].
l.5yX}VzpJeg
,ndn{%
IeE-Ibfe
D"=XCvbf4>m/x7}y8>
< fX1?k=79q
BMA^{LRG
N }~l;
],PfO_:c
qhM}`\
Y5q:+=
kB`k+}e
Thn"WN
E o`J$.
$pAOFtG
0Cp{@GW
#sVh"3'aq
(y?+r}d8$2
QriL~@
r#oE:SI%y(g@{
_s]7[G
v4f.XO
K`!A%
rz2L1!(E
r!Qp]iIx
fu.,[%RShFp66
#G/#W
4|f8\|5T?>b$X8
qDRcJ&DV
1C4 O;[K@
gWS=O.dctf+
\K#H#n veo
dJH5vY}&85%V
W~3 L'7G@(t
[NWaeK
#M8>hyt)[5
Q4kco!fOMta
<5BpDh=
b:rKi)6DZ,_+
3sNZ2@,a}S
xNqz1eF!BG
QlQX-Ee
d^X[
;g|I[V
=->X%J
/)|*qI8
*o@0nt
4#_NIP
(R;Lx
NZJ8qLU
9(0L,?3
'9Yt;W|LW
QqX9.8Q
{g#y9a:
;oGP1'-U:6gnpL:
t#/4Qw3
& 6HycW
nM'e7A
)jdhiIYo&
|3ih#^
@D}`;i-
o.6QpQmPE% cZlZu
70o/7B
<D?](UwtcrU "
{F8V/dVED'*
><Bck9
o4ju~vkK|
lwK'15|Wx
Ep4x8L _p
?F}OG_=
G!FK8=
a0I$@7oY_yiKM
op.TNL$/*/'b>f
s!$m!9P[`
{1.UM;
sAm-qLa6
=`|mgl
W,,RoI
x*Qx/4
^zCo;X
E%yU|r
_VC dy.8HH]
%d$pZ
HSW59CB
:,kC1?5A4m}
SH=N- , l
`$,">:
[!%!;+]z~
I_G{qf
?fCQgn@,9;d=
,/z/buX
}C)P')
FAc$t{)0Y{"(i
uLD|obeV
{|b]"d
|%-g2H
UC,[<qal
Y?d*||B
4\;;2$"
2[4zu;O2|
WDbj\u@\ib[t
*^vIs4}%N$
DKUdj*6
..<NRi
P&-'_z
ItN=\s
|?xCBP
H\gd96
'yaJEO"AAN
)!9<Bg
^+h7Cfw<G
7/HQ U&Rd
eLNUOa
[b,_K8
d~R#Frk6U6n
X"nH^|-<Tl71
EX>mA,rb>Kou9$G?0I
bDAm|O]
bi%w )7R'+!w
2%&Lc~
(#Cp$d
@~=ADZP}IF}KBD
FBD!%Q:Z<z
+x&h!W
HM&AgSQQ_^
AO!}w
lOm-eH&wkc
'?0?F2
@uGyJ:=bHw*0;:F5161s
X[+@O]b
|!g9UKgD|?
x (Pbv
jDiI6.&c8&
llz 0f7}Ooiv
?vR{98
qId\Jq4dg
*22\tJ
@&)k<-
nKKi2OT1
c4aQ_SG?KDV&f3
~y;cis
lODtUw%{CZ:Gl/<fk[tXIRG6oI
)>WTsRT
R{xT^`
6+i/+u~S
0dzshrOxut
_a[5P
OV]VM+H>
_~_9ElI?FmL
G`MvBIS
Q!w{yLQ*~
=d:GO9
a_9(cl3
v#C{}nD8
gY66@S
&\XJ$I
~FeEY#
RDL:_p
6E"2P9l
l|9[W
K@AnZ~
:tRr|\'
l&{_~F_9P40;x. ;w5zC'
txgI'0
,"!<`jrQ
g|3J$.
r1H.dZ7sg
A>teG~
q~^|)^A@ <
,j_<ui K}nRQF{;f!En-?
[89M;4&
V^*R(nk
h;uVR(2 Cm
2kobW"
L}e^iD
NHip$e
A|E7TGy7B@';@V
lb{FNmMC
+zT58O
OBt"`]9
{B2=Kx
VD%#!byC
iq`61R
gq~caF
{R8E`>]b
b9#dI+
?_BwtT
4>\q6-
)`f.K+
|a\V(,)
!?g&!+g
Y=Ip2:
;swl/;1)jVEm]q]
6v/G|2i
trO:mZ@-
gCgtd%b},
5S,GP=9
Hg)W:;o[+
#lP`KW
KYqfin
[/lq4cM
+bqyt;t
ipdl^djIx
>WN*ra
cal7K-s-
dX/$9
Hs%y\b
yR=@2Q
3ECUWV
!!$yzx
&W5II*@
Q^i ?h*
IK$if7;~(>
M*:wVY
~$^,EZJD.
/P|{j${w
3o2^,zZ+\M
R{<TN% sWbZXz
5.U2KcqGs%
E&W2V%SKf$XOa IL
SpSkZ`
Bt|q$|-
Cd{tts
rO<75s/P
U9z8Y@k/6&<
=q"$xB
(y&fK`
V|x[VT
HRKCLkR
t__C>eT%E
BPZAc+{
ixF:47Zr
S;>^`j
Qrt"CIh`
bxXQDJL
w&E4]#
q2txp[6O^
\.qd!#
1O[,x9e0
v@!#{Nf@@
:=d,=2Z
C d)3E
nGJctwdG
fu&X-o
q"<=HP,
]->Srljz/r
U<E5L\
q3Oul1z
PB1uaH
O6l{VC
h}Gjm
w$/t:TI1Q!=
,<+p4M_D
$]SGkNq
*&Bkd/E5Y
2T|gwP7H
_v?flM\`
CxuN;,Dsm
wuEPo[8
0+%.!r
b,]B4<SAW4[M
dHv9o+
z]7B5L
7bS`_&
T0kxeY
jQ=/i
n|?EWkal|m,?
.MqiiCk.
%=.).pxa2J
zZei3@6MSts9:Gb#
A%H>pI0
IF,fyN+T\
vWBFrn
[o*$;yt
UC[e~O
$ H|."
[N;bZ8:7;'9Rpl
8"no'C>Jc
k0k[[zm+fP%
*Z XS,
K9wD7|lY3sj
GiwMN-J< c
<BPck9
l^Nz>v
!2)3Ep
6h_ZG/)m2a4w
RY[6I'Zv*75"
g-Qt+]
i_*=_9kT
=YwvArX,tra
V>)4UYD?fE\t^y
ySJ>P5
u;*q!f>
;&&iQ$P/
uE9"w\
S@XVhS6
D";xO4u6cs
gvhF;0
Fu'm5o
|"+'kM
r@\h1m
Iro}HB
xe0tE}i
lf5Pu^2gw3,+
Fh@xn/(0Sc>]Jb%
5gH6T'
!n*{P!
[%eViJI'
U,=3c(
,T^AC`#v
sEx<>1;
tQRp^33gxGgXE
u'"N$Z51saJ%GwPVw
=^E00B
c{(T`a$
zPHb;4]
3-|QtLo>
3Q!rB{6gHKa
mSL}_Uz]
$ H\c0b<
BJJ-;+'
{2.Zdnz>T"
d]O!oT|D
|:roazX'[sfm4y
7LraH]j
dZt@'$2
Mz*M&{-Q]
8.J^7Gp!rL
S{eNgi[@
LCd'bg6#
{<:y&q
DI>nip
C*ShlAP7
+ockvpMY
aFu3nc
boV>!MyD>N
xBIO$fc=?&<W
X.b|2zUi{gG#lih!jP7]9j
33es#Lzy
Ac-YUEIA+YdeQNmw'
iA|8RtY#
+d!JS?
J0}UR
@8je9D<W
6r,&$l
[9}*UV<mXt08iP
DPGP?HrTrD
M{UouM
g!t]4{
vl+^LW^Yk
K66-Q\$J&vZ
A\#N2!
6{>=64
tBO\~|o/vjVSh8(#MnXVT1\
ATc@G:kg
:b'|vhtv&|
WRG1`v/
0KrFTSuU4
tM2u#vd.:ljGza N
T>5,BD
SJz'"6#
M.c\'"fG
!n+m1b,
y7LtB~s
RdVCQa"YmVVk
XZebx8
oIFv4d(TaX
"T:T. 286DV<VPBDJHVhNhbTV\ZJ
fLn5Q8x@.p\'~\?
@QgS6dXA
"-}"!Y;G_Y(&
H0JA=4dWZqr$04Bl
rC,-0fYG
e$9 Ff
m1&pLZDb_Ge
[ar6!j
gIi@|2
b`-bc'z
18>0?vHfjJf
hq<q%!?
Er}Ey\
c6mQTf
F%vU+R
,sOj=k
H)%~ji\
Me>nosj:+$1F&+%H^/
#qVEf(+k+*m!
[%G4d~Q>
lq-JWe
P]M[=7(e
S&s?'/
7q#7!QS[
%'c-jZq_-q
Mi_jtW
W~`v|Fx}
g56~^Q
&i]/F\[C
v=kT:[2oQ
=@DA+W~|)G>
>>:v!r2M$
MF<w:l}I
?Cx*rg,K~TM
=>#$h\
whVB=B
3&%._N5
E..if,hr
'h2c<1
%=1{~DvY
a=#IDU
$aQ*|'.D
Z=hylltY
F9fKL#
`f:]sa%n
d]NV>Cs7B0
_Vwt8z
^:5#tL
%Ej^@%TC
_2ugrW-l
6:MUiL{c})PW
5|4;28r?*2l<eY
k4E/Tf
FOXj[R
U})vly]
`KPStqG?NrFXhOr
#BLxn.*
`m64J{
C&f&r:
2 {.LXg>
ROt;{rC:H6v_-
k=/4OzK
KUE*EFMTZ
p(O!&1,Gi88$+
P? cQc
^qh7HM
&pL+B*26
Jw3TI|X1
dke!\eS@os
|1,Z5E'L:6
8;JdHm
v;"^c==
>GO$=!&
/vPR;0:
,LwA7'
Q^P_{pw!mG9
LaUKzK
z.~t7w
.6.,?B
N$AMjN]\ GCa6
8!C0$4ELj^
v1w'Sg
0xI:uf#V
u6Pr,;\~L
cE'UiCB
ox/+t[
>T.:x7
F.m q3X
D)-_rL8$P>r42
aF,lF,
=nky12
E0s'u{3eu
k?$J;=L{
qB>f5Y
?hswN-gS
kernel32.dll
user32.dll
GetModuleHandleA
MessageBoxA
uhPD;ywpY}&l>
i.BI{7<#v(nH"P
Z9Z<"sens\~
L==Qp*d[0
\;+Lw~sC~
tbjxNZ(
Mr![jm6O~2
6PI& $NZb~
bqdrRZ7
A=nMkx7.
zF&&Lfos@~
hcdxXU
Z7%Pj~e
|:=yho6F?^d`c=Q
>}I! Rcbb
<^!ubnO
F4-Vj+
t-H30"
Gggfv@
&vvggd
wwgbvt
1wwwr"gf@
1wwwr"vv@
wr""gf@
wr""&f@
ww"w""@
1wr'""@
3333;31
333333
sp`x`laE
jrYVK\~NA8XvC
W}vy_jmx
LL@GGNv
8Y>cPH
^.~_T@\|p
1qx0zi
-i7g~jw
.9'n#\{?
?" wBQ
?hD^v[Q
a{Hjev
jC?UQ67
lIb9oa
M'Jg%|
76r@q"-t,MiX
4LWN1D-N
$@-*{
>3uwZ6H7W
OzOXr4V|7i?Q
5';+FV
3jNqz2(X'!
_i0oT>`"SbXm
#vocUdi
@FS,_-*
:--KWrw
Ku'{q}L
)ye(Y)bVt
|qxf+0
K'(6*sq,*n
$cc6];A
Xw76>#w|
BoH^,_
u/?2~(
4ja74JLf:hT[H=/TZ
pu{,0CU:
p.9t"u\6x5vq
gTG(1@T[i/3
&>*[j:<G_1H%M
)x-e9|
?)6sUtP;n
rPfh/3Au
hx_iyd
WzfFIp]8s.`
/Ie8B}?}>F zCN"VCS
7YQ(GP
=14e('3p
EV[/k*u
6)2t=%
-]`F`E
u&oLz^:
FXozq^
Qt>aP"Sm8Du)uli99d
H4f>Mb
mfAL=F
n+8?J`S
0nM"W5Xz
^/SZoqM
:m*OsP
kZX2f.
<Oj@O.
@^;7"<hCX
G=^9FE
I;'l+r7
UeEfi,
K9yo1N.|.
\zZ)1V
;%\}y"4^
*XfP&[PN5
u&`1"hA%'
3~wpNb@
ElYrxsBgCQ0
Iw5Nya5
MO92mw
`#IW,W
eEa+Ge!
]<tHRU+%
Wk>0R]$<{
%@GaTmbD%fpJ'f9A}kH
B?R;b@
:jm/N%o?
D~:=h*
C+QyD8+!m
^2(A5I0E$[ Fk#[
U/xT)
%hKWCev
5J}NzHK+XL;[r
,b5"XO[vs1
jGWB]!0$h
}s._l"w
=:Sg:?
Y!As<saQ{"
e|H\*5
BSW-l(
`Y{.|f4F,$
_XNfFi;
y+m[kh
"h&?wby&M
gyD,):t0GF\-
-Noix;^5
'"0@"eI?l
ZLRC-bs
uxt.Ou$
+Bjt(uQDSc'2lw5
n sRPAmN_W
kZ0=jZI
Mrpn]v
9ueh"S
(K,v>_4Y
5y4Q#mP}
B#nJ01mT0
fF_M1=11
?4I/yJ&FR
2 +20D"
n0!kx7
&XBz!)O@FA~
j<Qj)T!:R
%bMk FkE
yYV YN_f8
@={\8Wv@_8$
g2jOl>q
.D]zl>Z!i \
tUcGW
Y-ubke
k:I&UY
g}?j^]_b/hWx@Fm'~M@%
O\m52A+'b'a
b4 w2j
HO#WB*
(jY/{\A
aEFf`u5R
.]Qm@)}
UdWYS,
}UmeBGIys"Z
^6HH|b4f
Pgw%qE
r9[ZpU}!@
`WM5pq
Zn,l}4{u$
|bDVuPWaF
q9.ADR
G"?Q}]v`
AW?W<[
\.sLz$@qMP!M
JPgU=V
Xs6G3.VDY6
wZYIPD~oG{
e[&^U@CR
Z$Cd,(
Z;h]G$O"
#/%foUF6
s:,X|,
#Ik&|R}+q
ml}k^Y
1#WU4<
QN8a?cMnU
kf>H.f{E^1
<ozN;it;
2d4ob6]
GJc[`[x;B:U+jTm
k80tl'
82,Gjp
;JN|tfgMN
J:v>*C
V>%~UK
hOq$R
fU.:4?$"
.STTw(
{v^b2YJovj@
15::R"&$7aE
SH.yO6Sz.x
!Kfq1N&A+]
4v!L:{rc
YjgTg!$RGK v
`CV@jCNZXH
4-#Pzo
+x<a'b
=6R\(q3
-]Ows({Zk
B/Ix)s<+";}Dg<Hlh
h4_YJ$1H^1
weouMw
z*XUkMK?UfW<HDHS
Re`WG=];u
WTX*0{1
H,%ZMib
!1)WNnx
vR6[y#
<_xt?=
mJRCZ^mYs
)r]Z-9CW)v5(
bvfL`{
c9vga9dG
*0_!gH
%+[72%d
@8ju*}FlKCg
Z|+QtRv?
6v V$9C
EQJMJ>T&X'3
XyKl!k]x^
X1$U<n<<pe}e
c:Th]1U6L
R*9X{2~M
Li)X3i
h%XvC};<
P7.WrX9%tj
jU}EQm6&
]!\l3I
xut2Fl
.)_Lc
Qy`HH'l8n
Ma~=$P
^1}$bEMG
wluqZP
*k<#b#.
c' 5e'*Yd
y'"J2IQP
-`7/+@:x
71F1b4=
H*Z]ZZ
y{'Eg13
q)9Zx\i:v;?
m ];h>
5OEXouM+
XLZmSj\T
n&.t-ZF6L,
f6_B}Fa#@
p}81G.:at,r]
d6}DUV@w
SX/RtB4
aE$5GRN`}
_~#F1\
-?=|g;`g
k#TB{
,#zxQTJ
ne1tU0%
_O_-28
F2rrU;
>yor7T1?M
Eu(2%6/R
Iu|9a@
w=4JtQ5y
~"l"jVB
$X~9V;
.yX_koDQDy8
+V.Whj
TmR)\d
%~L+i?E
~DLvY[h
w`Q\=f\Zo
|zSu?%
2sRL^G^
:I8!i"^m!SY
2:t'__/iqR
.7Y8M)
&zW</O
D/{(TF?S
sB,+yii32\
UDn5t9
>-iJ!s
B3M/kk>Q
jJwCQ[v~wxO
ic7zD|V
YS/kKo|l=,w2
-L$1gf4
Rr~)<H
PO}olN
6 lHF2*f
w$'eO(61,
h%^}G z
GmOMB.
y80:PW
I\pZ}_12$^
'V:W!v
~?=keS
e;$An,
7_UV*e
OEf&a`+
O%`mZs;:B\f
U4qjnc
X$/wOKT/Y0
@t,~d{
B`d6((
F7nSgx@.s:B
ADR2rsZkg
nvfW"|ct^s8
q^8w-v
A[=B_&
?/`8k7C-s:
XoZ1#Y%
;1GDbg;d{.
#xd{ I|y
G3U&2j
E}Exkt)
/+eNGr%CXhghm
t`iPJN
\vdi7q
g\5M<Z
F|L|jGw
9(6p]/j ;
w/}zMv
[k@HQ0r1
v'5~$@$"
m.QPFN{<>
29{m/cA
o3rkPA!
[KnbY~Jz'(p
c8NM/L
y]c`x-
o-53/a>
nDb,i6|LV2
R}[>|-Ac_$OQ
2I&#wLh
{B3HMC=
VJuO0WcA7
dY2yc9
v-+V6e
}(z_mwsU7
*c~XDt
gDur86p/q
Avv4V'VgZn;8
ajXh-`
CC4bV'!3Y
4!`RJ-K{XU
o" _Pf
=.FO/D
*!FGhr
/3I/kG
u$D]iJT'b
/7r.krw
@biGW~
G2"$5l
W"deu|
D7g0'Jj-
]Ai:fP/
[neQ5bK
0c1Czz
c{P-<>
7i{*~{D'MV-\O
8X`$Z~2=c(=iwuum:
g>O6MC,
7WV>Be)+%@
-D.S{93
3R+,[>
Bs-'7Y
J8;]'8
n&)R-J
?3%)vK*
:7YLc6
(5.rHIUv3 s
?xqW:`zz
|hKc6w1 '9"
e/E5]UQ
WZznlz&
'>Z/l>W
9dkUM*h3
#-csc5:ml7c1l^
7PC`QrScZ
x#P$sgf
6'#k8hq({
7^?,r^
{t mJ"u]P%9WMwKA 4,2
S.3+;^
L'gdi ?
_5a{HC:LX
^/]z)=
\}k4>x,{~~'"
?<\^'0#URlc
?[$OAVY8W8
$$d~h+^*"
Zt"X(SJ
}X~>%-J
t,HWS}+0_A@}vf?
[cR'4qBdI
hP]rjwh
R4$''*
)-A<S)szW
Ro#hIIg
bYuIp v
(?bX%q
9_8%~
Wol0p
c6y@wvnK_
v'L'bH
~*Ls.r4jm
marbz]rV1x@
a2ETidQ
FE@6M%
xr!+T9
QaFiAXZ
TeZ[<
CQfsZ,M
3w?~O8
Tl|2|Dhp6r+
<HNVOL
8}& H
nJnslyf
3k,Mg28@m
mj=Nj*V8
WI{T/,,A`"an9B(Y
.}x#'07
JJnw!|
"WzL|,%Tn2
HD66/K=
hFBSXh
bB-K[aH
zGU*P[@
ab!~=:6?Mkg'~qN
xQFN6Ak
Qpf-bc"B
pM*&i9e
RHdi"_a
Z:maTix
}DYs:v,
Vj#}}d
z/frSn
LxDCuu
iz3FF"
mbwEUb
}eoS<_
-0bWAcEfU2+DjX'
|-@w4xg,pX2*6>
;)o.uZY
WVU<^t=0dN:>4l$Zh;w4~t9v:s
QqR4G7,
tukopRPmu uG
4$x>PJ
3`]R/D+w
O@HqLc];sz@6
Uu }hTw7M9[WQ
{. lsy
?>)23E$nY;
x0nhBH1m
}7!V3r.
;DVkZH
qv\hTNE
,Je&P4qQy;I2WW2
BU}b_;
5Nsj:J
b(wW#ip|
p)l?7%'6
; zA:\&$s
nWVQEjO
kC4"Ac6RF
!m#eKC4
Q%m.m*yo
]8G#kQ/qa \(
P`Rul9
XENb9/
|fo5)<
!)*:Jg
G,Xn22
YUS[PvVm
yFp{6TO&
|$Cp`zk
OUG>-t
#SuusvW;6!
U+.UI
)HNG3g
02wYnU
@4ip %
v9LcJ4&r
O&:KPf(wP
u!)p_(NR+3>VhJh][
|PgCn-/A
~Q2(R<y!0zOY9
T\LIaVzF@)
W't"%#ikP
v3~FTf,
;XTvP)cRn
_6K@~=x"
OK:iKN
-N5.j&{(Q+wG~T
[RX#""
![:$/>W\
48Cjh`\LrL=w
Y{!=5p+js1]
]5H`+oE3?!>>Mu
gb(pGo
sp67`0k9'
+MF}nkQ
R&L"R6
=SOAe4
$18hgGQ}NfJ2[K#
wvhePo2o
BTX'%42.[@
dVQkWtrY
t*.XR0(Q9\e
CGj?@JoMd
\?aKK>/<r>sq7
{9BwRff_
}6ooFT
1^@R^c,b
9\xx-A
p@IYh!O
KR5-E@X>z
n7QF[5
]UoUNm[
-BM7L\*{
Zf+q}~7
,g;EbSi+J+m
AS\bk+^$q
kRPSfbK
]y2*(p+
R(ph-{m
|*?v>"Ca'
foeX5TI
9(`Pm`
W(3^M8JG
SXbh3 g
0R\B"A
5RzEI*w>@
^o'!9bcJ)o
R7iS.qOa
suz-rk
e9^$*e
|1<>?z
gFZY8d
xth}k7
@oOnd4 SWi
*W^#6;}
qZ}0r!
sVg'N&7l>Q
$R^"-Y.k
avf$V]c
@8%~KT"A
"x,2L(M
.BQ6yx
_%9gI?.>
&CJJZ^NzG|
)O}I=K:t
.>;;R>R}
!mv.lAT!
APtGT3
_p1Uar
&]XhitS7S
hzU5>lN
fQmC?7hM
,ua2AF'7_u
wV#a4oaY0;]
rsxcja
"KJ5fI
w>3}Y!+E
J!z1IH
(6&]. J
v[I[R?a
ZSI3hL5u
!;HMbX,&>p
0dxWrpc~AMG
{V!9vS@K^$g<8
7A$r<\nKh
zbRq<A
/81)k/2
VnCKMPp
vhA12F'l
n!Sb+VAJ&y
Q'(6.;Jw
|GcCf}
n?&Bc1KXD
)+@=/9>
QBX`E<l.c!=
BG>4et$
vf+@_4|kuU=
qQx!{AIV<J\<gm|*
/Hq;bn&
)"a52N~@
YwH2M3
?xjCUIZ
n..o!B;ly&g1^m
_@< 8<
O]&Tn\
B<R:;u9
6Ti3Jx1H
9:|;,Uhf[kCY3L<
!}~KuVJeKluW
OTbI=h4T\
<p]Z^mP0TLjSqD8
[-ZdjJ
PM1I|T`
B0@2?3
Gj.5JV=Und'
C=d?3=`
$uLOn*
rcM"Os\]5C-\q{UBM~
=41Nqg2
^V1gD*
6fL/TyWA
RB0 "b
Sb5s>K
4Cq>%;
'vonYIGC
pi"43*
Yqi<0K
.'Q,qQ
#rDnh]
|=":66
ft,B:!"3Ha
&*W~cA
5t##Wni
ZppS(Y|
gtd6F1G%
c*)r!
5$9~':
U2s39Q
!N4XtC@
_-;<Z|aF#e
[>d<h{*1
}Ah:@"] I
@oC3hTe
E;Usz(Af
@V/=G-O
KMQ,\9}Q
-1{o#G
p,c$Vtw
yZD,u]E(a
fVDtz@N
EevN1=
KEY&7K
=%SlfM$(
O@SsK<
YkH,'4yo%$(DcWDh
<ZU*,(:F
}4Xi}Ij
{[dtU.9
6"S,RCfs
X%,nHZ
o$nbX
I7=vf0z,N
IIN|>|k'
TA}7eD./1*^tK
!5#{ HY
aBnvCJ ~~6j
Utj[<g([,
pF`kh}A0YgsnET2>QKeyN
Gy?&XA*=qp
CeF`0hx"19
`dEu)Fc
O=dQ6WTF
fU(.o^l)_`+
)23t~D
[<%uh4Lx`%{7yL#y
@y%H/~C)
x'PJ*CNz o
1nk$dZD_nl
U<d<iWW+
+Vr>'@EeSM
p$q`eYRM
uE0XtW0 "QQ`
F#BqK"=5*
Jr#{MEqms:
l+:$}Hz
ed\+%@5ru_bl
DVf]bpK)'c~^*c
;+.Kcg
nw3`,U=
^Y)v27z
59=/ah
.6`fkz
!*&Qm3
{hjQcB8D4G]3G
"0&+;bfV^Mw
Y{oHM(
D!R-k-%\
s_:WLCT
WXM1UE<rJJ'WYdv[
tqo=4z
~M6!<QD( =BD=|}T
K3,P{ftu2F\
L)3#D
R6wr3
lacxVnluHBa
6Q[=c)D!ak{W!
X6}i-&7QftD
H{P\E(
a|f>R'd
1</'2\}|uYz3H|
Edor_:
21hX^
Unkwdj
^tVV7
;v9nl/
0>0ksnJ`-cr
"lr?E3+Z#
O%{X<epq1YJ
(qdu+f1 U
YH4'"}b5kS
,wX|#$4
_%1fFF'x$
cAJ|?`[`
(TSli*SHaY
b0}.VkBP
nqM"/eYBT1?(|
Uj)@#
8nlb4F
(%o?+}
ow(R(,
T~Zjrf
7jDTv&fB
Un\dv_y+P?n|pB'
.ROYEd
_wHDO#Jlfw
0lJ2Vl<T!bp]
1ynQ>dV9
<G:%qZ&IW/
C(3vQ&L
(0"8tv
?kep^[GS4
A`xDY?GE+\N.
Rsf4MIv
, |4S{
f`8A-5U'@n\SM\1:zxYZ<IAvA$
O8:L2@
yWWROBS
/iM~%/~Xl8PDP!1h/*i
GQEx_$dE;O]B}&
6'A-&Sq
^K#|lK
aE&_'I^
S:OU](
4<6)l/V&
*$'L$="2
$Oh'/;/gV
<y@X.~
Y1b+fD
,$[Pa;;Bqf/I
&T.;d`~L=V$p&lOZ.L
IN(meB
ICz%:sj
;%V6kn
=+t)G{"f
e8t0Cx
p2 |8x
]:>"*ytv(
Xt$D8cZ\D
X3!Yf,1
K.%^-Q$B%e5
,_1LQA
G+]w/1>U
4Z6wIa
5r@f9Ug
0Ymm~C<~d':8
B2i=W4IT
AGO@ie\/TCb/T
%pJAmpB
27S.@NY
Qlrc_J
s=cv 8_
+?so8s
+b6OJ"
S56-21Z
s =,m^
2){qaU~~
.wx65|gv
D,q.[O
4eV2m5.
>T^ReoY
xe'T"W
[+_oQ'yQK"'&S[BG8
"fzlRf97Q
M_Y*U'x~2{
"(p)@>6
cYMve>
A v*zx
+X8[76f
<zD9Hz
:$I|U)/z
^NK)_d
D/sE=p_
zZ$n`*q
z?:TL
q$g5K\
=xz1~?3M,~B"X~}{
JbUU2-
i%j69'
,lpiReS
&ff;:L2toYh@[1ET
KE:VVs!q
'^^KL8
'zgGMJa*#z]
}27^J"2Xh
_CQw0>Gfg?aM
~6.J \
xW)%h7S?cp7H0eLw
C3j$LYD
jP#f'6
E4GrG1^/t2bd4U%E[b
);r~ba
jk,.)~YNgz3
\|%M@/
2N$cP,G
fnkQiJ
Dqe%g?
KiFejz
E0#Lo.E
'.LZ`lO
07l|*4w
5XuND)m
21r8`ah!W61Db
FZD\3%5
0A$X&'U8ZNHP
8_d3ak
&O)Vlm9>
L9=cmn
o5/iY7dM8
E-- dq{
iZz( K<E]C
xu_RrE
k~dbJ?g@\#2
Qt(Gh-D0
MPDut:
&_^f::-L'M}n_
Q{5b2S
Uz<t=6
VoIRX\a|Z
HM|a'L.V
QU,SVY
}vUN7Rt(
FK{Ar4
^h`X}D;rPN|>d;
zQ(;gX230J&~/
;Ndq8p
%DR|$\3('
-H!F(@5
H$=1j:*)8Su8
gb)84iIhU:
$f)jcQru
x,cl]_4
.u"0Rb
+;M+aYm,LZ9
[w?~N&I
pAp4c$z<C
$h~GNadq_
TU`#4d
g2?"wF&
2.0.`!{
K{ 75SF
!>%[]*-B^L^}`B)Gv
> fS5@"
Y?Dm@6
:K}18#s(f9
Wxnbt}d%eyf+
@gDy{k}IE7
,Q`&zgb
8<VP\fE+[$9QFv
ETFAKN
tS)G9(l{)2b0U
wO7i0.Jq
h'Wy4zfCNr%cT
"|5HF0y
4Y}VQ93*
SrBKt\Q
Q@\Cu-
W2RcN>
h`H{4!b@'i
,a)1ac
?10]|gf
\XX`$S
bv0)5=$zr%lFh
W\Zpip<
"[5d`V-/q!
v#,k&x
2|+>>VLFM+
B=3-\O
y>GyNT
,MX3NP 4Up
S%;{X[~g;Y
MXYV@$}43
}2XAt?X9>;`
1v]jZp
D"b:~[n#*
]rWqaBFm
oi+"GA
3?F{~ya{
kzOJwr
,4!fl7
n.Ed-OKj0b
yD"?Ta
XmoB^V
BvDKQVj
9/j\yQ
eP}Y0LdY+}
G|V vJ
oV;+'uzo`
&d(2'46JqF?!
/cZQk0BY
?JrP)U]$3+}
tA#DU$v
ve'=iiq7{i
Ge1DX_
XXR<qv
2O I`(^bC
[VWQ|[;
zFu7t0|$
Zd_#+p
'!RvWq<
7$6.ZR
rp0T3j
6v~3E6
Jq{F27hx]nz
eY*dDJ7~05}&\4
p"f7w;f
qg&M[7O4]|D
`v)1h'
^i*MsUp
^)4;JIMl}
-]@V<]e)F
DcG+-jP2-Y
VePq_rBX>
HG$KRWJ2^
L^2S^8Y-UW
Xk{=0}XN[WoP
xla>P2!
&fJdfS.
:|PZl)7gM7
o 1W/YsNZ
4WUG#=x
*\a|G3+
E8R_ H
6uG<-e}K|
=b,bOx*@
yteuNGF
{se?.w7b`
?`mDS.
jb3=*Ow/0
,pg%^0!rQ
Z^0*/7r:
{LY\Dv
d% t.n*T a'
V7PF)%b
Af>uH;A
cV2Azy@6 P`(_RS
>QY*@5c4
u8Qj{l
)H[TpT
,,":hIr,iFTE!k
Bqo)HS`
r,{a[R$Wn(
W]urWT~#
"{9)hZA=X
scJ.k6h-;#
L'B>!R
./nj73
k0ONdE-6s
G,3MDDati41
U-33T%
x?CHM:6wrFUr"
^x@} 4S
k~*ZgGv
h}S#gM Ft
Vp-mFp
A`_(dPU
ms1oiT^
fw#nmo&^:
e87GTT
RdamlXqnt
{&?Y'iW7X
PZk,TuT
K,5{t>V*
k)Hnx<o
sqG$UdA\&a[Hcc
5~=l7F
/I7N>),25JCCu
"MD?D^
{l]W.)`xcoo}r
uxu*wn
,X44C<
Y] 0\Xsit
IuX$E+hQjhGi
5iN3 _<v%
/f[!X*Q
Vg#4(~:f{c*l=L
yiQ_#Osi5
_r6/X^fO
f#dQ#*6
%R?[|s
p{2_ TW+
`4cgQ9V`
~oWCD5?
PdOsui
Un^LKw
O5M?k/,&1
]4~6H{ PC%f#)\)}
r*1OWo*#
,/"ayMU2f0
];$V-Eb
Kc`kqYx
7^5Pl
@K[!6V
)dIz%d!xmS1
m^y+#8o
M7jxuE3\B
QR^$Xq-fGd
!(5BPcVX
6<7W$ud
H{L%5dG>*T?Ib
|M*_\Xt;%(
o@`VDW<
'@/|;K
]u4! C
ykH CuWV
WPnb/!pU<-z
P}NjLp
.{?VY@'`T
lK'oS!^
#D@s!h
;A.>Z`
JCS=2B8R0
Us|`9,
k)h-^6
sBv,~,$
9VKLg9*pl
l02e|y
^5.I3s8V6hy
yfr~g%n,
[{C t?^Jz
0*\7b^X
R}h]bG^t
$Lwm5_
^ev)D)rXU(1n
kQlk;=)
dMjESa
nAIT>Y@
{7c?(nm
d{Jm;f
q@zB5''7W
glcoG6#h\Z`6?
[eiPeE+e
'JgQi{q
G:cNj;
Sckr;D0qe
%gTM1"c-6i
QE]sr%
_DYJgi_ F
2(dv:eH]
!d#`NXR8
+=WTNGwv,I+Z0s"IB)1{
=Gh6]Ri
,Owv{'j
_/4)/#
\r?_j
q1V02-u
c7)\,/{
s(8dice)E`
!W=",78z#
2+xS+sH
_oMOrG
$.vpmv.:,>-
VnB@DFh^
ee&ekz
xRnCJYhWA?8d`
h|&T3h\N
5~MNQc%uMC|Z E8
oiV'XF*F-H%
WL"qq8y
bs4m|]o+a5
bn+;_4
IOo88it::P/Y
3\RQ9-i>6Y
Vd;d5K
?tI$XrR
a3T.S!"tL
!x=r.}31
@ma;_ Xl4}U4-
(71 ?LO
Cg/PHu
xA\K@4
l=PWHS-B
.D]k]g'
8{=Mr8A
)>!IH2
^W5p!<
)18s.L
i<SO-lz
#@$4p-2
ote ~0
VDQ@dA
3'5^sj5
V&l'dNpY
KmVL/=s)0
;5p$x6>
+\v'(Co
1hzN/wA
i5>h6B
amG}y%yPo
=Yn]'qkGI<
+pRAB{{I>=
+X3D;-
=.nwCod))6[
Yh#l>|2R
)+&g=.$f
Gi|OT68KoKQ
;y~N$O
23KRtH/
2.l%J
cFI*,sz_
UNG)9(+xEo
u\A]2|M
'dV+xHp=X
>NlS9KNMrK
"}sC^q/v
tO$6$,(oSN8~J
%cxnJ5/
k"n{]4&
wgm(*g
)NK5T*/Bs
<3wD}"c
PQh)QvY
p5|K#bv
#c);eb
4-q kt
*MwsK+
qVh/Py
I-A<!"?z'N
hAyW,2L
J:|$M}/X 8G
4r~t=ECF(4a
|il4,dJ
&&_2D]Z
Xd2BaUb
=5eI+Rh
Y6jN;*6
P.pkq=)PAjZb
W[u6^r|
NvP;{xaaaZN{;s|Y
H''P8v}
p0zD=W:3}z+Q
oFbzpm.M{R@P
iK^>U
NP[oet6dv
%i;jed@>
+~}lS:r3
/H.F7)4wPGT
W'}JT|
~f^ JQ
U_x}7:
cl7UI6*
>U,_Ua
\'MH/l*
!qFDPY
"^tsdB{
z9*>($]:GT~_gp:B6MAh/?
'mPFi*. S)vP
R&;T&ww+|R3t
ti"lGE
9z>L|Hk]HGNAxH
7Gvp"z
[qBN1V~1x
dEmLlq
k%-hV=|
TkMthW
X83Bs]
X4JJ-m
-hnno:
[BZwW?P{`$wp(Dfo
F-tdb@
ZIGV{7|$k(9F1j
B..0dB|
= <a%
ocz[Nqe
4]>hS{1
Rma[[g4.
9FxC83bD
.^?0t9T!~
TD!.8A
2_eP@g@
l*))oH
DVCLAL
PACKAGEINFO
MAINICON

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.