SmartHawk

4.2

中危

2 个模型检测该样本为恶意！

重新分析

下载样本

de01f2e632ad068170c59e0766a8bbb10e1f708716e3cfb75288e8cf8aa4909e

55b1b802bdf5d101e86f188276259bd9.exe

分析耗时

82s

最近分析

文件大小

10.1MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀时间	查杀版本
McAfee	20200925	6.0.6.653
Alibaba	20190527	0.3.0.5
Baidu	20190318	1.0.0.2
Avast	20200926	18.4.3895.0
Kingsoft	20200926	2013.8.14.323
Tencent	20200926	1.0.0.1
CrowdStrike	20190702	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619439589.50875 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619439592.82175 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

This executable has a PDB path (1 个事件)

pdb_path

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Allocates read-write-execute memory (usually to unpack itself) (6 个事件)

Time & API	Arguments	Status
1619439577.49375 NtProtectVirtualMemory	process_identifier: 580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75121000	success
1619439577.58675 NtProtectVirtualMemory	process_identifier: 580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75101000	success
1619439584.28975 NtProtectVirtualMemory	process_identifier: 580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75a11000	success
1619439584.28975 NtProtectVirtualMemory	process_identifier: 580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x766c1000	success
1619439584.28975 NtProtectVirtualMemory	process_identifier: 580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77691000	success
1619439590.46175 NtProtectVirtualMemory	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02d85000	success

Creates (office) documents on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\QDI_User_Guide_EN_v1.2.pdf

Creates executable files on the filesystem (25 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\FXPIFEXD.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDevCommon.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmPluginXcmi.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\FXPDIK.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmSNMPFindMethod.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmPluginCommon.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\Quick Drivers Installer.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmaUtility.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmFindCommon.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmcLogging.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Quick Drivers Installer.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmPluginFXNIC.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmaMIBAccess.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmcSocketUtility.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmuJobClientID.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\FXPIFAPI.DLL
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\PmcAsnValue.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmcCommon.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmPluginIETF.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmtTrapHandler.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmsSnmpUtility.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmPluginMgr.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmPluginFXCMI.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmPluginLegacy.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmPluginDEIM.dll

Creates a suspicious process (2 个事件)

cmdline	cmd.exe /c systeminfo.exe > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\lib\syslog"
cmdline	cmd.exe /c lib\"quick drivers installer.exe"

Drops a binary and executes it (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Quick Drivers Installer.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\Quick Drivers Installer.exe

Drops an executable to the user AppData folder (50 out of 77 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDPC2255AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmSNMPFindMethod.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmcCommon.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDPC2200AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDPC1110AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDCIIIC3100AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDC236AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDP205AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDC156AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmIETFGen.plugin
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDCIIIC2200AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDC650IAP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDCC250AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDevCommon.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmFX4112AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDC450IAP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmaMIBAccess.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmtTrapHandler.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDPC2428AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDCII4000AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDPC525AAP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDP2065AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmaIETFModule.xmm
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDC2003AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmLegacy1.plugin
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmPluginFXNIC.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDCIIC3000AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmaFXPropExtModule.xmm
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmuJobClientID.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\PmcAsnValue.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDPC2120AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDPC1190FSAP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmLegacy3.plugin
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDCC5540IAP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDC1055AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmaUtility.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDP240AAP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmPluginLegacy.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\IOTOptionAddOn.xao
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\DocumentResourceAddOn.xao
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmcLogging.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\FXPIFEXD.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDCIIIC4400AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\FXPIFAPI.DLL
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmaLegacyModule.xmm
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmcSocketUtility.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDCIIIC5500AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDPC4350AP.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDW2050.xpi
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\Lib\pmmDCIIC2200AP.xpi

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 个事件)

Cybereason	malicious.6fcaca
APEX	Malicious

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	cmd.exe /c systeminfo.exe > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\lib\syslog"
cmdline	systeminfo.exe

Collects information on the system (ipconfig, netstat, systeminfo) (1 个事件)

cmdline

cmd.exe /c systeminfo.exe > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\lib\syslog"

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2014-08-28 00:40:54

Imports

Library COMCTL32.dll:

• 0x42a028 InitCommonControlsEx

Library SHLWAPI.dll:

• 0x42a298 SHAutoComplete

Library KERNEL32.dll:

• 0x42a068 FindClose

• 0x42a06c FindNextFileW

• 0x42a070 FindFirstFileW

• 0x42a074 GetVersionExW

• 0x42a078 GetCurrentDirectoryW

• 0x42a07c GetFullPathNameW

• 0x42a080 GetModuleFileNameW

• 0x42a084 FindResourceW

• 0x42a088 GetModuleHandleW

• 0x42a08c FreeLibrary

• 0x42a090 GetProcAddress

• 0x42a094 LoadLibraryW

• 0x42a098 GetCurrentProcessId

• 0x42a09c GetLocaleInfoW

• 0x42a0a0 GetNumberFormatW

• 0x42a0a4 ExpandEnvironmentStringsW

• 0x42a0a8 WaitForSingleObject

• 0x42a0ac GetDateFormatW

• 0x42a0b0 GetTimeFormatW

• 0x42a0b4 FileTimeToSystemTime

• 0x42a0b8 FileTimeToLocalFileTime

• 0x42a0bc GetExitCodeProcess

• 0x42a0c0 GetTempPathW

• 0x42a0c4 MoveFileExW

• 0x42a0c8 Sleep

• 0x42a0cc UnmapViewOfFile

• 0x42a0d0 MapViewOfFile

• 0x42a0d4 GetCommandLineW

• 0x42a0d8 CreateFileMappingW

• 0x42a0dc GetTickCount

• 0x42a0e0 SetEnvironmentVariableW

• 0x42a0e4 OpenFileMappingW

• 0x42a0e8 InitializeCriticalSection

• 0x42a0ec DeleteCriticalSection

• 0x42a0f0 EnterCriticalSection

• 0x42a0f4 LeaveCriticalSection

• 0x42a0f8 CreateThread

• 0x42a0fc GetProcessAffinityMask

• 0x42a100 CreateEventW

• 0x42a104 CreateSemaphoreW

• 0x42a108 ReleaseSemaphore

• 0x42a10c ResetEvent

• 0x42a110 SetEvent

• 0x42a114 SetThreadPriority

• 0x42a118 SystemTimeToFileTime

• 0x42a11c GetSystemTime

• 0x42a120 SystemTimeToTzSpecificLocalTime

• 0x42a124 TzSpecificLocalTimeToSystemTime

• 0x42a128 LocalFileTimeToFileTime

• 0x42a12c WideCharToMultiByte

• 0x42a130 MultiByteToWideChar

• 0x42a134 CompareStringW

• 0x42a138 SetFileTime

• 0x42a13c SetFileAttributesW

• 0x42a140 GlobalAlloc

• 0x42a144 SetCurrentDirectoryW

• 0x42a148 WriteConsoleW

• 0x42a14c GetConsoleOutputCP

• 0x42a150 WriteConsoleA

• 0x42a154 SetStdHandle

• 0x42a158 GetLocaleInfoA

• 0x42a15c GetStringTypeW

• 0x42a160 GetStringTypeA

• 0x42a164 LoadLibraryA

• 0x42a168 GetConsoleMode

• 0x42a16c GetConsoleCP

• 0x42a170 InitializeCriticalSectionAndSpinCount

• 0x42a174 QueryPerformanceCounter

• 0x42a178 SetHandleCount

• 0x42a17c GetEnvironmentStringsW

• 0x42a180 FreeEnvironmentStringsW

• 0x42a184 GetEnvironmentStrings

• 0x42a188 FreeEnvironmentStringsA

• 0x42a18c GetModuleHandleA

• 0x42a190 LCMapStringW

• 0x42a194 LCMapStringA

• 0x42a198 IsValidCodePage

• 0x42a19c GetOEMCP

• 0x42a1a0 GetACP

• 0x42a1a4 GetModuleFileNameA

• 0x42a1a8 ExitProcess

• 0x42a1ac HeapSize

• 0x42a1b0 IsDebuggerPresent

• 0x42a1b4 SetUnhandledExceptionFilter

• 0x42a1b8 UnhandledExceptionFilter

• 0x42a1bc TerminateProcess

• 0x42a1c0 VirtualAlloc

• 0x42a1c4 VirtualFree

• 0x42a1c8 HeapCreate

• 0x42a1cc InterlockedDecrement

• 0x42a1d0 GetCurrentThreadId

• 0x42a1d4 InterlockedIncrement

• 0x42a1d8 TlsFree

• 0x42a1dc TlsSetValue

• 0x42a1e0 TlsAlloc

• 0x42a1e4 TlsGetValue

• 0x42a1e8 GetStartupInfoA

• 0x42a1ec GetFileAttributesW

• 0x42a1f0 FlushFileBuffers

• 0x42a1f4 ReadFile

• 0x42a1f8 GetFileType

• 0x42a1fc SetEndOfFile

• 0x42a200 SetFilePointer

• 0x42a204 WriteFile

• 0x42a208 GetStdHandle

• 0x42a20c GetLongPathNameW

• 0x42a210 GetShortPathNameW

• 0x42a214 GetCPInfo

• 0x42a218 MoveFileW

• 0x42a21c CreateFileW

• 0x42a220 CreateDirectoryW

• 0x42a224 DeviceIoControl

• 0x42a228 RemoveDirectoryW

• 0x42a22c DeleteFileW

• 0x42a230 CreateHardLinkW

• 0x42a234 GetCurrentProcess

• 0x42a238 CloseHandle

• 0x42a23c SetLastError

• 0x42a240 GetLastError

• 0x42a244 CreateFileA

• 0x42a248 IsDBCSLeadByte

• 0x42a24c GetCommandLineA

• 0x42a250 RaiseException

• 0x42a254 GetSystemTimeAsFileTime

• 0x42a258 HeapAlloc

• 0x42a25c HeapReAlloc

• 0x42a260 HeapFree

• 0x42a264 RtlUnwind

Library USER32.dll:

• 0x42a2a0 EnableWindow

• 0x42a2a4 GetDlgItem

• 0x42a2a8 ShowWindow

• 0x42a2ac SetWindowLongW

• 0x42a2b0 GetDC

• 0x42a2b4 ReleaseDC

• 0x42a2b8 FindWindowExW

• 0x42a2bc GetParent

• 0x42a2c0 MapWindowPoints

• 0x42a2c4 CreateWindowExW

• 0x42a2c8 UpdateWindow

• 0x42a2cc LoadCursorW

• 0x42a2d0 RegisterClassExW

• 0x42a2d4 DefWindowProcW

• 0x42a2d8 DestroyWindow

• 0x42a2dc CopyRect

• 0x42a2e0 IsWindow

• 0x42a2e4 LoadIconW

• 0x42a2e8 LoadBitmapW

• 0x42a2ec PostMessageW

• 0x42a2f0 GetSysColor

• 0x42a2f4 SetForegroundWindow

• 0x42a2f8 MessageBoxW

• 0x42a2fc WaitForInputIdle

• 0x42a300 IsWindowVisible

• 0x42a304 DialogBoxParamW

• 0x42a308 DestroyIcon

• 0x42a30c SetFocus

• 0x42a310 GetClassNameW

• 0x42a314 SendDlgItemMessageW

• 0x42a318 EndDialog

• 0x42a31c GetDlgItemTextW

• 0x42a320 SetDlgItemTextW

• 0x42a324 wvsprintfW

• 0x42a328 SendMessageW

• 0x42a32c PeekMessageW

• 0x42a330 GetMessageW

• 0x42a334 TranslateMessage

• 0x42a338 DispatchMessageW

• 0x42a33c LoadStringW

• 0x42a340 GetWindowRect

• 0x42a344 GetClientRect

• 0x42a348 SetWindowPos

• 0x42a34c GetWindowTextW

• 0x42a350 SetWindowTextW

• 0x42a354 GetSystemMetrics

• 0x42a358 GetWindow

• 0x42a35c GetWindowLongW

• 0x42a360 OemToCharBuffA

Library GDI32.dll:

• 0x42a040 GetDeviceCaps

• 0x42a044 CreateCompatibleDC

• 0x42a048 CreateCompatibleBitmap

• 0x42a04c SelectObject

• 0x42a050 StretchBlt

• 0x42a054 DeleteDC

• 0x42a058 GetObjectW

• 0x42a05c DeleteObject

• 0x42a060 CreateDIBSection

Library COMDLG32.dll:

• 0x42a030 GetSaveFileNameW

• 0x42a034 CommDlgExtendedError

• 0x42a038 GetOpenFileNameW

Library ADVAPI32.dll:

• 0x42a000 RegOpenKeyExW

• 0x42a004 RegQueryValueExW

• 0x42a008 RegCreateKeyExW

• 0x42a00c RegSetValueExW

• 0x42a010 RegCloseKey

• 0x42a014 SetFileSecurityW

• 0x42a018 OpenProcessToken

• 0x42a01c LookupPrivilegeValueW

• 0x42a020 AdjustTokenPrivileges

Library SHELL32.dll:

• 0x42a274 SHGetMalloc

• 0x42a278 SHGetSpecialFolderLocation

• 0x42a27c SHGetFileInfoW

• 0x42a280 ShellExecuteExW

• 0x42a284 SHChangeNotify

• 0x42a288 SHFileOperationW

• 0x42a28c SHBrowseForFolderW

• 0x42a290 SHGetPathFromIDListW

Library ole32.dll:

• 0x42a368 CLSIDFromString

• 0x42a36c CoCreateInstance

• 0x42a370 OleInitialize

• 0x42a374 OleUninitialize

• 0x42a378 CreateStreamOnHGlobal

Library OLEAUT32.dll:

• 0x42a26c VariantInit

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.24.14
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	50539	255.255.255.255	161

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.