1.4
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.59
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:TrojanX-gen [Trj] | 20200501 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200502 | 2013.8.14.323 |
| McAfee | GenericRXAA-AA!9A34CF471205 | 20200502 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b3cd4a | 20200502 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | |
| section | petite |
动态指标
在 PE 资源中识别到外语
(9 个事件)
| name | RT_ICON | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000a590 | size | 0x000002e8 | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b020 | size | 0x0000006a | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000a578 | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000a220 | size | 0x00000358 | ||||||||||||||||||
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '', 'virtual_address': '0x00001000', 'virtual_size': '0x00009000', 'size_of_data': '0x00005600', 'entropy': 7.711960948968617} | entropy | 7.711960948968617 | description | 发现高熵的节 | |||||||||
| entropy | 0.8628649813834999 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 56 个反病毒引擎识别为恶意
(50 out of 56 个事件)
| ALYac | Trojan.GenericKD.31701564 |
| APEX | Malicious |
| AVG | Win32:TrojanX-gen [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.31701564 |
| AhnLab-V3 | Malware/Win32.Generic.C3036121 |
| Antiy-AVL | Trojan[Backdoor]/Win32.Farfli |
| Arcabit | Trojan.Generic.D1E3BA3C |
| Avast | Win32:TrojanX-gen [Trj] |
| Avira | TR/Crypt.XPACK.Gen |
| BitDefender | Trojan.GenericKD.31701564 |
| BitDefenderTheta | Gen:NN.ZexaF.34108.bm1@aOhiJhlb |
| Bkav | HW32.Packed. |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| Comodo | TrojWare.Win32.ServStart.CB@7486ss |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.712056 |
| Cylance | Unsafe |
| Cyren | W32/ServStart.H.gen!Eldorado |
| DrWeb | Trojan.DownLoader24.63361 |
| ESET-NOD32 | a variant of Win32/ServStart.OP |
| Emsisoft | Trojan.GenericKD.31701564 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/ServStart.H.gen!Eldorado |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| FireEye | Generic.mg.9a34cf471205635f |
| Fortinet | W32/GenKryptik.AWIY!tr |
| GData | Trojan.GenericKD.31701564 |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.dctkc |
| K7AntiVirus | Trojan ( 0053266f1 ) |
| K7GW | Trojan ( 0053266f1 ) |
| Kaspersky | Trojan-GameThief.Win32.Magania.uhbd |
| MAX | malware (ai score=89) |
| Malwarebytes | DDoSTool.Nitol |
| MaxSecure | Trojan.Malware.300983.susgen |
| McAfee | GenericRXAA-AA!9A34CF471205 |
| McAfee-GW-Edition | BehavesLike.Win32.Cutwail.mc |
| MicroWorld-eScan | Trojan.GenericKD.31701564 |
| Microsoft | DDoS:Win32/Nitol.A |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.F31C.Malware.Gen |
| Rising | Worm.ServStart!8.10D (TFE:dGZlOgZLqBav9MrMew) |
| Sangfor | Malware |
| SentinelOne | DFI - Suspicious PE |
| Sophos | Troj/Agent-BCHT |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.10b3cd4a |
| Trapmine | malicious.high.ml.score |
| VBA32 | BScope.Trojan.Downloader |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2017-05-28 21:59:36
PE Imphash
7bdb3a3ad9a3c676789cc5fe74509fe9
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| 0x00001000 | 0x00009000 | 0x00005600 | 7.711960948968617 | |
| .rsrc | 0x0000a000 | 0x00002000 | 0x00000c00 | 4.548959897127443 |
| petite | 0x0000c000 | 0x000001ab | 0x000001ab | 3.83071027050959 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000a590 | 0x000002e8 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_DIALOG | 0x0000b020 | 0x0000006a | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_GROUP_ICON | 0x0000a578 | 0x00000014 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_VERSION | 0x0000a220 | 0x00000358 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
Imports
Library kernel32.dll:
• 0x40c10a ExitProcess
• 0x40c10e GetModuleHandleA
• 0x40c112 GetProcAddress
• 0x40c116 VirtualProtect
• 0x40c11a VirtualAlloc
• 0x40c11e VirtualFree
• 0x40c122 LoadLibraryA
Library MFC42.DLL:
• 0x40c12a None
Library MSVCRT.dll:
• 0x40c132 free
Exports
| Ordinal | Address | Name |
|---|---|---|
| 1 | 0x401c70 | Musalut |
L!This program cannot be run in DOS mode.
MvMvMv6jLvyIvjLv"iLv"iFv"iOv{POvMvviKvpLviIvRichMv
`.rsrc
@petite
h{ZY-L [9Fwr
9BVEu`
f-e^Ul.p*#j
z'djgJ+p
&qvG'b
`rP^$^<ci
l'f,5s
qm>&or\hhe5z
7TJjAJ>/)
1INN4]C
b+K>;3o
y%x2dLB
#@h<<Q!#PSHR@aG/1
xi|`@^2qttH
]$TkzA*2`2]iTO_
7?<U$E
['`Xqo"
BdAQuQ
hcpD(p$&
<[LyDRfB
)fAu4I
LTzsr{
!l k;6;*bRVx
g{^!m]T_oV
^Cu39V
WI OE w2~
:fg#R+$
{%^F~h=O*,-u4Q
nTS8WVR
|uLQ_^_T,i0Z+y^
4$eVEr!"o
Z$`a(f
3oWI]1
Z f'a[
))*\\V"{BK
xF]>ZR*5XY"
8qAz?-wj
&>';@aN
l{B,e)NJ*
Ew:>5>Fb#VD;
vuOpUyR
6k >WM
5Wl?.>uIx~F
o+ZG^I
:U9*p>>xw
'(<1EhU
VAEY<MZ|
t.d1=&(m
;\K3A&
bVI9Ul?8
v3KX;?N'*n,U*
EJRf(ox
0ng:frw
<}8 :khHd<
?xy<)2Ac"9\&V
+ &L'<K$
In8_uf
X7b}J3
2]3.`Df$MiOJ8f_
mhF_>}
Tu,Yg]
BBB@ABBBB
BBBBBBBBBBBBBBBB
BBBBBBBBBBBB
BBBBBBBB!!h^F
,"P)!!(6
@YP_Pa
-B*.j-
V3!JBB5#IDy13,
yqLun}1%Ev
VUYQkA* AdpT;Qu(u
oy9`tm
rI:qt;
exl|$g7
EA@' {)2!
u(oaWj
2L"/&nN>i
2a`iFX
T(Y>fu$pGk"
L)X/$ax $
3|zeyo
.s2$>6
UF$ogk%nBT
r.RpBrS
Etijntr&
,0zqanVBM
2\L,-zi
9eC^)-
i4MmMzTai&iFhzkidn`0:
T<6rZ\L"0
CYC&!.}<QCA
>$2GTm|\
RBQ,.!C.:
rqenkmtqP
_q{b5-@Onm`dd)mcfvla3
1DKRu<?M
JICbZ@
=lZLQD{cM
"<(]&0:JZQ1
y03*wTQ97!0O9
u;2{ 3
5-c|OQN
HY kK<caDHl
jrg=~I
JV9E$b
cT>zoc
&Quf@>D*i+
gb1zpJ
vhl& /*sED41
PXQ/RF ?
Yf"'xU#
sGaz5
P9"#cf
&i&isGmpbF
Qqpqt]V
hDm|LIF[Glc
_T^:TH'YUdW
J:-[_ $
Z:2J/}kK'"
{\Bd ^
.zcjk:
N]|3C%H1
16I98'+
[q`;la2Ul
ah^P4u
c bpdz5#
uLD&t_
i#kb/t
U !vS[7
*|q;G4&X
>F@[u}jv
LhI3JA|D%VN`V
FH7h8G{Bq'
e=kH5B(-S
@416?YsX4
|/e*N{6UZxI
G2,*{Hi
,Y8}zbZ
\?z?w=EHu:
mwHl "&
0(xfy;=
gQd.V%
EICc@|
Z.[@t-v
= <)WK$"5M
W5w,XH~[5X
Wr0mh&'"
^Awf!bXcO
r&^q&Y:uNn+/G
X5@YK?PII,
Of@y+|zV
cg00BF
W\|1i:T@>9'
8ufQW0E4
T]Q5.^PvI?P`'
k5dfAokn
F3za:H 5j'
yINX%4By
<G}>=B
"spaE)c29xA_
M//$|.
2KYFo}
1!57F4
"(M+<w
{Fh=9>
NB2h-WvUF
k)rWxd
Vco8B>
H'5-Uv
`uu;y:L
m<9" PY
?_.r%r
jWj6$T<n
EF: VU
`4Z67~
2)#>~!
3PHhUUKw]B/h
.TPU_q
) nru^A
LxND2"J
r@25JI
[S5]oj
S$hb=K
FhnbTSzI
ouI;Q@NN
?,jfj
^.L(JS
4jk%TiD
312IZbs
Y{x+63D
ZuOA:O$,
/WS1,c2
8F(m\f
J rIqbN9
/20dj}F
}b~Y%yn
Bl4k)s
r _xH5
t}J>^I
:Ka'`A
J;F3RN
lhVpRH,
{49pDr
#Lh=81P
O'!/2ZzK
1y'Tpjf|%
&VDT]mJ~c`
CwNZ5RQg
mDFb 7
fgVs3A
d".CbS{*
86sYQ;]
-@cXzG7
KP.a&-}
>6,JpG%G
`jx57Bs_(O:
:^Z,x*
<G=mI.i
X<#'.m
/0o$+4
<Bi^aA#e>
[<8*p-Z)#
j9T>Y7
S.MS,k
+4AS`.uRPH
Pv]z.s<_xZ+
Z~TBNp
?:el\a6_
R-18~tv"7%%t
y~w*N7@
9)W|DT7
Gb:.c-
cp'$/GH&2$_NOZ
*\N3@l
$.`d=4E
tOW!{q
.1,*K)~"cqwW@
\Vj(_a1
R!8=s+D
`xWo9=N
xU%v*3|*avi
</OSLT
| iS_!'
nAX9UwP3\ZIvhZx
z[!V0_
ysj'IE13t
Vh`\V_
+l%M&C(t
|YD#1Um.
{_R2%C
hQxn1" ],7u)
^_z#:t
-nnad\
w|4F4i2
`EFhsu
@P2+|0.LTv
y03YUf
II8&Ka
_E,||#v}w Ri
1;<ut4
J9:rtG
UBLW"?
t9.wS0
4Wa6IffPca
WBDP $
hQEV}j
5@LfMgr/
!|]hs <%
8nHJi$9
J?=g%UZ"5m"]76
)BPC|4
&6Y^<MH
MN-~)I
=q;!VP[`2Ob
cZ)x{ru9_'q1
DlW'X3W
V#_Ees
'U}*Rt
``;6n\
>Sv_yE"D4s=}^x/j1tq
V4 )O}7G
Jn%`t?~khVy
P"F$:GB/)z<
_,Gkadl~{Z
8c/aad'k{-6;
tyNnZ2neHRT|'B
mDDG4$Xp_
cA?DLN
xvzQNe
\G%SS6"
!07I]R
4zI124G
h%Z"XxC@BW?4Tjks
LD\!YG
\l5o'X
z?)Te+{
vI2Y/l,9=
a>QNF{
i69Mlv
#E/m!D
?qDq1DEM#7
Q9<"7c]I
t$VjS]
mme/"T
JZOpu1
\0lHYu
T7@n$~!O'GmU
Zkaqv'
Tza(lh!DO&
pify1JIE
}{4zICA
%MI\S1
\p7v4t
{|YL\B_DL]
1h@dSAr{jsirr8TYX|82Be
"3@.2<;./
X1N75=sR
/NXyu{oVai`jD
DM#`>g
:}~yF/
UX1!&Y
T/>0@;
7WpXom-n*nc-]KW
Qo4PaO
zCe-Q`9G<`a
R}@j'%8p
41d/%n&
#*\n1*"v3+
qG `=>x
UNH KBN
0: oE<(
;/`vqms
LqX&*Z
V\dF{da&
V48^XXXX]
HrCg@b
Z(JbOG
"+2 +>
T/JcYA
2,bcQq
;PA!6I
!z(\|V]QV
3r>bPr4
jO `v*9|`s
MMROcY,q
)C^VO_/f
Pq-_v+q
2[d'/Z
%]'SaA{T
UGs.@Am
MessageBoxA
wsprintfA
ExitProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
user32.dll
kernel32.dll
MFC42.DLL
MSVCRT.dll
Musalut
MDat.dll
CfvbpWekbyCfvbpWekbyCfvbpWekbyCfvbpWekbyCfvbpWekbyhcUZXIq4
hcUZXIq4
hcUZXIq4
hcUZXIq4
hcUZXIq4
sIbl0ZWzd3sIbl0ZWzd3sIbl0ZWzd3sIbl0ZWzd3sIbl0ZWzd36X9SFq0e9
6X9SFq0e9
6X9SFq0e9
6X9SFq0e9
6X9SFq0e9
9WUpu2sJOL9WUpu2sJOL9WUpu2sJOL9WUpu2sJOL9WUpu2sJOL
Err7hWf9UErr7hWf9U
Err7hWf9U
Err7hWf9U
Err7hWf9U
65XdXt5aIN65XdXt5aIN65XdXt5aIN65XdXt5aIN65XdXt5aINh7efsKrJDzh7efsKrJDzh7efsKrJDzh7efsKrJDzh7efsKrJDz
nChql6
tZnChql6tZ
nChql6tZ
nChql6tZ
nChql6tZ
i17cXeqZz
i17cXeqZz
i17cXeqZz
i17cXeqZz
i17cXeqZz
4KdNR3rnKd4KdNR3rnKd4KdNR3rnKd4KdNR3rnKd4KdNR3rnKdu1NxjVam9Ou1NxjVam9Ou1NxjVam9Ou1NxjVam9Ou1NxjVam9ONgD03DnGmtNgD03DnGmtNgD03DnGmtNgD03DnGmtNgD03DnGmtiVY4q0L5
uiVY4q0L5u
iVY4q0L5u
iVY4q0L5u
iVY4q0L5u
tvVs0Fa3dftvVs0Fa3dftvVs0Fa3dftvVs0Fa3dftvVs0Fa3df4vtR1cukr
4vtR1cukr
4vtR1cukr
4vtR1cukr
4vtR1cukr
cOZx8LiasIcOZx8LiasIcOZx8LiasIcOZx8LiasIcOZx8LiasIC7dTscNhvQC7dTscNhvQC7dTscNhvQC7dTscNhvQC7dTscNhvQH8QHjDcHu6H8QHjDcHu6H8QHjDcHu6H8QHjDcHu6H8QHjDcHu6zb2gxQhxhnzb2gxQhxhnzb2gxQhxhnzb2gxQhxhnzb2gxQhxhncqXH0EJ2N
cqXH0EJ2N
cqXH0EJ2N
cqXH0EJ2N
cqXH0EJ2N
neMlXF1sMxneMlXF1sMxneMlXF1sMxneMlXF1sMxneMlXF1sMxWq1zPF4YrzWq1zPF4YrzWq1zPF4YrzWq1zPF4YrzWq1zPF4YrzUqLxlqfWcaUqLxlqfWcaUqLxlqfWcaUqLxlqfWcaUqLxlqfWcaXl
EeRnbiRXlEeRnbiR
XlEeRnbiR
XlEeRnbiR
XlEeRnbiR
Qai0kz5O4UQai0kz5O4UQai0kz5O4UQai0kz5O4UQai0kz5O4UK6Ha7oJO
XK6Ha7oJOX
K6Ha7oJOX
K6Ha7oJOX
K6Ha7oJOX
21FdhQcXZi21FdhQcXZi21FdhQcXZi21FdhQcXZi21FdhQcXZi
pixT71osfpixT71osf
pixT71osf
pixT71osf
pixT71osf
nGaD7DaVVMnGaD7DaVVMnGaD7DaVVMnGaD7DaVVMnGaD7DaVVMdf2RxCNXCcdf2RxCNXCcdf2RxCNXCcdf2RxCNXCcdf2RxCNXCcYrNvIasx2uYrNvIasx2uYrNvIasx2uYrNvIasx2uYrNvIasx2uHVPV5MTo40HVPV5MTo40HVPV5MTo40HVPV5MTo40HVPV5MTo4008ea2nrDxl08ea2nrDxl08ea2nrDxl08ea2nrDxl08ea2nrDxlanwP6Mzcq
anwP6Mzcq
anwP6Mzcq
anwP6Mzcq
anwP6Mzcq
HGb6wMni
HGb6wMni
HGb6wMni
HGb6wMni
HGb6wMni
bsOGN8uXF
bsOGN8uXF
bsOGN8uXF
bsOGN8uXF
bsOGN8uXF
nX1PlFehyznX1PlFehyznX1PlFehyznX1PlFehyznX1PlFehyzmjt
DURj5VmjtDURj5V
mjtDURj5V
mjtDURj5V
mjtDURj5V
KktEoMxY5jKktEoMxY5jKktEoMxY5jKktEoMxY5jKktEoMxY5jd68W6PlZUqd68W6PlZUqd68W6PlZUqd68W6PlZUqd68W6PlZUqLRr5u1derZLRr5u1derZLRr5u1derZLRr5u1derZLRr5u1derZZ4shi8sImbZ4shi8sImbZ4shi8sImbZ4shi8sImbZ4shi8sImbQtvQaELXZTQtvQaELXZTQtvQaELXZTQtvQaELXZTQtvQaELXZT5On7kFrZU05On7kFrZU05On7kFrZU05On7kFrZU05On7kFrZU0j0COqfyOgej0COqfyOgej0COqfyOgej0COqfyOgej0COqfyOge60QKia8eKR60QKia8eKR60QKia8eKR60QKia8eKR60QKia8eKRDTbjvsxSxbDTbjvsxSxbDTbjvsxSxbDTbjvsxSxbDTbjvsxSxbLtX8uVqMrkLtX8uVqMrkLtX8uVqMrkLtX8uVqMrkLtX8uVqMrkHFsOG0dfL
HFsOG0dfL
HFsOG0dfL
HFsOG0dfL
HFsOG0dfL
qqJcs7f8szqqJcs7f8szqqJcs7f8szqqJcs7f8szqqJcs7f8szgF67t9glVSgF67t9glVSgF67t9glVSgF67t9glVSgF67t9glVS7MLn5h5
7k7MLn5h57k
7MLn5h57k
7MLn5h57k
7MLn5h57k
Mgstik4ynJMgstik4ynJMgstik4ynJMgstik4ynJMgstik4ynJ8VXjdGFUhp8VXjdGFUhp8VXjdGFUhp8VXjdGFUhp8VXjdGFUhp
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 4 0 4 b 0
C o m m e n t s
C o m p a n y N a m e
F i l e D e s c r i p t i o n
4 g f t r 7 h 8 7 j d 9 8 . e x e
F i l e V e r s i o n
1 , 0 , 0 , 1
I n t e r n a l N a m e
4 g f t r 7 h 8 7 j d 9 8 . e x e
L e g a l C o p y r i g h t
( C ) 2 0 1 7
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
4 g f t r 7 h 8 7 j d 9 8 . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
4 g f t r 7 h 8 7 j d 9 8 . e x e
P r o d u c t V e r s i o n
1 , 0 , 0 , 1
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.