SmartHawk

3.8

中危

55 个模型检测该样本为恶意！

重新分析

下载样本

1c93d7a579c3564a58ac04755cffbb3614aa63a9750cc0d5909f5e655e0386c9

f71865c0c0842821720f4b5fafb295e8.exe

分析耗时

87s

最近分析

文件大小

679.0KB

静态报毒动态报毒 AGENTTESLA AI SCORE=89 ATTRIBUTE AXJT BRQOQ CONFIDENCE EBGI ELDORADO FAREIT GDSDA GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE KRYPTIK MALICIOUS PE MALWARE@#12IRM3IEHSE5G MALWAREX NANOBOT NOON QM0@A8YDBUD R057C0DIC20 R350841 SCORE SPYBOTNET SUSGEN TSCOPE UNSAFE XUFSVLT9DZH ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanSpy:MSIL/NanoBot.fc198c4c	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20200927	18.4.3895.0
Kingsoft		20200927	2013.8.14.323
McAfee	Fareit-FYE!F71865C0C084	20200926	6.0.6.653
Tencent	Win32.Trojan.Generic.Ebgi	20200927	1.0.0.1

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620815302.957501 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620815364.957501 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 51 个事件)

Time & API	Arguments	Status
1620815301.410501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00b90000	success
1620815301.410501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cf0000	success
1620815302.691501 NtProtectVirtualMemory	process_identifier: 1164 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1620815302.972501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043a000	success
1620815302.972501 NtProtectVirtualMemory	process_identifier: 1164 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1620815302.972501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00432000	success
1620815303.550501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00442000	success
1620815303.832501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00443000	success
1620815303.894501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047b000	success
1620815303.894501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00477000	success
1620815304.707501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044c000	success
1620815305.519501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00444000	success
1620815305.629501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00690000	success
1620815305.675501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00446000	success
1620815306.019501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046a000	success
1620815306.035501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045a000	success
1620815306.035501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00457000	success
1620815306.394501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043b000	success
1620815306.504501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00462000	success
1620815306.504501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046c000	success
1620815306.644501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00447000	success
1620815306.769501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef50000	success
1620815306.769501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef50000	success
1620815306.769501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef50000	success
1620815306.769501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef40000	success
1620815306.769501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef40000	success
1620815306.863501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00448000	success
1620815307.129501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00475000	success
1620815307.722501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00456000	success
1620815308.066501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00449000	success
1620815308.082501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00691000	success
1620815364.363501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00692000	success
1620815364.363501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00697000	success
1620815364.550501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cf1000	success
1620815364.863501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x047b0000	success
1620815364.879501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x047b1000	success
1620815364.879501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x047b2000	success
1620815364.879501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044d000	success
1620815364.879501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x047b3000	success
1620815364.879501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x047b4000	success
1620815364.879501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00698000	success
1620815364.894501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00699000	success
1620815364.910501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0069e000	success
1620815364.925501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a90000	success
1620815364.925501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a91000	success
1620815364.925501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a96000	success
1620815364.957501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a97000	success
1620815365.004501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a9c000	success
1620815365.050501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044a000	success
1620815365.066501 NtAllocateVirtualMemory	process_identifier: 1164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a9d000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.79195726570929

section

{'size_of_data': '0x000a5600', 'virtual_address': '0x00002000', 'entropy': 7.79195726570929, 'name': '.text', 'virtual_size': '0x000a55ec'}

description

A section with a high entropy has been found

entropy

0.9749447310243183

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Generates some ICMP traffic

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34501337
CAT-QuickHeal	Trojan.Multi
Qihoo-360	Win32/Trojan.c96
ALYac	Trojan.GenericKD.34501337
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2515643
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanSpy:MSIL/NanoBot.fc198c4c
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_80% (W)
Arcabit	Trojan.Generic.D20E72D9
Invincea	Mal/Generic-S
Cyren	W32/MSIL_Kryptik.BPO.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender	Trojan.GenericKD.34501337
Paloalto	generic.ml
Rising	Spyware.Noon!8.E7C9 (TFE:C:XuFSvLt9DzH)
Ad-Aware	Trojan.GenericKD.34501337
Sophos	Mal/Generic-S
Comodo	Malware@#12irm3iehse5g
F-Secure	Trojan.TR/AD.AgentTesla.brqoq
DrWeb	BackDoor.SpyBotNET.25
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R057C0DIC20
McAfee-GW-Edition	Fareit-FYE!F71865C0C084
FireEye	Generic.mg.f71865c0c0842821
Emsisoft	Trojan.GenericKD.34501337 (B)
SentinelOne	DFI - Malicious PE
Jiangmin	TrojanSpy.MSIL.axjt
Avira	TR/AD.AgentTesla.brqoq
Antiy-AVL	Trojan[Spy]/MSIL.Noon
Microsoft	Trojan:MSIL/NanoBot.D!MTB
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
GData	Trojan.GenericKD.34501337
AhnLab-V3	Trojan/Win32.Agent.R350841
McAfee	Fareit-FYE!F71865C0C084
MAX	malware (ai score=89)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.MalPack
ESET-NOD32	a variant of MSIL/Kryptik.XRN
TrendMicro-HouseCall	TROJ_GEN.R057C0DIC20
Tencent	Win32.Trojan.Generic.Ebgi
Ikarus	Trojan.MSIL.Inject
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Noon.XRN!tr

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-10 07:36:19

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.110
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.