Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| docs.microsoft.com | 104.74.216.251 | |
| eter101.dvrlists.com | 79.134.225.84 |
- TCP Requests
-
-
192.168.56.101:49215 104.74.214.213:80
-
192.168.56.101:49240 104.74.214.213:80
-
192.168.56.101:49259 104.74.214.213:80
-
104.74.214.213:80 192.168.56.101:49260
-
192.168.56.101:49216 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49217 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49218 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49219 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49220 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49221 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49261 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49262 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49263 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49264 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49265 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49267 184.25.26.74:443docs.microsoft.com
-
192.168.56.101:49242 23.197.164.62:443docs.microsoft.com
-
192.168.56.101:49243 23.197.164.62:443docs.microsoft.com
-
192.168.56.101:49244 23.197.164.62:443docs.microsoft.com
-
192.168.56.101:49245 23.197.164.62:443docs.microsoft.com
-
192.168.56.101:49246 23.197.164.62:443docs.microsoft.com
-
192.168.56.101:49247 23.197.164.62:443docs.microsoft.com
-
192.168.56.101:49232 79.134.225.84:2050eter101.dvrlists.com
-
192.168.56.101:49233 79.134.225.84:2050eter101.dvrlists.com
-
192.168.56.101:49234 79.134.225.84:2050eter101.dvrlists.com
-
- UDP Requests
-
-
192.168.56.101:54056 164.124.101.2:53
-
192.168.56.101:55450 164.124.101.2:53
-
192.168.56.101:59369 164.124.101.2:53
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62325 239.255.255.250:3702
-
192.168.56.101:62445 239.255.255.250:1900
-
192.168.56.101:62447 239.255.255.250:3702
-
192.168.56.101:62449 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
GET
302
http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0
REQUEST
RESPONSE
BODY
GET /fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: ko-KR
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: go.microsoft.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Location: https://docs.microsoft.com/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0
Server: Kestrel
Request-Context: appId=cid-v1:9b037ab9-fa5a-4c09-81bd-41ffa859f01e
X-Response-Cache-Status: True
Content-Length: 0
Expires: Thu, 05 Aug 2021 08:39:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 05 Aug 2021 08:39:27 GMT
Connection: keep-alive
GET
302
http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0
REQUEST
RESPONSE
BODY
GET /fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: ko-KR
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: go.microsoft.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Location: https://docs.microsoft.com/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0
Server: Kestrel
Request-Context: appId=cid-v1:9b037ab9-fa5a-4c09-81bd-41ffa859f01e
X-Response-Cache-Status: True
Content-Length: 0
Expires: Thu, 05 Aug 2021 08:39:36 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 05 Aug 2021 08:39:36 GMT
Connection: keep-alive
GET
302
http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0
REQUEST
RESPONSE
BODY
GET /fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: ko-KR
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: go.microsoft.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Location: https://docs.microsoft.com/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0
Server: Kestrel
Request-Context: appId=cid-v1:9b037ab9-fa5a-4c09-81bd-41ffa859f01e
X-Response-Cache-Status: True
Content-Length: 0
Expires: Thu, 05 Aug 2021 08:39:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 05 Aug 2021 08:39:44 GMT
Connection: keep-alive
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.3 192.168.56.101:49232 79.134.225.84:2050 |
None | None | None |
|
TLS 1.3 192.168.56.101:49233 79.134.225.84:2050 |
None | None | None |
|
TLS 1.3 192.168.56.101:49234 79.134.225.84:2050 |
None | None | None |
Snort Alerts
No Snort Alerts