Edit tour
Windows
Analysis Report
http://teligrum.ru/
Overview
General Information
| Sample URL: | http://teligrum.ru/ |
| Analysis ID: | 1467882 |
| Infos: | |
 | |
Errors
| |
Detection
| Score: | 48 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Stores files to the Windows start menu directory
Classification
- System is w10x64
chrome.exe (PID: 1164 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed "about :blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 2136 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2524 --fi eld-trial- handle=184 8,i,551184 3658287972 954,139689 2445744905 9006,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- chrome.exe (PID: 2428 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt p://teligr um.ru/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | SlashNext: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 Registry Run Keys / Startup Folder | 1 Process Injection | 1 Masquerading | OS Credential Dumping | System Service Discovery | Remote Services | Data from Local System | 2 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 Registry Run Keys / Startup Folder | 1 Process Injection | LSASS Memory | Application Window Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | Obfuscated Files or Information | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira URL Cloud | malware | ||
| 100% | SlashNext | Credential Stealing type: Phishing & Social Engineering |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| google.com | 142.250.181.238 | true | false | unknown | |
| www.google.com | 142.250.186.100 | true | false | unknown | |
| fp2e7a.wpc.phicdn.net | 192.229.221.95 | true | false | unknown | |
| teligrum.ru | unknown | unknown | false | unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.186.100 | www.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.5 |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1467882 |
| Start date and time: | 2024-07-05 00:26:26 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 1m 48s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | browseurl.jbs |
| Sample URL: | http://teligrum.ru/ |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 6 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal48.win@19/6@12/3 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- URL not reachable
- Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 108.177.15.84, 142.250.185.227, 142.250.186.142, 34.104.35.123, 184.28.90.27, 13.85.23.86, 93.184.221.240, 192.229.221.95, 20.3.187.198
- Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, e16604.g.akamaiedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtSetInformationFile calls found.
- VT rate limit hit for: http://teligrum.ru/
⊘No simulations
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.978557317528684 |
| Encrypted: | false |
| SSDEEP: | 48:8N6odQlQTwl0PlbAEHpidAKZdA19ehwiZUklqeh3y+3:8UFQE4bdYy |
| MD5: | 2A99FCDB78603778A0744924E8E4FA7F |
| SHA1: | 01485742B5DC0D8B81AFCF2E6514C8BB794CB828 |
| SHA-256: | A0E71F55D6A5691868ADEE1D7E174345E244AA6F4581226703DC831DC11A88A3 |
| SHA-512: | 71B8FCDD20433891DC90D5D6A99B23A6549431D2EE986D00E06997CCAD27FF3D5251CF2D47D9955A659BB62D0F9183F8F527D6502495910A18D699680681443E |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9914783089560477 |
| Encrypted: | false |
| SSDEEP: | 48:8D6odQlQTwl0PlbAEHpidAKZdA1weh/iZUkAQkqehIy+2:8D6FQE4bX9Qdy |
| MD5: | E194FAF43D405463A5921507FA612B2A |
| SHA1: | 89E885F1F36B51D4398FB485508302A322144381 |
| SHA-256: | 573D5A3BFD1C14AC963B135EE3B0241A2BB074A8E5E541F31CC21CE37350EE5C |
| SHA-512: | 00812098F9A74A0FD7E6ED6F1F494E299EC16C340D784E626ACCBC6938785FD24388DB5286B9748222B9DFE438500421DF6761D4F85AAE22290D33291B4208FB |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2693 |
| Entropy (8bit): | 4.006747371588687 |
| Encrypted: | false |
| SSDEEP: | 48:8xJodQlQTwl0PlbsHpidAKZdA14tseh7sFiZUkmgqeh7smy+BX:8xJFQE4bIn8y |
| MD5: | 7350EDB523D91CC21A59FE0C1088474C |
| SHA1: | E18E223437DC5F0014C6F17CEC6033EEB8054194 |
| SHA-256: | 78FFBCAEA538B8830F29F2E8F8C901B3115D1B0D4DE0AC4DFFD54DB23CA551DF |
| SHA-512: | 1971C22040BE58220DCB88C1B9221BC53CFA3C5DB64FBBB59F7BE7AB4ED39E18937BC0194244C05C76A1F2E36B6FAF6DF6641C2E0F110A816B620BAD6E57F361 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.98940461724931 |
| Encrypted: | false |
| SSDEEP: | 48:82odQlQTwl0PlbAEHpidAKZdA1vehDiZUkwqehUy+R:82FQE4bUey |
| MD5: | 8BEBFC6F6F2960610D3C6125E2A5E7FD |
| SHA1: | 0C7899474E842F75173663190E74C607DEBA8D4B |
| SHA-256: | F3EB609BE73DF84EB6E9DD853BA2FF05DE2F8B65EEEEDBD1D196C11EA63EFA3A |
| SHA-512: | A88CA1E9797082738197753AD0FE9857ECDD62C23B7B171DDFAF3943E3B73DD6033B44BEC7BC2EC327268C895D077717D79E5CBA83D3D56EF3157FBE17EAED89 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9796645736854295 |
| Encrypted: | false |
| SSDEEP: | 48:8iodQlQTwl0PlbAEHpidAKZdA1hehBiZUk1W1qehKy+C:8iFQE4b09qy |
| MD5: | 436D6DBAA05043E2A62885AEB540BDC4 |
| SHA1: | FD3B768C8E2DC7A60AB53ECEEE44642DD374A6A0 |
| SHA-256: | BEFA50A341B8B955EB3171F9FDB8302DF86A462431257005C7718BB922BD4CB0 |
| SHA-512: | 67FED9D72461D514636B031E1E1F4AD80710E5AC13002BC282AAD54743C6250535B0D93AB8A97CD1A0EA4970C64DF1174984C8646F56F4D4C28CCAC011140014 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2683 |
| Entropy (8bit): | 3.988725584656372 |
| Encrypted: | false |
| SSDEEP: | 48:8SodQlQTwl0PlbAEHpidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb8y+yT+:8SFQE4baT/TbxWOvTb8y7T |
| MD5: | 790EE6FBCBB310FE9E6A2B6C5D8EC93B |
| SHA1: | 0587785E47E182F7CF5FE1B8C2C9D85A58DD8553 |
| SHA-256: | ED3AF1FD6ED34E5FE2FB9326581106237093E649D3D7AE742B722D3921C06280 |
| SHA-512: | 350A5BBA4A238F6446C855FCEB199C8A94EB260DA2BDF49E76072095BF79911FE0134A9B533BBF519CBD4B0C2D21989320C3F471F6508CD7EAC3B0C6C3B2EC04 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
⊘No static file info
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jul 5, 2024 00:27:10.832653999 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Jul 5, 2024 00:27:10.832689047 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Jul 5, 2024 00:27:10.942034960 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Jul 5, 2024 00:27:19.347873926 CEST | 49711 | 443 | 192.168.2.5 | 142.250.186.100 |
| Jul 5, 2024 00:27:19.347909927 CEST | 443 | 49711 | 142.250.186.100 | 192.168.2.5 |
| Jul 5, 2024 00:27:19.347994089 CEST | 49711 | 443 | 192.168.2.5 | 142.250.186.100 |
| Jul 5, 2024 00:27:19.348673105 CEST | 49711 | 443 | 192.168.2.5 | 142.250.186.100 |
| Jul 5, 2024 00:27:19.348685026 CEST | 443 | 49711 | 142.250.186.100 | 192.168.2.5 |
| Jul 5, 2024 00:27:20.022599936 CEST | 443 | 49711 | 142.250.186.100 | 192.168.2.5 |
| Jul 5, 2024 00:27:20.023943901 CEST | 49711 | 443 | 192.168.2.5 | 142.250.186.100 |
| Jul 5, 2024 00:27:20.023966074 CEST | 443 | 49711 | 142.250.186.100 | 192.168.2.5 |
| Jul 5, 2024 00:27:20.024837971 CEST | 443 | 49711 | 142.250.186.100 | 192.168.2.5 |
| Jul 5, 2024 00:27:20.024899960 CEST | 49711 | 443 | 192.168.2.5 | 142.250.186.100 |
| Jul 5, 2024 00:27:20.030898094 CEST | 49711 | 443 | 192.168.2.5 | 142.250.186.100 |
| Jul 5, 2024 00:27:20.030956984 CEST | 443 | 49711 | 142.250.186.100 | 192.168.2.5 |
| Jul 5, 2024 00:27:20.072282076 CEST | 49711 | 443 | 192.168.2.5 | 142.250.186.100 |
| Jul 5, 2024 00:27:20.072293997 CEST | 443 | 49711 | 142.250.186.100 | 192.168.2.5 |
| Jul 5, 2024 00:27:20.115359068 CEST | 49711 | 443 | 192.168.2.5 | 142.250.186.100 |
| Jul 5, 2024 00:27:20.443521023 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Jul 5, 2024 00:27:20.443521976 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Jul 5, 2024 00:27:20.552864075 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Jul 5, 2024 00:27:22.266416073 CEST | 443 | 49703 | 23.1.237.91 | 192.168.2.5 |
| Jul 5, 2024 00:27:22.269156933 CEST | 49703 | 443 | 192.168.2.5 | 23.1.237.91 |
| Jul 5, 2024 00:27:29.928442001 CEST | 443 | 49711 | 142.250.186.100 | 192.168.2.5 |
| Jul 5, 2024 00:27:29.928522110 CEST | 443 | 49711 | 142.250.186.100 | 192.168.2.5 |
| Jul 5, 2024 00:27:29.928591013 CEST | 49711 | 443 | 192.168.2.5 | 142.250.186.100 |
| Jul 5, 2024 00:27:31.059218884 CEST | 49711 | 443 | 192.168.2.5 | 142.250.186.100 |
| Jul 5, 2024 00:27:31.059231997 CEST | 443 | 49711 | 142.250.186.100 | 192.168.2.5 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jul 5, 2024 00:27:14.924320936 CEST | 53 | 57443 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:14.926776886 CEST | 53 | 60661 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:16.043704033 CEST | 53 | 52312 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:16.241494894 CEST | 51894 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:16.241712093 CEST | 49498 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:16.289693117 CEST | 53 | 51894 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:16.289711952 CEST | 53 | 49498 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:16.290497065 CEST | 60735 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:16.339962006 CEST | 53 | 60735 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:16.361498117 CEST | 61660 | 53 | 192.168.2.5 | 8.8.8.8 |
| Jul 5, 2024 00:27:16.361983061 CEST | 52303 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:16.368861914 CEST | 53 | 52303 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:16.369986057 CEST | 53 | 61660 | 8.8.8.8 | 192.168.2.5 |
| Jul 5, 2024 00:27:17.379297018 CEST | 51629 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:17.379719019 CEST | 64085 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:17.428047895 CEST | 53 | 51629 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:17.464107990 CEST | 53 | 64085 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:19.338485956 CEST | 55282 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:19.339013100 CEST | 57294 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:19.345494986 CEST | 53 | 55282 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:19.346651077 CEST | 53 | 57294 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:22.582627058 CEST | 63294 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:22.583039045 CEST | 54070 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:22.635101080 CEST | 53 | 54070 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:22.733560085 CEST | 53 | 63294 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:22.734221935 CEST | 58523 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jul 5, 2024 00:27:22.789733887 CEST | 53 | 58523 | 1.1.1.1 | 192.168.2.5 |
| Jul 5, 2024 00:27:33.034666061 CEST | 53 | 50956 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Checksum | Code | Type |
|---|---|---|---|---|---|
| Jul 5, 2024 00:27:17.464193106 CEST | 192.168.2.5 | 1.1.1.1 | c21f | (Port unreachable) | Destination Unreachable |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jul 5, 2024 00:27:16.241494894 CEST | 192.168.2.5 | 1.1.1.1 | 0x6fec | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:16.241712093 CEST | 192.168.2.5 | 1.1.1.1 | 0xcbd7 | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 5, 2024 00:27:16.290497065 CEST | 192.168.2.5 | 1.1.1.1 | 0x2f15 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:16.361498117 CEST | 192.168.2.5 | 8.8.8.8 | 0xbac | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:16.361983061 CEST | 192.168.2.5 | 1.1.1.1 | 0xdbda | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:17.379297018 CEST | 192.168.2.5 | 1.1.1.1 | 0x255c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:17.379719019 CEST | 192.168.2.5 | 1.1.1.1 | 0x28f3 | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 5, 2024 00:27:19.338485956 CEST | 192.168.2.5 | 1.1.1.1 | 0xb97b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:19.339013100 CEST | 192.168.2.5 | 1.1.1.1 | 0xdf9 | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 5, 2024 00:27:22.582627058 CEST | 192.168.2.5 | 1.1.1.1 | 0xe6d9 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:22.583039045 CEST | 192.168.2.5 | 1.1.1.1 | 0xb566 | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 5, 2024 00:27:22.734221935 CEST | 192.168.2.5 | 1.1.1.1 | 0xaf50 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jul 5, 2024 00:27:16.289693117 CEST | 1.1.1.1 | 192.168.2.5 | 0x6fec | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:16.289711952 CEST | 1.1.1.1 | 192.168.2.5 | 0xcbd7 | Name error (3) | none | none | 65 | IN (0x0001) | false | |
| Jul 5, 2024 00:27:16.339962006 CEST | 1.1.1.1 | 192.168.2.5 | 0x2f15 | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:16.368861914 CEST | 1.1.1.1 | 192.168.2.5 | 0xdbda | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Jul 5, 2024 00:27:16.369986057 CEST | 8.8.8.8 | 192.168.2.5 | 0xbac | No error (0) | 172.217.168.14 | A (IP address) | IN (0x0001) | false | ||
| Jul 5, 2024 00:27:17.428047895 CEST | 1.1.1.1 | 192.168.2.5 | 0x255c | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:17.464107990 CEST | 1.1.1.1 | 192.168.2.5 | 0x28f3 | Name error (3) | none | none | 65 | IN (0x0001) | false | |
| Jul 5, 2024 00:27:19.345494986 CEST | 1.1.1.1 | 192.168.2.5 | 0xb97b | No error (0) | 142.250.186.100 | A (IP address) | IN (0x0001) | false | ||
| Jul 5, 2024 00:27:19.346651077 CEST | 1.1.1.1 | 192.168.2.5 | 0xdf9 | No error (0) | 65 | IN (0x0001) | false | |||
| Jul 5, 2024 00:27:22.635101080 CEST | 1.1.1.1 | 192.168.2.5 | 0xb566 | Name error (3) | none | none | 65 | IN (0x0001) | false | |
| Jul 5, 2024 00:27:22.733560085 CEST | 1.1.1.1 | 192.168.2.5 | 0xe6d9 | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:22.789733887 CEST | 1.1.1.1 | 192.168.2.5 | 0xaf50 | Name error (3) | none | none | A (IP address) | IN (0x0001) | false | |
| Jul 5, 2024 00:27:32.690001965 CEST | 1.1.1.1 | 192.168.2.5 | 0x6768 | No error (0) | fp2e7a.wpc.phicdn.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jul 5, 2024 00:27:32.690001965 CEST | 1.1.1.1 | 192.168.2.5 | 0x6768 | No error (0) | 192.229.221.95 | A (IP address) | IN (0x0001) | false |
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 0 |
| Start time: | 18:27:11 |
| Start date: | 04/07/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff715980000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 2 |
| Start time: | 18:27:13 |
| Start date: | 04/07/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff715980000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 3 |
| Start time: | 18:27:15 |
| Start date: | 04/07/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff715980000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
⊘No disassembly