Windows
Analysis Report
https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=Ne7lLAcjQUaMUQJ9C8JRxUnNOxFiqmxEvtl5lDv69HJUMDcyQThVMFBaMzdYWTM3RDY1SVZJUUVaSC4u
Overview
General Information
Detection
Score: | 48 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- chrome.exe (PID: 2300 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed "about :blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 4944 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2148 --fi eld-trial- handle=198 4,i,963238 4411519252 099,158098 6949890721 8560,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- chrome.exe (PID: 6544 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://custo mervoice.m icrosoft.c om/Pages/R esponsePag e.aspx?id= Ne7lLAcjQU aMUQJ9C8JR xUnNOxFiqm xEvtl5lDv6 9HJUMDcyQT hVMFBaMzdY WTM3RDY1SV ZJUUVaSC4u " MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
Click to jump to signature section
AV Detection |
---|
Source: | SlashNext: |
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: |
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | Classification label: |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Window detected: |
Source: | Binary or memory string: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | Path Interception | 1 Process Injection | 1 Process Injection | OS Credential Dumping | 1 Security Software Discovery | Remote Services | Data from Local System | 2 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | Application Window Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | Obfuscated Files or Information | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
100% | SlashNext | Credential Stealing type: Phishing & Social Engineering |
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
www.google.com | 172.217.19.228 | true | false | high | |
s-part-0035.t-0009.t-msedge.net | 13.107.246.63 | true | false | high | |
cdn.forms.office.net | unknown | unknown | false | high |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | unknown | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
172.217.19.228 | www.google.com | United States | 15169 | GOOGLEUS | false | |
239.255.255.250 | unknown | Reserved | unknown | unknown | false |
IP |
---|
192.168.2.4 |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1579595 |
Start date and time: | 2024-12-23 03:30:29 +01:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 3m 3s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | browseurl.jbs |
Sample URL: | https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=Ne7lLAcjQUaMUQJ9C8JRxUnNOxFiqmxEvtl5lDv69HJUMDcyQThVMFBaMzdYWTM3RDY1SVZJUUVaSC4u |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 8 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Detection: | MAL |
Classification: | mal48.win@16/43@6/3 |
EGA Information: | Failed |
HCA Information: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.206, 64.233.162.84, 172.217.17.46, 13.107.246.40, 13.107.246.69, 13.107.246.41, 13.107.253.31, 13.107.246.51, 13.107.246.57, 2.16.34.24, 104.86.110.51, 13.74.129.1, 204.79.197.237, 13.107.21.237, 199.232.210.172, 192.229.221.95, 13.69.239.77, 172.217.17.35, 184.30.17.174, 13.107.246.63, 4.245.163.56
- Not all processes where analyzed, report is missing behavior information
- VT rate limit hit for: https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=Ne7lLAcjQUaMUQJ9C8JRxUnNOxFiqmxEvtl5lDv69HJUMDcyQThVMFBaMzdYWTM3RDY1SVZJUUVaSC4u
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 213851 |
Entropy (8bit): | 5.088246037410228 |
Encrypted: | false |
SSDEEP: | 1536:1IuiHlqxqvT5Rbs+VvaHTwhW2CyUueSRboS2aaY9hiCA3:tAT5Ns+VkTwhWRq1Qaxu |
MD5: | 1E32CA6BBAFE052158A41BF5C67F5DEA |
SHA1: | B54FA24F0670E191B0CDEFEE82AE4F9C75C4FAB8 |
SHA-256: | 2AE8446022C65DEFC2BDB3B4E0760F4F1AB95D054CAC799AE33168C67C17C872 |
SHA-512: | EC615FCA5E92BDAFFC95BC589942FDC8A50A4CBD57EB70E0E9D20E3DC15733E995DC4C0F112BB28272A3A256FF43BDCDBA7914CEEBD044A6033B77098078EFB0 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/css/dist/cv-response-page.min.92870c5.css |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 369103 |
Entropy (8bit): | 5.381338995618774 |
Encrypted: | false |
SSDEEP: | 6144:dMy8G6RujcHX6MQ47GK4C/YG7jtogSPiRoUQrwYq4UKHZeSY8/sLy9:qywRuI36TCIPiRoUqKMZZ/aW |
MD5: | 6E9386843C22345A256F324692D627F2 |
SHA1: | FEF7FADB3A27032695AAB726682A340D583BFC51 |
SHA-256: | D40E9F33813211AA5DFABEEBF4A1571D488E56878954DE4D513A25B3525B3988 |
SHA-512: | C90E8A26A10AFA84C74C1D4828466E75D0FB24E826BB984EE0C50C96E44488031D4F43068614559A77967BE58E63E5BB12D3BF0999F763725BC7E1C0BF75C6BB |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 107394 |
Entropy (8bit): | 5.423584978243818 |
Encrypted: | false |
SSDEEP: | 1536:2X05mT9ntavn4MIKsjcWw1xHvWPxBaReA1wITNdJfIW:2XamBntavn4MVWw1xPlR5HTHJwW |
MD5: | A9FAF67DA30136D5F428BE56EFADDC86 |
SHA1: | EADA0F80A6723EC152F56C0C03652205E126BBDE |
SHA-256: | 31A6F00AD24FED514454D008063823AB704B87382690DF2406E020E124D40A96 |
SHA-512: | 1576643AA0C4EC3507270FC708B21871CF9520D3A1A4AA2148E4487B94D6AF6E18474FE94C99CCDDE3D99BCD147506850BCB892B76E1943300C496FAF2615158 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.1ds.e8b22bb.js |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 2765 |
Entropy (8bit): | 5.360796985586596 |
Encrypted: | false |
SSDEEP: | 48:icCVJPGKtGy7aYa9bEkW9v+KwcDAvHbZpBXzM5JaYGbELXzM2JaYGbEHecy7uQRz:+JRN5QbEkW9HDAfbZPM5JaYGbEfM2Jan |
MD5: | 5E49FA04443B3840E9F4DE7C7D25EE1D |
SHA1: | F3BA9D1731104A2791DDBA59604DAD319F28562B |
SHA-256: | F1EDE636B08818B1766E85AB3D00FECD7C5719C3EA3BB9A4DC61BE5BD775AC8A |
SHA-512: | FC9C481C3E2A7CF9AC8DE887681B5E484FF5A6434275EB9C0DD5706D6CE81F2EE0D7923BF712A811F635D3A4BF85ABFFE64A20C51C680603D7DDA2D2AF0E6632 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.quiz.4c32c58.js |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 4286 |
Entropy (8bit): | 5.790142327810594 |
Encrypted: | false |
SSDEEP: | 48:SPVe3xrp8vtSgzZwuOhNYBIakka4sSSSSgU0B/4QL/d54hUHy5c59fHIre1YHyph:SPVUBpozOsBn+4Y0B/4QhuWw29foKWw |
MD5: | EE2B357FA5FBA69AF238168E3A1A27E1 |
SHA1: | B5DD4606BEDBF1D705A01F833802248E03D01518 |
SHA-256: | 0FD813BAE48835570858A2508D9C29900B8A4CDDEBFF4A250E79AD12F8ACBDCB |
SHA-512: | EC00810F1DAD54D6036359386C7A205953CF1E8F81909471376EA7F77786BAABCF2EBB37A68CEB63531147A92080195EF64D93FE750380038E0AA00797DFCBDA |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/images/customervoice/customervoice.ico |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 31572 |
Entropy (8bit): | 5.333378143141286 |
Encrypted: | false |
SSDEEP: | 768:GJdE/g/UkYPHHAEOY/Pz+TPkoo0PsH6p91U1k8o:8UHHA4LcQe91U1kp |
MD5: | 9ACA0AFBC4561365D1DB07D88037EE53 |
SHA1: | A5DC94C7BD49DEED5C4E2FC9FA671A93ECA85766 |
SHA-256: | 31EFB5F52CD1CFAFB214D34CD7135227160302BE2022772496D8EC33FAD2E03B |
SHA-512: | FBA5CC91054F03AF253D2FA1B5D4C45A272117FC9423F37AE5C6F58A6619F6DD85EFF0DADB1516D661097C0165278F1C8DAC3478186324FA83EA700151346291 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 799726 |
Entropy (8bit): | 5.380183078880162 |
Encrypted: | false |
SSDEEP: | 6144:Ns98kk/vJAfnbZFe8rpd+z91LGAb2RkNI1M+zeO6crrFtSg9+dUAevGXuUOwcLxr:2NtfnXWBueTqw2r |
MD5: | 11A99865B8D25E480C23CD2B63F20E28 |
SHA1: | BCD35D6657DB5C064ED94312472EF1E592B8D0A6 |
SHA-256: | 3E0C2F6A344AFE5E9E3B81DA71656F8CEA6044572A5193048287D83C5A5DF94D |
SHA-512: | 7A548DF17738C359B918B717AE7EDAC4F400F9AB954EB1F3890A7AC2043162BDD6E33FEDCE55EF7516050D016B3798A7EF88F0FF53C9611F82F324E580DF9A97 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.min.5e8194d.js |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 91082 |
Entropy (8bit): | 5.304260101835755 |
Encrypted: | false |
SSDEEP: | 1536:LLi6M9GIr+b5z24bx60BWDkubX8Tahi3kpG5r+At/sEVsIOBLRhwxhh7bcfkkQCe:cFhi3kpG5XZIZ2qQCY3 |
MD5: | A557D8D7C3F63445005902EE024876E6 |
SHA1: | 6D097FFCCFBCE4270ADAE2261D4D6A511AF58754 |
SHA-256: | E2C7997DC15755E59C0DB23D2A5481AF59A26A986C19873083B0FF4995AD0B96 |
SHA-512: | 772CE0B3711057F8149617A0145167AC193BEC8009CC6282AE850A6582103E3EB89499DD460162A3C0BF693E3065E6BB20FEFC1295A9ECD0A54415915FC114D8 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 215 |
Entropy (8bit): | 4.670562668070735 |
Encrypted: | false |
SSDEEP: | 3:YAMzEjk5MIxdFPUtfvMILRNVyEUAI9iXh7JbpHRd0X3q/ATmBoWLd0XiWRKxoe6t:YAMKknfFPCFyFAI4xl1xOX3qYyOX1iE |
MD5: | 9A77D58507ECFA042FF3CE1434D67B12 |
SHA1: | C21F0E82EE775B50AA7F89411D544426B62F17BA |
SHA-256: | DA78801E32FEFD439B37F1A2F603AF11E18759FE55884BF6D61D6F523B6D81BC |
SHA-512: | 65B96AA021B3372847DCCC3A996C5DD355BFDA889528A004CA9CF65C9B910250D94C9F47AC780F9583D1D57A387255C93ADA23A626136DD370711190E552644F |
Malicious: | false |
Reputation: | low |
URL: | "https://customervoice.microsoft.com/formapi/api/2ce5ee35-2307-4641-8c51-027d0bc251c5/users/113bcd49-aa62-446c-bed9-79943bfaf472/light/runtimeForms('Ne7lLAcjQUaMUQJ9C8JRxUnNOxFiqmxEvtl5lDv69HJUMDcyQThVMFBaMzdYWTM3RDY1SVZJUUVaSC4u')?$select=id,title,modifiedDate,description,settings,background,otherInfo,questions,descriptiveQuestions,logo,category,predefinedResponses,thankYouMessage,emailReceiptEnabled,DataClassificationLabel,type,defaultLanguage,localeList,reputationTier,progressBarEnabled,tenantSwitches,privacyUrl,formsProRTTitle,formsProRTDescription,customCssFileName,footerText,conditionalThankyouMessage,cvDefaultLanguage,FormsProBranchRules,mfpBranchingData,cvSimplifiedBranchingSupported,formsProConfiguredPipes,responseThresholdCount,inviteExpiryDays,ownerUserType,surveyFont,headerFont,headerEnabled,customCSSInLineHeaderToggle,headerAltText,header,headerOtherInfo,projectGroupId,fileUploadStorage,surveyLastModifiedAt&$expand=questions($expand=choices)" |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 106767 |
Entropy (8bit): | 5.680047259595656 |
Encrypted: | false |
SSDEEP: | 1536:CO8OOQk8HuAkYcgnWaBuJY/a/tR6NgcnCoWbKxKJBmSEPgMgAzkSV/0iLinkQVaF:CO8OOQk80aQL/OWb99A4mInkQVaURBK |
MD5: | 242105D60A98B9D7EDC5A1A86FCE6644 |
SHA1: | 2D7BC903956BAC5A167BBEB32AD199C5485E2C25 |
SHA-256: | 4A3B861E7D6CEFEC3284D4C7D9FC9BC382A68D00F22ADF73450D67CBB386F50D |
SHA-512: | 96941939675A0B8E520ADC615365BD9ECDA5E0A31730499C451C4DB938661120408D1E1ADE709E07CB693AF873CF9B6D1AF34042102C69A0A030D14289E7B531 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 91082 |
Entropy (8bit): | 5.304260101835755 |
Encrypted: | false |
SSDEEP: | 1536:LLi6M9GIr+b5z24bx60BWDkubX8Tahi3kpG5r+At/sEVsIOBLRhwxhh7bcfkkQCe:cFhi3kpG5XZIZ2qQCY3 |
MD5: | A557D8D7C3F63445005902EE024876E6 |
SHA1: | 6D097FFCCFBCE4270ADAE2261D4D6A511AF58754 |
SHA-256: | E2C7997DC15755E59C0DB23D2A5481AF59A26A986C19873083B0FF4995AD0B96 |
SHA-512: | 772CE0B3711057F8149617A0145167AC193BEC8009CC6282AE850A6582103E3EB89499DD460162A3C0BF693E3065E6BB20FEFC1295A9ECD0A54415915FC114D8 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.616.93becff.js |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 107394 |
Entropy (8bit): | 5.423584978243818 |
Encrypted: | false |
SSDEEP: | 1536:2X05mT9ntavn4MIKsjcWw1xHvWPxBaReA1wITNdJfIW:2XamBntavn4MVWw1xPlR5HTHJwW |
MD5: | A9FAF67DA30136D5F428BE56EFADDC86 |
SHA1: | EADA0F80A6723EC152F56C0C03652205E126BBDE |
SHA-256: | 31A6F00AD24FED514454D008063823AB704B87382690DF2406E020E124D40A96 |
SHA-512: | 1576643AA0C4EC3507270FC708B21871CF9520D3A1A4AA2148E4487B94D6AF6E18474FE94C99CCDDE3D99BCD147506850BCB892B76E1943300C496FAF2615158 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 4286 |
Entropy (8bit): | 5.790142327810594 |
Encrypted: | false |
SSDEEP: | 48:SPVe3xrp8vtSgzZwuOhNYBIakka4sSSSSgU0B/4QL/d54hUHy5c59fHIre1YHyph:SPVUBpozOsBn+4Y0B/4QhuWw29foKWw |
MD5: | EE2B357FA5FBA69AF238168E3A1A27E1 |
SHA1: | B5DD4606BEDBF1D705A01F833802248E03D01518 |
SHA-256: | 0FD813BAE48835570858A2508D9C29900B8A4CDDEBFF4A250E79AD12F8ACBDCB |
SHA-512: | EC00810F1DAD54D6036359386C7A205953CF1E8F81909471376EA7F77786BAABCF2EBB37A68CEB63531147A92080195EF64D93FE750380038E0AA00797DFCBDA |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 528595 |
Entropy (8bit): | 5.074596954565412 |
Encrypted: | false |
SSDEEP: | 12288:hHU5EFMAKR+/rI5LsTKkw8sX9P7BePb/V6bFSDqwnZhqtRqwzXZ5HzK3DgmGNNYZ:hHU5EKAKR+/rI5LsTKkw8sX9P7BePb/b |
MD5: | 8562191137BA1917CF5887508E36853D |
SHA1: | 146F6F85316DF9BAF351440378732BB81ABF26D8 |
SHA-256: | 92AE085B781A59E40B73EFC9AC4210804DEC629F49F90ACA02FF470596AF963F |
SHA-512: | C2F22FD0937D4F1EC9C1E42D364BD39CDEC8E6D093119BDA4E28682992CD781A13CEDC1CBCF33009EF656FB0A011959B4F6923E3E3D9B913B337974EBDF885A9 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 106767 |
Entropy (8bit): | 5.680047259595656 |
Encrypted: | false |
SSDEEP: | 1536:CO8OOQk8HuAkYcgnWaBuJY/a/tR6NgcnCoWbKxKJBmSEPgMgAzkSV/0iLinkQVaF:CO8OOQk80aQL/OWb99A4mInkQVaURBK |
MD5: | 242105D60A98B9D7EDC5A1A86FCE6644 |
SHA1: | 2D7BC903956BAC5A167BBEB32AD199C5485E2C25 |
SHA-256: | 4A3B861E7D6CEFEC3284D4C7D9FC9BC382A68D00F22ADF73450D67CBB386F50D |
SHA-512: | 96941939675A0B8E520ADC615365BD9ECDA5E0A31730499C451C4DB938661120408D1E1ADE709E07CB693AF873CF9B6D1AF34042102C69A0A030D14289E7B531 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.vendors.aa37695.js |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 369103 |
Entropy (8bit): | 5.381338995618774 |
Encrypted: | false |
SSDEEP: | 6144:dMy8G6RujcHX6MQ47GK4C/YG7jtogSPiRoUQrwYq4UKHZeSY8/sLy9:qywRuI36TCIPiRoUqKMZZ/aW |
MD5: | 6E9386843C22345A256F324692D627F2 |
SHA1: | FEF7FADB3A27032695AAB726682A340D583BFC51 |
SHA-256: | D40E9F33813211AA5DFABEEBF4A1571D488E56878954DE4D513A25B3525B3988 |
SHA-512: | C90E8A26A10AFA84C74C1D4828466E75D0FB24E826BB984EE0C50C96E44488031D4F43068614559A77967BE58E63E5BB12D3BF0999F763725BC7E1C0BF75C6BB |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/scripts/vendors/combinedmin/basics_osi_v5_j3.min.14e59a0.js |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 215 |
Entropy (8bit): | 4.670562668070735 |
Encrypted: | false |
SSDEEP: | 3:YAMzEjk5MIxdFPUtfvMILRNVyEUAI9iXh7JbpHRd0X3q/ATmBoWLd0XiWRKxoe6t:YAMKknfFPCFyFAI4xl1xOX3qYyOX1iE |
MD5: | 9A77D58507ECFA042FF3CE1434D67B12 |
SHA1: | C21F0E82EE775B50AA7F89411D544426B62F17BA |
SHA-256: | DA78801E32FEFD439B37F1A2F603AF11E18759FE55884BF6D61D6F523B6D81BC |
SHA-512: | 65B96AA021B3372847DCCC3A996C5DD355BFDA889528A004CA9CF65C9B910250D94C9F47AC780F9583D1D57A387255C93ADA23A626136DD370711190E552644F |
Malicious: | false |
Reputation: | low |
URL: | https://customervoice.microsoft.com/formapi/api/2ce5ee35-2307-4641-8c51-027d0bc251c5/users/113bcd49-aa62-446c-bed9-79943bfaf472/light/runtimeForms('Ne7lLAcjQUaMUQJ9C8JRxUnNOxFiqmxEvtl5lDv69HJUMDcyQThVMFBaMzdYWTM3RDY1SVZJUUVaSC4u')?$expand=questions($expand=choices) |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 63359 |
Entropy (8bit): | 5.12221168883596 |
Encrypted: | false |
SSDEEP: | 768:hVh9K3992UNwiq3DE/NH1SHuK7Pdok8SdOFozxHQJr7K7szXlwm+pvN77hd9XO:zY2UNWDTuwLOFoVk7K7szVwF1/O |
MD5: | 7AE4934CE8DA0B569F4EE13F7624B52D |
SHA1: | D25C3D09B71D9AC0472C8832E3F7547ECE952903 |
SHA-256: | F3F402B75A352F62BB0A400BBE828E760BA509D1B4A6C29C69EEBDA56C9BADDC |
SHA-512: | AA0171205C9365A4AD18E1C3A204F0E7A09276606DEC7E4DCDED40A7F52924BDBB35CF5FDE9D2F6421984C454E58305BCBEC3CDC080A22DA789624E55744F92B |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.cachegroup-nerve.min.7d75bb5.js |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 72 |
Entropy (8bit): | 4.241202481433726 |
Encrypted: | false |
SSDEEP: | 3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY |
MD5: | 9E576E34B18E986347909C29AE6A82C6 |
SHA1: | 532C767978DC2B55854B3CA2D2DF5B4DB221C934 |
SHA-256: | 88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D |
SHA-512: | 5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 189268 |
Entropy (8bit): | 7.970160807185759 |
Encrypted: | false |
SSDEEP: | 3072:tnRe4tMyfP1zkhr5ChbLD0qS1DK4s5kAzaihcyTgesRtRkL160J9WK7tna+/z5kY:tRe4BKsJH0q0e4sPzJGy3mRkL1bLlnae |
MD5: | 7EC87557FD62038D1593C2DEE4BD024E |
SHA1: | 4D6F15D218837A915DD17E76CA6492D917D4373A |
SHA-256: | 750BF1DACAFC794F0B455281CD734C1EBE01F108E4D96286B733E60A322512C4 |
SHA-512: | 90E0A790A6D7EACD20FF0681580C638D8D062580658B7A552806A53D87CCD4AEDC3303BA2C0F4619F22D060AAE055B676BE08636321017ADCBC57BC643222E60 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/images/customervoice/designererror.png |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 13636 |
Entropy (8bit): | 7.985843089375733 |
Encrypted: | false |
SSDEEP: | 384:K51SatoYVcOmhHErxUddWunRgwh6g/SPpshoT:KG4ozO0Ee5nOc6g/SPWhS |
MD5: | FB5CF9D276C5E8FBF2A00E412A957C8D |
SHA1: | 96FF8CD5EB5D31422771ED1CA5CA37009EA843F1 |
SHA-256: | 9CAF5103422EF75DC4F09379A6F38B31693943B089129FF47CB0C4D0C621B1E2 |
SHA-512: | B7417B7E4C670CCB6B3E8512E4734B2FCEB3835BB5A80F95317017176537BE49D4D4A09256CBFC419AD9BC2C5813EF6DB55E01564EA1A9E3EB6E62BCDBD4CBD9 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/fonts/fabricmdl2icons-3.70-20201111.subset.woff2 |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 109092 |
Entropy (8bit): | 5.4064484604607514 |
Encrypted: | false |
SSDEEP: | 1536:XfDKniNuN8bBBg0oJ4ezARl/HbpWXkxkt/lNc7t/uEWzrEWsXThdH0TEMb:LLIN8bBB2yY5E4x |
MD5: | 02F0CBBF60618FEEF34460F4081679AA |
SHA1: | 712447B023A5B83BA7D9ECB81452B5B6CF82745D |
SHA-256: | 0BD8087AD441197168B6C21E6F38E704C1A4620F423ABFEC13254011AD58B194 |
SHA-512: | E229940D121D819D31A5673A64AF4FDF0EF2FFE3E5777B795CA31F7728DB9DFEC60E2DFC68086CBED2DDC112EAD019C54E8BFA77154AE4A40B7946F4DBD745C2 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 63359 |
Entropy (8bit): | 5.12221168883596 |
Encrypted: | false |
SSDEEP: | 768:hVh9K3992UNwiq3DE/NH1SHuK7Pdok8SdOFozxHQJr7K7szXlwm+pvN77hd9XO:zY2UNWDTuwLOFoVk7K7szVwF1/O |
MD5: | 7AE4934CE8DA0B569F4EE13F7624B52D |
SHA1: | D25C3D09B71D9AC0472C8832E3F7547ECE952903 |
SHA-256: | F3F402B75A352F62BB0A400BBE828E760BA509D1B4A6C29C69EEBDA56C9BADDC |
SHA-512: | AA0171205C9365A4AD18E1C3A204F0E7A09276606DEC7E4DCDED40A7F52924BDBB35CF5FDE9D2F6421984C454E58305BCBEC3CDC080A22DA789624E55744F92B |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 799726 |
Entropy (8bit): | 5.380183078880162 |
Encrypted: | false |
SSDEEP: | 6144:Ns98kk/vJAfnbZFe8rpd+z91LGAb2RkNI1M+zeO6crrFtSg9+dUAevGXuUOwcLxr:2NtfnXWBueTqw2r |
MD5: | 11A99865B8D25E480C23CD2B63F20E28 |
SHA1: | BCD35D6657DB5C064ED94312472EF1E592B8D0A6 |
SHA-256: | 3E0C2F6A344AFE5E9E3B81DA71656F8CEA6044572A5193048287D83C5A5DF94D |
SHA-512: | 7A548DF17738C359B918B717AE7EDAC4F400F9AB954EB1F3890A7AC2043162BDD6E33FEDCE55EF7516050D016B3798A7EF88F0FF53C9611F82F324E580DF9A97 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 528595 |
Entropy (8bit): | 5.074596954565412 |
Encrypted: | false |
SSDEEP: | 12288:hHU5EFMAKR+/rI5LsTKkw8sX9P7BePb/V6bFSDqwnZhqtRqwzXZ5HzK3DgmGNNYZ:hHU5EKAKR+/rI5LsTKkw8sX9P7BePb/b |
MD5: | 8562191137BA1917CF5887508E36853D |
SHA1: | 146F6F85316DF9BAF351440378732BB81ABF26D8 |
SHA-256: | 92AE085B781A59E40B73EFC9AC4210804DEC629F49F90ACA02FF470596AF963F |
SHA-512: | C2F22FD0937D4F1EC9C1E42D364BD39CDEC8E6D093119BDA4E28682992CD781A13CEDC1CBCF33009EF656FB0A011959B4F6923E3E3D9B913B337974EBDF885A9 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/scripts/dists/ls-pro.en-us.ba3db0403.js |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 31572 |
Entropy (8bit): | 5.333378143141286 |
Encrypted: | false |
SSDEEP: | 768:GJdE/g/UkYPHHAEOY/Pz+TPkoo0PsH6p91U1k8o:8UHHA4LcQe91U1kp |
MD5: | 9ACA0AFBC4561365D1DB07D88037EE53 |
SHA1: | A5DC94C7BD49DEED5C4E2FC9FA671A93ECA85766 |
SHA-256: | 31EFB5F52CD1CFAFB214D34CD7135227160302BE2022772496D8EC33FAD2E03B |
SHA-512: | FBA5CC91054F03AF253D2FA1B5D4C45A272117FC9423F37AE5C6F58A6619F6DD85EFF0DADB1516D661097C0165278F1C8DAC3478186324FA83EA700151346291 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/scripts/vendors/combinedmin/response_v2.min.ad1c4f6.js |
Preview: |
Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
File Type: | |
Category: | downloaded |
Size (bytes): | 109092 |
Entropy (8bit): | 5.4064484604607514 |
Encrypted: | false |
SSDEEP: | 1536:XfDKniNuN8bBBg0oJ4ezARl/HbpWXkxkt/lNc7t/uEWzrEWsXThdH0TEMb:LLIN8bBB2yY5E4x |
MD5: | 02F0CBBF60618FEEF34460F4081679AA |
SHA1: | 712447B023A5B83BA7D9ECB81452B5B6CF82745D |
SHA-256: | 0BD8087AD441197168B6C21E6F38E704C1A4620F423ABFEC13254011AD58B194 |
SHA-512: | E229940D121D819D31A5673A64AF4FDF0EF2FFE3E5777B795CA31F7728DB9DFEC60E2DFC68086CBED2DDC112EAD019C54E8BFA77154AE4A40B7946F4DBD745C2 |
Malicious: | false |
Reputation: | low |
URL: | https://cdn.forms.office.net/forms/scripts/dists/response-page-pro.chunk.postsubmit.ae2b319.js |
Preview: |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Dec 23, 2024 03:31:16.855143070 CET | 49675 | 443 | 192.168.2.4 | 173.222.162.32 |
Dec 23, 2024 03:31:26.457115889 CET | 49675 | 443 | 192.168.2.4 | 173.222.162.32 |
Dec 23, 2024 03:31:29.259372950 CET | 49738 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:31:29.259478092 CET | 443 | 49738 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:31:29.259555101 CET | 49738 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:31:29.259872913 CET | 49738 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:31:29.259915113 CET | 443 | 49738 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:31:30.956984997 CET | 443 | 49738 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:31:30.957501888 CET | 49738 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:31:30.957535982 CET | 443 | 49738 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:31:30.959062099 CET | 443 | 49738 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:31:30.959134102 CET | 49738 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:31:30.961083889 CET | 49738 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:31:30.961158991 CET | 443 | 49738 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:31:31.010648966 CET | 49738 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:31:31.010673046 CET | 443 | 49738 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:31:31.057565928 CET | 49738 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:31:40.650543928 CET | 443 | 49738 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:31:40.650707960 CET | 443 | 49738 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:31:40.650762081 CET | 49738 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:31:40.660990000 CET | 49738 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:31:40.661027908 CET | 443 | 49738 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:31:44.505032063 CET | 49723 | 80 | 192.168.2.4 | 199.232.214.172 |
Dec 23, 2024 03:31:44.625080109 CET | 80 | 49723 | 199.232.214.172 | 192.168.2.4 |
Dec 23, 2024 03:31:44.625205040 CET | 49723 | 80 | 192.168.2.4 | 199.232.214.172 |
Dec 23, 2024 03:32:29.183469057 CET | 49808 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:32:29.183500051 CET | 443 | 49808 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:32:29.183583975 CET | 49808 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:32:29.183810949 CET | 49808 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:32:29.183825016 CET | 443 | 49808 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:32:30.525903940 CET | 49724 | 80 | 192.168.2.4 | 199.232.214.172 |
Dec 23, 2024 03:32:30.646056890 CET | 80 | 49724 | 199.232.214.172 | 192.168.2.4 |
Dec 23, 2024 03:32:30.646301985 CET | 49724 | 80 | 192.168.2.4 | 199.232.214.172 |
Dec 23, 2024 03:32:30.880791903 CET | 443 | 49808 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:32:30.881206036 CET | 49808 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:32:30.881223917 CET | 443 | 49808 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:32:30.881688118 CET | 443 | 49808 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:32:30.882148027 CET | 49808 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:32:30.882235050 CET | 443 | 49808 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:32:30.932081938 CET | 49808 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:32:40.618065119 CET | 443 | 49808 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:32:40.618191957 CET | 443 | 49808 | 172.217.19.228 | 192.168.2.4 |
Dec 23, 2024 03:32:40.618261099 CET | 49808 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:32:41.988758087 CET | 49808 | 443 | 192.168.2.4 | 172.217.19.228 |
Dec 23, 2024 03:32:41.988784075 CET | 443 | 49808 | 172.217.19.228 | 192.168.2.4 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Dec 23, 2024 03:31:25.394732952 CET | 53 | 58407 | 1.1.1.1 | 192.168.2.4 |
Dec 23, 2024 03:31:25.399980068 CET | 53 | 61087 | 1.1.1.1 | 192.168.2.4 |
Dec 23, 2024 03:31:28.734441042 CET | 53 | 54210 | 1.1.1.1 | 192.168.2.4 |
Dec 23, 2024 03:31:29.121315956 CET | 63003 | 53 | 192.168.2.4 | 1.1.1.1 |
Dec 23, 2024 03:31:29.121551991 CET | 63527 | 53 | 192.168.2.4 | 1.1.1.1 |
Dec 23, 2024 03:31:29.257994890 CET | 53 | 63003 | 1.1.1.1 | 192.168.2.4 |
Dec 23, 2024 03:31:29.258249044 CET | 53 | 63527 | 1.1.1.1 | 192.168.2.4 |
Dec 23, 2024 03:31:33.984580994 CET | 57305 | 53 | 192.168.2.4 | 1.1.1.1 |
Dec 23, 2024 03:31:33.984814882 CET | 56894 | 53 | 192.168.2.4 | 1.1.1.1 |
Dec 23, 2024 03:31:36.681432962 CET | 64642 | 53 | 192.168.2.4 | 1.1.1.1 |
Dec 23, 2024 03:31:36.681566000 CET | 58325 | 53 | 192.168.2.4 | 1.1.1.1 |
Dec 23, 2024 03:31:42.111603975 CET | 138 | 138 | 192.168.2.4 | 192.168.2.255 |
Dec 23, 2024 03:31:45.714443922 CET | 53 | 52097 | 1.1.1.1 | 192.168.2.4 |
Dec 23, 2024 03:32:04.619908094 CET | 53 | 52971 | 1.1.1.1 | 192.168.2.4 |
Dec 23, 2024 03:32:24.635718107 CET | 53 | 56317 | 1.1.1.1 | 192.168.2.4 |
Dec 23, 2024 03:32:27.508553028 CET | 53 | 51357 | 1.1.1.1 | 192.168.2.4 |
Timestamp | Source IP | Dest IP | Checksum | Code | Type |
---|---|---|---|---|---|
Dec 23, 2024 03:31:25.489090919 CET | 192.168.2.4 | 1.1.1.1 | c233 | (Port unreachable) | Destination Unreachable |
Dec 23, 2024 03:31:38.674068928 CET | 192.168.2.4 | 1.1.1.1 | c264 | (Port unreachable) | Destination Unreachable |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Dec 23, 2024 03:31:29.121315956 CET | 192.168.2.4 | 1.1.1.1 | 0x388c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Dec 23, 2024 03:31:29.121551991 CET | 192.168.2.4 | 1.1.1.1 | 0x2980 | Standard query (0) | 65 | IN (0x0001) | false | |
Dec 23, 2024 03:31:33.984580994 CET | 192.168.2.4 | 1.1.1.1 | 0xbe0e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Dec 23, 2024 03:31:33.984814882 CET | 192.168.2.4 | 1.1.1.1 | 0xa942 | Standard query (0) | 65 | IN (0x0001) | false | |
Dec 23, 2024 03:31:36.681432962 CET | 192.168.2.4 | 1.1.1.1 | 0xd8e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Dec 23, 2024 03:31:36.681566000 CET | 192.168.2.4 | 1.1.1.1 | 0xb9bf | Standard query (0) | 65 | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Dec 23, 2024 03:31:29.257994890 CET | 1.1.1.1 | 192.168.2.4 | 0x388c | No error (0) | 172.217.19.228 | A (IP address) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:29.258249044 CET | 1.1.1.1 | 192.168.2.4 | 0x2980 | No error (0) | 65 | IN (0x0001) | false | |||
Dec 23, 2024 03:31:34.554589987 CET | 1.1.1.1 | 192.168.2.4 | 0xa942 | No error (0) | cdn.forms.office.net.edgesuite.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:34.571707010 CET | 1.1.1.1 | 192.168.2.4 | 0xbe0e | No error (0) | cdn.forms.office.net.edgesuite.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:36.818368912 CET | 1.1.1.1 | 192.168.2.4 | 0xd8e | No error (0) | cdn.forms.office.net.edgesuite.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:36.820461035 CET | 1.1.1.1 | 192.168.2.4 | 0xb9bf | No error (0) | cdn.forms.office.net.edgesuite.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:38.126202106 CET | 1.1.1.1 | 192.168.2.4 | 0x4919 | No error (0) | azurefd-t-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:38.239161015 CET | 1.1.1.1 | 192.168.2.4 | 0xa751 | No error (0) | azurefd-t-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:38.239161015 CET | 1.1.1.1 | 192.168.2.4 | 0xa751 | No error (0) | s-part-0035.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:38.239161015 CET | 1.1.1.1 | 192.168.2.4 | 0xa751 | No error (0) | 13.107.246.63 | A (IP address) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:38.467082024 CET | 1.1.1.1 | 192.168.2.4 | 0x3bf4 | No error (0) | c-msn-com-nsatc.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:38.672312975 CET | 1.1.1.1 | 192.168.2.4 | 0xdf8 | No error (0) | c-msn-com-nsatc.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:45.145674944 CET | 1.1.1.1 | 192.168.2.4 | 0x99b6 | No error (0) | c-msn-com-nsatc.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:31:45.146492004 CET | 1.1.1.1 | 192.168.2.4 | 0xb336 | No error (0) | c-msn-com-nsatc.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:32:40.388210058 CET | 1.1.1.1 | 192.168.2.4 | 0xbedf | No error (0) | azurefd-t-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:32:40.460253000 CET | 1.1.1.1 | 192.168.2.4 | 0xa29e | No error (0) | azurefd-t-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:32:40.460253000 CET | 1.1.1.1 | 192.168.2.4 | 0xa29e | No error (0) | s-part-0035.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 23, 2024 03:32:40.460253000 CET | 1.1.1.1 | 192.168.2.4 | 0xa29e | No error (0) | 13.107.246.63 | A (IP address) | IN (0x0001) | false |
Click to jump to process
Click to jump to process
Click to jump to process
Target ID: | 0 |
Start time: | 21:31:20 |
Start date: | 22/12/2024 |
Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff76e190000 |
File size: | 3'242'272 bytes |
MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | false |
Target ID: | 2 |
Start time: | 21:31:22 |
Start date: | 22/12/2024 |
Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff76e190000 |
File size: | 3'242'272 bytes |
MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | false |
Target ID: | 3 |
Start time: | 21:31:29 |
Start date: | 22/12/2024 |
Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff76e190000 |
File size: | 3'242'272 bytes |
MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | true |