Windows
Analysis Report
https://meettamaskloginn.webflow.io/
Overview
General Information
Detection
Score: | 52 |
Range: | 0 - 100 |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
chrome.exe (PID: 5468 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --s tart-maxim ized "abou t:blank" MD5: E81F54E6C1129887AEA47E7D092680BF) chrome.exe (PID: 5300 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --no-pre-r ead-main-d ll --field -trial-han dle=2328,i ,169809969 7985951924 3,14519546 1949993234 46,262144 --disable- features=O ptimizatio nGuideMode lDownloadi ng,Optimiz ationHints ,Optimizat ionHintsFe tching,Opt imizationT argetPredi ction --va riations-s eed-versio n=20250306 -183004.42 9000 --moj o-platform -channel-h andle=2356 /prefetch :3 MD5: E81F54E6C1129887AEA47E7D092680BF)
chrome.exe (PID: 6840 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://meett amasklogin n.webflow. io/" MD5: E81F54E6C1129887AEA47E7D092680BF)
- cleanup
- • AV Detection
- • Phishing
- • Networking
- • System Summary
Click to jump to signature section
AV Detection |
---|
Source: | Avira URL Cloud: |
Phishing |
---|
Source: | Joe Sandbox AI: |
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: |
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | Classification label: |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 Browser Extensions | 1 Process Injection | 1 Process Injection | OS Credential Dumping | System Service Discovery | Remote Services | Data from Local System | 2 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | Application Window Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | Obfuscated Files or Information | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
100% | Avira URL Cloud | phishing |
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
meettamaskloginn.webflow.io | 104.18.36.248 | true | true | unknown | |
www.google.com | 142.250.185.132 | true | false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
104.18.36.248 | meettamaskloginn.webflow.io | United States | 13335 | CLOUDFLARENETUS | true | |
142.250.185.132 | www.google.com | United States | 15169 | GOOGLEUS | false |
IP |
---|
192.168.2.15 |
192.168.2.4 |
Joe Sandbox version: | 42.0.0 Malachite |
Analysis ID: | 1637937 |
Start date and time: | 2025-03-14 01:24:52 +01:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 1m 58s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | browseurl.jbs |
Sample URL: | https://meettamaskloginn.webflow.io/ |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 18 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Detection: | MAL |
Classification: | mal52.win@22/0@4/4 |
EGA Information: | Failed |
HCA Information: |
|
Cookbook Comments: |
|
- URL not reachable
- Exclude process from analysis
(whitelisted): audiodg.exe, Ru ntimeBroker.exe, ShellExperien ceHost.exe, SIHClient.exe, Sgr mBroker.exe, backgroundTaskHos t.exe, svchost.exe - Excluded IPs from analysis (wh
itelisted): 142.250.186.174, 1 42.250.185.163, 216.58.212.174 , 74.125.206.84, 199.232.210.1 72, 184.30.131.245 - Excluded domains from analysis
(whitelisted): fs.microsoft.c om, clients2.google.com, ocsp. digicert.com, accounts.google. com, slscr.update.microsoft.co m, ctldl.windowsupdate.com, cl ientservices.googleapis.com, c lients.l.google.com, fe3cr.del ivery.mp.microsoft.com - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtOpenFile calls found . - VT rate limit hit for: https:
//meettamaskloginn.webflow.io/
Download Network PCAP: filtered – full
- Total Packets: 127
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Mar 14, 2025 01:25:50.542083025 CET | 49671 | 443 | 192.168.2.4 | 204.79.197.203 |
Mar 14, 2025 01:25:50.854146957 CET | 49671 | 443 | 192.168.2.4 | 204.79.197.203 |
Mar 14, 2025 01:25:51.463560104 CET | 49671 | 443 | 192.168.2.4 | 204.79.197.203 |
Mar 14, 2025 01:25:52.666914940 CET | 49671 | 443 | 192.168.2.4 | 204.79.197.203 |
Mar 14, 2025 01:25:52.676812887 CET | 49723 | 443 | 192.168.2.4 | 142.250.185.132 |
Mar 14, 2025 01:25:52.676862955 CET | 443 | 49723 | 142.250.185.132 | 192.168.2.4 |
Mar 14, 2025 01:25:52.677232027 CET | 49723 | 443 | 192.168.2.4 | 142.250.185.132 |
Mar 14, 2025 01:25:52.677340031 CET | 49723 | 443 | 192.168.2.4 | 142.250.185.132 |
Mar 14, 2025 01:25:52.677350998 CET | 443 | 49723 | 142.250.185.132 | 192.168.2.4 |
Mar 14, 2025 01:25:52.877433062 CET | 443 | 49723 | 142.250.185.132 | 192.168.2.4 |
Mar 14, 2025 01:25:52.878205061 CET | 49725 | 443 | 192.168.2.4 | 142.250.185.132 |
Mar 14, 2025 01:25:52.878226042 CET | 443 | 49725 | 142.250.185.132 | 192.168.2.4 |
Mar 14, 2025 01:25:52.878401995 CET | 49725 | 443 | 192.168.2.4 | 142.250.185.132 |
Mar 14, 2025 01:25:52.878685951 CET | 49725 | 443 | 192.168.2.4 | 142.250.185.132 |
Mar 14, 2025 01:25:52.878695011 CET | 443 | 49725 | 142.250.185.132 | 192.168.2.4 |
Mar 14, 2025 01:25:53.077471972 CET | 443 | 49725 | 142.250.185.132 | 192.168.2.4 |
Mar 14, 2025 01:25:53.761358023 CET | 49727 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.761405945 CET | 443 | 49727 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:53.761492968 CET | 49727 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.761724949 CET | 49728 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.761773109 CET | 443 | 49728 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:53.761841059 CET | 49728 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.762105942 CET | 49727 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.762116909 CET | 443 | 49727 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:53.762528896 CET | 49728 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.762542963 CET | 443 | 49728 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:53.961375952 CET | 443 | 49728 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:53.961385012 CET | 443 | 49727 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:53.962122917 CET | 49729 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.962158918 CET | 443 | 49729 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:53.962234974 CET | 49729 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.962578058 CET | 49730 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.962596893 CET | 443 | 49730 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:53.962963104 CET | 49729 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.962975979 CET | 443 | 49729 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:53.963015079 CET | 49730 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.963310003 CET | 49730 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:53.963320017 CET | 443 | 49730 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:54.161209106 CET | 443 | 49729 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:54.161509037 CET | 443 | 49730 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.073429108 CET | 49671 | 443 | 192.168.2.4 | 204.79.197.203 |
Mar 14, 2025 01:25:55.212699890 CET | 49736 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.212759972 CET | 443 | 49736 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.212836027 CET | 49736 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.212990999 CET | 49737 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.213053942 CET | 443 | 49737 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.213109970 CET | 49737 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.213442087 CET | 49736 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.213454962 CET | 443 | 49736 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.213819027 CET | 49737 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.213834047 CET | 443 | 49737 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.413417101 CET | 443 | 49736 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.413933992 CET | 49739 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.413978100 CET | 443 | 49739 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.414056063 CET | 49739 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.414181948 CET | 443 | 49737 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.414411068 CET | 49739 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.414424896 CET | 443 | 49739 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.414947987 CET | 49740 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.414978981 CET | 443 | 49740 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.415040016 CET | 49740 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.415343046 CET | 49740 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:25:55.415359020 CET | 443 | 49740 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.613255978 CET | 443 | 49739 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:55.613938093 CET | 443 | 49740 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:25:58.940788984 CET | 49742 | 443 | 192.168.2.4 | 23.60.203.209 |
Mar 14, 2025 01:25:58.940838099 CET | 443 | 49742 | 23.60.203.209 | 192.168.2.4 |
Mar 14, 2025 01:25:58.940917969 CET | 49742 | 443 | 192.168.2.4 | 23.60.203.209 |
Mar 14, 2025 01:25:58.955763102 CET | 49742 | 443 | 192.168.2.4 | 23.60.203.209 |
Mar 14, 2025 01:25:58.955780029 CET | 443 | 49742 | 23.60.203.209 | 192.168.2.4 |
Mar 14, 2025 01:25:58.956418991 CET | 443 | 49742 | 23.60.203.209 | 192.168.2.4 |
Mar 14, 2025 01:25:58.961325884 CET | 49743 | 443 | 192.168.2.4 | 23.60.203.209 |
Mar 14, 2025 01:25:58.961364031 CET | 443 | 49743 | 23.60.203.209 | 192.168.2.4 |
Mar 14, 2025 01:25:58.961438894 CET | 49743 | 443 | 192.168.2.4 | 23.60.203.209 |
Mar 14, 2025 01:25:58.961847067 CET | 49743 | 443 | 192.168.2.4 | 23.60.203.209 |
Mar 14, 2025 01:25:58.961854935 CET | 443 | 49743 | 23.60.203.209 | 192.168.2.4 |
Mar 14, 2025 01:25:58.962260962 CET | 443 | 49743 | 23.60.203.209 | 192.168.2.4 |
Mar 14, 2025 01:25:58.962616920 CET | 49744 | 443 | 192.168.2.4 | 23.60.203.209 |
Mar 14, 2025 01:25:58.962651968 CET | 443 | 49744 | 23.60.203.209 | 192.168.2.4 |
Mar 14, 2025 01:25:58.962713003 CET | 49744 | 443 | 192.168.2.4 | 23.60.203.209 |
Mar 14, 2025 01:25:58.966231108 CET | 49744 | 443 | 192.168.2.4 | 23.60.203.209 |
Mar 14, 2025 01:25:58.966265917 CET | 443 | 49744 | 23.60.203.209 | 192.168.2.4 |
Mar 14, 2025 01:25:58.966315031 CET | 49744 | 443 | 192.168.2.4 | 23.60.203.209 |
Mar 14, 2025 01:25:59.308350086 CET | 49678 | 443 | 192.168.2.4 | 20.189.173.27 |
Mar 14, 2025 01:25:59.620529890 CET | 49678 | 443 | 192.168.2.4 | 20.189.173.27 |
Mar 14, 2025 01:25:59.901808977 CET | 49671 | 443 | 192.168.2.4 | 204.79.197.203 |
Mar 14, 2025 01:26:00.245462894 CET | 49678 | 443 | 192.168.2.4 | 20.189.173.27 |
Mar 14, 2025 01:26:00.582534075 CET | 49709 | 443 | 192.168.2.4 | 131.253.33.254 |
Mar 14, 2025 01:26:00.587342978 CET | 443 | 49709 | 131.253.33.254 | 192.168.2.4 |
Mar 14, 2025 01:26:00.668946028 CET | 49745 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.669019938 CET | 443 | 49745 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:00.669109106 CET | 49745 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.669162035 CET | 49746 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.669245005 CET | 443 | 49746 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:00.669605970 CET | 49746 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.670731068 CET | 49745 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.670746088 CET | 443 | 49745 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:00.671211004 CET | 49746 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.671226978 CET | 443 | 49746 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:00.686641932 CET | 443 | 49709 | 131.253.33.254 | 192.168.2.4 |
Mar 14, 2025 01:26:00.686662912 CET | 443 | 49709 | 131.253.33.254 | 192.168.2.4 |
Mar 14, 2025 01:26:00.686676979 CET | 443 | 49709 | 131.253.33.254 | 192.168.2.4 |
Mar 14, 2025 01:26:00.686686993 CET | 443 | 49709 | 131.253.33.254 | 192.168.2.4 |
Mar 14, 2025 01:26:00.686700106 CET | 443 | 49709 | 131.253.33.254 | 192.168.2.4 |
Mar 14, 2025 01:26:00.686698914 CET | 49709 | 443 | 192.168.2.4 | 131.253.33.254 |
Mar 14, 2025 01:26:00.686711073 CET | 443 | 49709 | 131.253.33.254 | 192.168.2.4 |
Mar 14, 2025 01:26:00.686732054 CET | 49709 | 443 | 192.168.2.4 | 131.253.33.254 |
Mar 14, 2025 01:26:00.686779976 CET | 49709 | 443 | 192.168.2.4 | 131.253.33.254 |
Mar 14, 2025 01:26:00.869170904 CET | 443 | 49746 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:00.869853020 CET | 443 | 49745 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:00.869957924 CET | 49748 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.869988918 CET | 443 | 49748 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:00.870055914 CET | 49748 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.870275974 CET | 49749 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.870323896 CET | 443 | 49749 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:00.870429993 CET | 49749 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.870618105 CET | 49748 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.870632887 CET | 443 | 49748 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:00.872343063 CET | 49749 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:00.872359037 CET | 443 | 49749 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.069602013 CET | 443 | 49748 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.073436975 CET | 443 | 49749 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.370090961 CET | 49681 | 80 | 192.168.2.4 | 2.17.190.73 |
Mar 14, 2025 01:26:01.428108931 CET | 49751 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.428167105 CET | 443 | 49751 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.428323030 CET | 49751 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.428734064 CET | 49752 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.428785086 CET | 443 | 49752 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.429379940 CET | 49752 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.431391954 CET | 49751 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.431406975 CET | 443 | 49751 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.434529066 CET | 49752 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.434555054 CET | 443 | 49752 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.451849937 CET | 49678 | 443 | 192.168.2.4 | 20.189.173.27 |
Mar 14, 2025 01:26:01.629553080 CET | 443 | 49751 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.630249977 CET | 49753 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.630345106 CET | 443 | 49753 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.630431890 CET | 49753 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.630752087 CET | 49753 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.630793095 CET | 443 | 49753 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.633164883 CET | 443 | 49752 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.633698940 CET | 49754 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.633733988 CET | 443 | 49754 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.633805037 CET | 49754 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.634073973 CET | 49754 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:01.634088993 CET | 443 | 49754 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.683098078 CET | 49681 | 80 | 192.168.2.4 | 2.17.190.73 |
Mar 14, 2025 01:26:01.829184055 CET | 443 | 49753 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:01.834731102 CET | 443 | 49754 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:02.292418957 CET | 49681 | 80 | 192.168.2.4 | 2.17.190.73 |
Mar 14, 2025 01:26:02.893702030 CET | 49757 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.893759012 CET | 443 | 49757 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.893841982 CET | 49757 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.895453930 CET | 49757 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.895463943 CET | 443 | 49757 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.896104097 CET | 443 | 49757 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.916189909 CET | 49758 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.916240931 CET | 443 | 49758 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.916330099 CET | 49758 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.916728020 CET | 49758 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.916742086 CET | 443 | 49758 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.917453051 CET | 443 | 49758 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.966711998 CET | 49759 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.966762066 CET | 443 | 49759 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.966845036 CET | 49759 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.967312098 CET | 49759 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.967325926 CET | 443 | 49759 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.967959881 CET | 443 | 49759 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.987828016 CET | 49761 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.987869978 CET | 443 | 49761 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.988059044 CET | 49761 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.988475084 CET | 49761 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:02.988490105 CET | 443 | 49761 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:02.989129066 CET | 443 | 49761 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.010812998 CET | 49762 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.010863066 CET | 443 | 49762 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.011096954 CET | 49762 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.012214899 CET | 49762 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.012228012 CET | 443 | 49762 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.012860060 CET | 443 | 49762 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.028640032 CET | 49763 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.028681993 CET | 443 | 49763 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.028758049 CET | 49763 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.029335022 CET | 49763 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.029346943 CET | 443 | 49763 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.029939890 CET | 443 | 49763 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.045236111 CET | 49764 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.045284986 CET | 443 | 49764 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.045365095 CET | 49764 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.045810938 CET | 49764 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.045824051 CET | 443 | 49764 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.046412945 CET | 443 | 49764 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.063148022 CET | 49765 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.063193083 CET | 443 | 49765 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.063290119 CET | 49765 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.063741922 CET | 49765 | 443 | 192.168.2.4 | 20.12.23.50 |
Mar 14, 2025 01:26:03.063755989 CET | 443 | 49765 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.064296007 CET | 443 | 49765 | 20.12.23.50 | 192.168.2.4 |
Mar 14, 2025 01:26:03.495418072 CET | 49681 | 80 | 192.168.2.4 | 2.17.190.73 |
Mar 14, 2025 01:26:03.856183052 CET | 49678 | 443 | 192.168.2.4 | 20.189.173.27 |
Mar 14, 2025 01:26:05.901216984 CET | 49681 | 80 | 192.168.2.4 | 2.17.190.73 |
Mar 14, 2025 01:26:08.666829109 CET | 49678 | 443 | 192.168.2.4 | 20.189.173.27 |
Mar 14, 2025 01:26:09.511586905 CET | 49671 | 443 | 192.168.2.4 | 204.79.197.203 |
Mar 14, 2025 01:26:10.281066895 CET | 49767 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.281117916 CET | 443 | 49767 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.281141996 CET | 49768 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.281196117 CET | 443 | 49768 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.281235933 CET | 49767 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.281639099 CET | 49767 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.281653881 CET | 443 | 49767 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.281713009 CET | 49768 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.286245108 CET | 49768 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.286267042 CET | 443 | 49768 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.485847950 CET | 443 | 49768 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.487657070 CET | 49769 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.487703085 CET | 443 | 49769 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.487915993 CET | 49769 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.488390923 CET | 49769 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.488409996 CET | 443 | 49769 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.489320040 CET | 443 | 49767 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.489789963 CET | 49770 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.489825010 CET | 443 | 49770 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.490425110 CET | 49770 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.490716934 CET | 49770 | 443 | 192.168.2.4 | 104.18.36.248 |
Mar 14, 2025 01:26:10.490731955 CET | 443 | 49770 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.689923048 CET | 443 | 49770 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.690006018 CET | 443 | 49769 | 104.18.36.248 | 192.168.2.4 |
Mar 14, 2025 01:26:10.703061104 CET | 49681 | 80 | 192.168.2.4 | 2.17.190.73 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Mar 14, 2025 01:25:48.538738012 CET | 53 | 54421 | 1.1.1.1 | 192.168.2.4 |
Mar 14, 2025 01:25:48.611469030 CET | 53 | 53848 | 1.1.1.1 | 192.168.2.4 |
Mar 14, 2025 01:25:52.668553114 CET | 50718 | 53 | 192.168.2.4 | 1.1.1.1 |
Mar 14, 2025 01:25:52.668553114 CET | 55581 | 53 | 192.168.2.4 | 1.1.1.1 |
Mar 14, 2025 01:25:52.675201893 CET | 53 | 50718 | 1.1.1.1 | 192.168.2.4 |
Mar 14, 2025 01:25:52.675817013 CET | 53 | 55581 | 1.1.1.1 | 192.168.2.4 |
Mar 14, 2025 01:25:53.749475956 CET | 58253 | 53 | 192.168.2.4 | 1.1.1.1 |
Mar 14, 2025 01:25:53.749735117 CET | 51556 | 53 | 192.168.2.4 | 1.1.1.1 |
Mar 14, 2025 01:25:53.759175062 CET | 53 | 58253 | 1.1.1.1 | 192.168.2.4 |
Mar 14, 2025 01:25:53.759854078 CET | 53 | 51556 | 1.1.1.1 | 192.168.2.4 |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Mar 14, 2025 01:25:52.668553114 CET | 192.168.2.4 | 1.1.1.1 | 0xb205 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Mar 14, 2025 01:25:52.668553114 CET | 192.168.2.4 | 1.1.1.1 | 0xc537 | Standard query (0) | 65 | IN (0x0001) | false | |
Mar 14, 2025 01:25:53.749475956 CET | 192.168.2.4 | 1.1.1.1 | 0xb802 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Mar 14, 2025 01:25:53.749735117 CET | 192.168.2.4 | 1.1.1.1 | 0x59c4 | Standard query (0) | 65 | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Mar 14, 2025 01:25:52.675201893 CET | 1.1.1.1 | 192.168.2.4 | 0xb205 | No error (0) | 142.250.185.132 | A (IP address) | IN (0x0001) | false | ||
Mar 14, 2025 01:25:52.675817013 CET | 1.1.1.1 | 192.168.2.4 | 0xc537 | No error (0) | 65 | IN (0x0001) | false | |||
Mar 14, 2025 01:25:53.759175062 CET | 1.1.1.1 | 192.168.2.4 | 0xb802 | No error (0) | 104.18.36.248 | A (IP address) | IN (0x0001) | false | ||
Mar 14, 2025 01:25:53.759175062 CET | 1.1.1.1 | 192.168.2.4 | 0xb802 | No error (0) | 172.64.151.8 | A (IP address) | IN (0x0001) | false | ||
Mar 14, 2025 01:25:53.759854078 CET | 1.1.1.1 | 192.168.2.4 | 0x59c4 | No error (0) | 65 | IN (0x0001) | false |
Click to jump to process
Click to jump to process
Click to jump to process
Target ID: | 1 |
Start time: | 20:25:43 |
Start date: | 13/03/2025 |
Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff786830000 |
File size: | 3'388'000 bytes |
MD5 hash: | E81F54E6C1129887AEA47E7D092680BF |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | false |
Target ID: | 2 |
Start time: | 20:25:46 |
Start date: | 13/03/2025 |
Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff786830000 |
File size: | 3'388'000 bytes |
MD5 hash: | E81F54E6C1129887AEA47E7D092680BF |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | false |
Target ID: | 4 |
Start time: | 20:25:52 |
Start date: | 13/03/2025 |
Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff786830000 |
File size: | 3'388'000 bytes |
MD5 hash: | E81F54E6C1129887AEA47E7D092680BF |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | true |