Play interactive tour
Edit tourAnalysis Report Request for Quotation via ShipServ 7465649870 RFQ).ppt
Overview
General Information
| Sample Name: | Request for Quotation via ShipServ 7465649870 RFQ).ppt |
| Analysis ID: | 363657 |
| MD5: | e4405847f94ce7a7ff1cf42754030467 |
| SHA1: | 3c183881bab3a09576a24da6c6aceaf106e97f1b |
| SHA256: | bc692c42c9c300e9ea559d6cdd74239d85339b60918b1c712db7078c1298421a |
| Infos: | |
Most interesting Screenshot:  | |
Detection
| Score: | 92 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to a URL shortener service
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA with hexadecimal encoded strings
Document exploit detected (process start blacklist hit)
Sigma detected: Microsoft Office Product Spawning Windows Shell
Uses ping.exe to check the status of other devices and networks
Allocates a big amount of memory (probably used for heap spraying)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
Startup |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
| No yara matches |
|---|
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: | ||
Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Antivirus / Scanner detection for submitted sample | Show sources | ||
| Source: | Avira: | ||
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | Metadefender: | Perma Link | ||
| Source: | ReversingLabs: | |||
Compliance: | |
|---|
| Uses new MSVCR Dlls | Show sources | ||
| Source: | File opened: | ||
| Uses secure TLS version for HTTPS connections | Show sources | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
Software Vulnerabilities: | |
|---|
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | ||
| Source: | Memory has grown: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
Networking: | |
|---|
| Connects to a URL shortener service | Show sources | ||
| Source: | DNS query: | ||
| Uses ping.exe to check the status of other devices and networks | Show sources | ||
| Source: | Process created: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTP traffic detected: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Window created: | ||
System Summary: | |
|---|
| Document contains an embedded VBA macro which may execute processes | Show sources | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro line: | ||
| Document contains an embedded VBA with hexadecimal encoded strings | Show sources | ||
| Source: | Stream path 'VBA/Module3' : | ||
| Source: | Code function: | ||
| Source: | OLE, VBA macro line: | ||
| Source: | OLE, VBA macro: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | OLE stream indicators for Word, Excel, PowerPoint, and Visio: | ||
| Source: | Key opened: | ||
| Source: | Binary or memory string: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | WMI Queries: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Metadefender: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Key value queried: | ||
| Source: | Key opened: | ||
| Source: | Window detected: | ||
| Source: | Key opened: | ||
| Source: | File opened: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
Boot Survival: | |
|---|
| Creates an autostart registry key pointing to binary in C:\Windows | Show sources | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Creates autostart registry keys with suspicious values (likely registry only malware) | Show sources | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Creates multiple autostart registry keys | Show sources | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry key monitored for changes: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Thread sleep time: | ||
| Source: | Memory protected: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Queries volume information: | ||
| Source: | Queries volume information: | ||
| Source: | Queries volume information: | ||
| Source: | Queries volume information: | ||
| Source: | Queries volume information: | ||
| Source: | Queries volume information: | ||
| Source: | Queries volume information: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Spearphishing Link1 | Windows Management Instrumentation1 | Registry Run Keys / Startup Folder31 | Process Injection11 | Masquerading1 | OS Credential Dumping | Query Registry1 | Remote Services | Email Collection1 | Exfiltration Over Other Network Medium | Encrypted Channel12 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Scripting22 | Boot or Logon Initialization Scripts | Registry Run Keys / Startup Folder31 | Virtualization/Sandbox Evasion1 | LSASS Memory | Virtualization/Sandbox Evasion1 | Remote Desktop Protocol | Archive Collected Data1 | Exfiltration Over Bluetooth | Ingress Tool Transfer2 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | Exploitation for Client Execution13 | Logon Script (Windows) | Extra Window Memory Injection1 | Disable or Modify Tools1 | Security Account Manager | Remote System Discovery11 | SMB/Windows Admin Shares | Clipboard Data1 | Automated Exfiltration | Non-Application Layer Protocol2 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Process Injection11 | NTDS | System Network Configuration Discovery1 | Distributed Component Object Model | Input Capture | Scheduled Transfer | Application Layer Protocol13 | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Scripting22 | LSA Secrets | File and Directory Discovery1 | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | Obfuscated Files or Information1 | Cached Domain Credentials | System Information Discovery14 | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features | |
| External Remote Services | Scheduled Task | Startup Items | Startup Items | Extra Window Memory Injection1 | DCSync | Network Sniffing | Windows Remote Management | Web Portal Capture | Exfiltration Over Alternative Protocol | Commonly Used Port | Rogue Wi-Fi Access Points | Data Encrypted for Impact |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 30% | Metadefender | Browse | ||
| 62% | ReversingLabs | Script-Macro.Trojan.Valyria | ||
| 100% | Avira | HEUR/Macro.Downloader.MRKI.Gen |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
| No Antivirus matches |
|---|
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| blogspot.l.googleusercontent.com | 216.58.207.129 | true | false | high | |
| onedrive.linkpc.net | 192.254.74.210 | true | false | high | |
| ia801404.us.archive.org | 207.241.228.144 | true | false | high | |
| j.mp | 67.199.248.17 | true | true | unknown | |
| ia801502.us.archive.org | 207.241.228.152 | true | false | high | |
| linkpc.net | 67.214.175.69 | true | false | high | |
| ghostbackbone123.blogspot.com | unknown | unknown | false | high | |
| startthepartyup.blogspot.com | unknown | unknown | false | high | |
| backbones1234511a.blogspot.com | unknown | unknown | false | high | |
| randikhanaekminar.blogspot.com | unknown | unknown | false | high | |
| mysensesaredead.blogspot.com | unknown | unknown | false | high | |
| www.blogger.com | unknown | unknown | false | high | |
| resources.blogblog.com | unknown | unknown | false | high |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| low | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high |
Contacted IPs |
|---|
General Information |
|---|
| Joe Sandbox Version: | 31.0.0 Emerald |
| Analysis ID: | 363657 |
| Start date: | 05.03.2021 |
| Start time: | 02:28:18 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 6m 2s |
| Hypervisor based Inspection enabled: | false |
| Report type: | light |
| Sample file name: | Request for Quotation via ShipServ 7465649870 RFQ).ppt |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2) |
| Number of analysed new started processes analysed: | 40 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal92.troj.expl.winPPT@44/24@40/3 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| Time | Type | Description |
|---|---|---|
| 02:28:44 | API Interceptor | |
| 02:30:35 | Autostart |
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 67.199.248.17 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| j.mp | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| linkpc.net | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| onedrive.linkpc.net | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| GOOGLE-PRIVATE-CLOUDUS | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 7dcce5b76c8b17472d024758970a406b | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3812 |
| Entropy (8bit): | 5.167428807218489 |
| Encrypted: | false |
| SSDEEP: | 96:Tpnj64Z4HufeAA4DhRXRBd031AkDhRXRBd039YAH/hv:xjnRfp |
| MD5: | B3E61DF6E41A93485461F77324FCD93E |
| SHA1: | 46EFB1044FF1CB854E02BCB49ADA1D501CE0AFF4 |
| SHA-256: | 0FC52EF116F03FD95F9857856F1E2CBDFA2CACC398E066DB0D8D5481739BC2D7 |
| SHA-512: | 2CEB087B5B5122A2CDC6EDF8CC0613A8F2671091E8524C8E8F312BDCF39A494FD260F84E0C8EFAD1A09738DF4896C6C39964B3A26463628398D6111DBE68AB3C |
| Malicious: | false |
| IE Cache URL: | https://www.blogger.com/static/v1/v-css/281434096-static_pages.css |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 36990 |
| Entropy (8bit): | 5.156709527997923 |
| Encrypted: | false |
| SSDEEP: | 384:B0OhFvg3AwN6VysImDyPWquJMpx/SCYW0bS8+Rl9yapwuJ86YKSQCNL/J69nag9N:B0Oh+/N6nIm6IvW0ErVJwxgngRdFr2 |
| MD5: | 0BEF7C3D549CA15E5FE23315FC211990 |
| SHA1: | 28E3A4693A8F0212850A38303A037A6DDBC14D2E |
| SHA-256: | C91AFADBE63DD834AAC00B49BC715795DA58970E7D500C4BD8F50ED713C77880 |
| SHA-512: | 6A255013A987FFFAE23B8AF3A19471CBC4E51F747F41E1341596829FB3316B74882B43F281A9F0741FAEC345F92C6A784EE6C9BEB28D23F211D099D32C597961 |
| Malicious: | false |
| IE Cache URL: | https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 146912 |
| Entropy (8bit): | 5.5646947417374975 |
| Encrypted: | false |
| SSDEEP: | 1536:Ltzv4flsEWe9MKEf35Z89PTjZ+oeBzKvosWsJj6yYyG5br9Wn0StLqSEE4bBsXML:5v893Z0zKplcO0Sb4uW+a |
| MD5: | FF8ED927B00BF1C4200B107744A7D02B |
| SHA1: | F65354D683457A3AF378B0AADA5CA191FB11AE64 |
| SHA-256: | 68B924795300F45FCA9372150C9C12ADF42AEABCE707597C00EEA2D9CA2DA923 |
| SHA-512: | 6717ACD0586080154D7B7CAF6588FB9AF20311FE8DCDE925C2E99247CA0AEE43688E51ABA2A49B74D12C6D516EC1FE85B6E84EA7BA404ED2593496868413FE2E |
| Malicious: | false |
| IE Cache URL: | https://www.blogger.com/static/v1/widgets/629644797-widgets.js |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 162 |
| Entropy (8bit): | 6.20718596834588 |
| Encrypted: | false |
| SSDEEP: | 3:CUS9n21IZClSWEj5QQxlEGsSZpZcYES9XfLvlcDdcpFXn:HS9nSIUlSlNQQjEGsSJcYEowdcrX |
| MD5: | C991641178FF05ADF0D004298B5EAFA9 |
| SHA1: | D8F6CE8ECD92B86D49849360F6B81CEB10B4C941 |
| SHA-256: | CA9848E6006CFEC8F9FFA29433ADE8152204BDB95579200831C6DC0F53DFF70B |
| SHA-512: | 6A845A5DB1F1388DF00F09FDE3787C5A8846C4F1F8041476BC011553821F9BD90FB2937AC10BE45EB5DD1749105CCD4F7339FAA044ECC7386CAF9B59B374EB3B |
| Malicious: | false |
| IE Cache URL: | https://resources.blogblog.com/img/icon18_edit_allbkg.gif |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 26709 |
| Entropy (8bit): | 5.473113075102964 |
| Encrypted: | false |
| SSDEEP: | 384:kRXBsAF8UMG+43L1dHMqXCxPHo189YaGuVMxoufjWFerWxWHrog4P+eF4MeUkz9+:kRX1kwqwVqkWxWHrwjF4VUQ9DlbQ |
| MD5: | CB9AF0197F496F52B471A76CFD8D601A |
| SHA1: | 067B3EE27F6B49431B5C72791D52F353C577853B |
| SHA-256: | DA3EB4AB25E02A8DC118FEBC626DF495ACD468E84BC0B9767B56E8959B150F99 |
| SHA-512: | 504E25F2E2204D2015236792EADD3C5CF353734E7EA16F500A272B9F915BF1321A10E908CF63873A29B89BE5FB28C6AA34CAB60F2B977378EB0B91C910DBC783 |
| Malicious: | false |
| IE Cache URL: | https://www.blogger.com/static/v1/jsbin/1277698886-ieretrofit.js |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 148463 |
| Entropy (8bit): | 5.570503932665935 |
| Encrypted: | false |
| SSDEEP: | 1536:VbSMuDhulPeyooGpV2UAWI5SDHhgoynJ3mYOqLZUf1o4FYA03EhHZOWCdEvL0nWj:tS7clagATjBLNUgNgMW2 |
| MD5: | 928BFF12B26E124480BDBD6A84B3CE4F |
| SHA1: | 1E3F7F0C971C086E0EFFA4ECC9BD55BEC6C09F3A |
| SHA-256: | E1D7305096192F3514FC3A898DECB10C22C879EE6F36D5C8948D24F5895AAD7C |
| SHA-512: | 025D31C4408E9B1689AF3F11DD625055DBDE2E2E55F32EFB67D71301D963E43C34D6235F96CCC53FE896DE1F3B25DBA3A016ECF6DA7D8AD162B424BF43381160 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 95 |
| Entropy (8bit): | 4.633118599879715 |
| Encrypted: | false |
| SSDEEP: | 3:yionv//thPlH1kmlS1jmTQ9IyehXhbp:6v/lhPcS5TeIFdhbp |
| MD5: | 3B2A20D5B0BA4CA0C5DD90865AD6B9C4 |
| SHA1: | A90928A16D11D21E112B45B60990A9D7D19CC1D5 |
| SHA-256: | 0FDCB4746995F0D5240E5EC11370CB950722A894F3CFF4118AA68CCC92010EDD |
| SHA-512: | EF256091EE551337B9789E8D55C558D85AF0780C2906FA971A33D36A6F9D78114A573D606DAB086816006E072CEF7029EFE4D47F7BF3BE16007CA464F3281765 |
| Malicious: | false |
| IE Cache URL: | https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3247 |
| Entropy (8bit): | 5.459946526910292 |
| Encrypted: | false |
| SSDEEP: | 96:vKFlZ/kxjqD9zqp36wxVJddFAdd5Ydddopdyddv+dd865FhlleXckVDuca:C0pv+GkduSDl6LRa |
| MD5: | 16AA7C3BEBF9C1B84C9EE07666E3207F |
| SHA1: | BF0AFA2F8066EB7EE98216D70A160A6B58EC4AA1 |
| SHA-256: | 7990E703AE060C241EBA6257D963AF2ECF9C6F3FBDB57264C1D48DDA8171E754 |
| SHA-512: | 245559F757BAB9F3D63FB664AB8F2D51B9369E2B671CF785A6C9FB4723F014F5EC0D60F1F8555D870855CF9EB49F3951D98C62CBDF9E0DC1D28544966D4E70F1 |
| Malicious: | false |
| IE Cache URL: | res://ieframe.dll/error.dlg |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 403 |
| Entropy (8bit): | 5.849127564472003 |
| Encrypted: | false |
| SSDEEP: | 12:6v/74Qlk8WIyzs740Oc5maj4m3YULe3dk:Hgk8uw740OcWAY13dk |
| MD5: | 4F7DE2E6AFEFB125B1F14FA5CDA610EE |
| SHA1: | 57A145F234B504A73F9D55CF39F2231A04719456 |
| SHA-256: | ECB30886406E3F776FF7BC3834DE849944471E626FF148BED2FA389D02866044 |
| SHA-512: | 9E3C207F0931EE4C5F48E62670F33D33815CF0779AC5F719017401C20273B4E0403CE03C08643A58BA4C3B023F9C691C34E8FDA776B710DFE8EE3DBFEE7D887B |
| Malicious: | false |
| IE Cache URL: | https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 47332 |
| Entropy (8bit): | 5.518633523108405 |
| Encrypted: | false |
| SSDEEP: | 768:UyC36rcBLbfsl5XqYoyPndHTkoWY3SoavVVy2WiCgYUD0FEw0stZb:UyDAZfY5hVdHTwY3SoIjw0sD |
| MD5: | 6A10EB2BB5C90414980729F4F96FFBDA |
| SHA1: | 8BBBD5948255549E4B691B614AA3177DEA9AF1B7 |
| SHA-256: | 0F3BE44690AE9914AE3E47B7752E1BDEA316F09938E9094F99E0DE19CCD8987A |
| SHA-512: | 5A505CBAAEEAB8961AA0DE94767F76A09B6F03E60EB0C72954B85EC0392EE1CE383D2088939A314D3175AB24B7A69390C841CFE0237C1D1C40966B43F22AE929 |
| Malicious: | false |
| IE Cache URL: | https://www.google-analytics.com/analytics.js |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 284 |
| Entropy (8bit): | 7.185887813584849 |
| Encrypted: | false |
| SSDEEP: | 6:XtwVpeAxOeXo0t7bT5oVXHXLYLtKkRuks4zBCpbP6aKZW91qquT3B/:XiVwAI+oCT5U3LYUZqWbwWzqquT3B/ |
| MD5: | 19B002212A5B8555B884CBCCBA6E35DE |
| SHA1: | 084CE38EF9E1EB2BBE6684A3900FD391D72FC253 |
| SHA-256: | EA6A5929F8185DE0C2691FD794A9353B8AA61FF68425AB9E5243347E104B6FF3 |
| SHA-512: | 00800AE00CF9B67E29A34162FA8A071BCDC33BBA7DA8F691AFCFAAF6C4CF200AD658C0CCAC5D2AECF1ED1268005A51508CFE80B5D69CB588210E7ADC49B701E3 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3247 |
| Entropy (8bit): | 5.459946526910292 |
| Encrypted: | false |
| SSDEEP: | 96:vKFlZ/kxjqD9zqp36wxVJddFAdd5Ydddopdyddv+dd865FhlleXckVDuca:C0pv+GkduSDl6LRa |
| MD5: | 16AA7C3BEBF9C1B84C9EE07666E3207F |
| SHA1: | BF0AFA2F8066EB7EE98216D70A160A6B58EC4AA1 |
| SHA-256: | 7990E703AE060C241EBA6257D963AF2ECF9C6F3FBDB57264C1D48DDA8171E754 |
| SHA-512: | 245559F757BAB9F3D63FB664AB8F2D51B9369E2B671CF785A6C9FB4723F014F5EC0D60F1F8555D870855CF9EB49F3951D98C62CBDF9E0DC1D28544966D4E70F1 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 475 |
| Entropy (8bit): | 7.239750626651385 |
| Encrypted: | false |
| SSDEEP: | 12:6v/7ElZUJDdwjI5Fa4ep0LPf+veUxQn6/Xh0ptMQsfZhkNTpQEsb7:ZK1dw0etKjfUxQn6/x0DWrETpQZb7 |
| MD5: | F617EFFE6D96C15ACFEA8B2E8AAE551F |
| SHA1: | 6D676AF11AD2E84B620CCE4D5992B657CB2D8AB6 |
| SHA-256: | D172D750493BE64A7ED84DEC1DD2A0D787BA42F78BC694B0858F152C52B6620B |
| SHA-512: | 3189A6281AD065848AFC700A47BEA885CD3905DAE11CCB28B88C81D3B28F73F4DFA2D5D1883BB9325DC7729A32AA29B7D1181AE5752DF00F6931624B50571986 |
| Malicious: | false |
| IE Cache URL: | https://resources.blogblog.com/img/icon18_wrench_allbkg.png |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 798781 |
| Entropy (8bit): | 3.1430189345605375 |
| Encrypted: | false |
| SSDEEP: | 12288:MW7Xk4PLSG9oShFjRUFYf4bfWqe5avBiHl+i137j+ocBzwtNMWvF/FoGG1pP8J3j:3 |
| MD5: | ED32D754F2655C3058CC8B3261821E25 |
| SHA1: | 69C63CFC75D0F81B866A570DDAE975FC3C979348 |
| SHA-256: | F1022AA7AAE3BAD3285A6D796257488515300A0BF23D12EDDB310C5CB9D8EB00 |
| SHA-512: | D084E7B99560D2EA19EA762C08BB28D644300ACD837180B2EEB5556CB9A18E1002C8D501C1AB33B10520B0FCD3BC239AD6F3E747EFD1AAAA76B74EB3B9BCD6D7 |
| Malicious: | false |
| IE Cache URL: | https://mysensesaredead.blogspot.com/p/master.html |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5080 |
| Entropy (8bit): | 7.934378623776424 |
| Encrypted: | false |
| SSDEEP: | 96:fQF0nYNa08BXqtmthO92OamTM5TuqeKJbLcbIsZNB52O2LK:fQoYkLBpc92OamT0TeKxLCIsvB52OCK |
| MD5: | AD9999106D5F550920B586E8E1704E5A |
| SHA1: | 93FD02C51166402A41F96509CD0CA3FB917877DD |
| SHA-256: | 3829A5B2ADE7CFC416C80B8F3DF71E49E68672875F025D525223978F5CEE3FD3 |
| SHA-512: | DE6552632F76A64C26FC0F27CCE741FBB383D60C62A4999A79023D3207B0FAB754CC975B4988B3F65CE481791C434D18D427CE3D98D7838AD0ED05A1D8125519 |
| Malicious: | false |
| IE Cache URL: | https://www.blogger.com/img/share_buttons_20_3.png |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 25296 |
| Entropy (8bit): | 5.292580915400208 |
| Encrypted: | false |
| SSDEEP: | 768:xkt9hXjJ9UP+8qeyDVrQi7xD21qTOxcVB9yNGY:xc9hXjJYyDVrQi7xD21qTfBg |
| MD5: | 094CE5DCACCF632457AE9FBF4F325399 |
| SHA1: | 87E144F51C7BEE2D624709C8F596037A92D06E66 |
| SHA-256: | 21CC4DC6C3C01B84C808004173F42E3ED1B4F09551A10D69B4CEC7394A1590E6 |
| SHA-512: | 5E7EBEE0AE1C7F421687406891DBF418794E4709C048D6AA29E9D104F9AFF13112EEFF64B4A5006C092E07B968316663BE014181E63A294D896FFC720C6B8837 |
| Malicious: | false |
| IE Cache URL: | https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.js |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 13346 |
| Entropy (8bit): | 5.405149681041944 |
| Encrypted: | false |
| SSDEEP: | 192:BqWjbSFO5Og47t7xNycGK7SlV4cjCqN1Yae3CCaJzWTKtTOpY2Dzt8cvtWPXtxQK:BqGSFOsZM61WyV3CCaJIav2F8G2XnQK |
| MD5: | EE77AB1C7CA023A501E4DA28CCC2915F |
| SHA1: | F309FB6B570041EE11C830ABA4DD58D586D193B6 |
| SHA-256: | A09131F2885086EB3DEA6A379C43E58C88E683B99FB7CF9CEFDE399DFD68D0FF |
| SHA-512: | DE42C9F444DC0D617EE12FBACE43F8EB659FBB461A6B03AD851A21FED5B44721D63D66A0802915DA387F0FD1FDD2BC06AA9A4E00FC18E2125B89A3D2238BE6A9 |
| Malicious: | false |
| IE Cache URL: | https://www.blogger.com/static/v1/jsbin/3858658042-comment_from_post_iframe.js |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 6513 |
| Entropy (8bit): | 4.798066280817504 |
| Encrypted: | false |
| SSDEEP: | 96:q54UPzHFcJZ7haKemb/m2GzrzCXAl/MStzo41Pm+YsttcVcbYhyjcso13EZDjiat:q5rPzHgxm2GzaXeMnuzYstyryPhZD9 |
| MD5: | A705132A2174F88E196EC3610D68FAA8 |
| SHA1: | 3BAD57A48D973A678FEC600D45933010F6EDC659 |
| SHA-256: | 068FFE90977F2B5B2DC2EF18572166E85281BD0ECB31C4902464B23DB54D2568 |
| SHA-512: | E947D33E0E9C5E6516F05E0EA696406E4E09B458F85021BC3A217071AE14879B2251E65AEC5D1935CA9AF2433D023356298321564E1A41119D41BE7C2B2D36D5 |
| Malicious: | false |
| IE Cache URL: | https://mysensesaredead.blogspot.com/js/cookienotice.js |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6494 |
| Entropy (8bit): | 5.459946526910292 |
| Encrypted: | false |
| SSDEEP: | 96:vKFlZ/kxjqD9zqp36wxVJddFAdd5Ydddopdyddv+dd865FhlleXckVDucqKFlZ/P:C0pv+GkduSDl6LRl0pv+GkduSDl6LRa |
| MD5: | 267E302C26E032132179DE088213355D |
| SHA1: | 7BAB512125E561DE8CB6304F85E1C942F1144C52 |
| SHA-256: | CB0BA3CA8EB46FDF94EECE50590E21BC1DF2000C0DF63E06C9E9D91F7EB0EFC9 |
| SHA-512: | 0C84328BB901154545D9EAF735847AAA9132CC937E3E694C40FA1339FBFC5FC716CD7C2FB4DEDCBCDDBCA1E0D39EC4EF4BBAD0C44F744452E3F2CC805C3016F4 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3247 |
| Entropy (8bit): | 5.459946526910292 |
| Encrypted: | false |
| SSDEEP: | 96:vKFlZ/kxjqD9zqp36wxVJddFAdd5Ydddopdyddv+dd865FhlleXckVDuca:C0pv+GkduSDl6LRa |
| MD5: | 16AA7C3BEBF9C1B84C9EE07666E3207F |
| SHA1: | BF0AFA2F8066EB7EE98216D70A160A6B58EC4AA1 |
| SHA-256: | 7990E703AE060C241EBA6257D963AF2ECF9C6F3FBDB57264C1D48DDA8171E754 |
| SHA-512: | 245559F757BAB9F3D63FB664AB8F2D51B9369E2B671CF785A6C9FB4723F014F5EC0D60F1F8555D870855CF9EB49F3951D98C62CBDF9E0DC1D28544966D4E70F1 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 137 |
| Entropy (8bit): | 4.444797932651765 |
| Encrypted: | false |
| SSDEEP: | 3:qVvzLURODccZ/vXbvx9nDy1+kWSKlJIVjkFSXbKFvNGb:qFzLIeco3XLx921JzKl2jMSLWQb |
| MD5: | 78073E4E1704D977FEA7891B773D59F1 |
| SHA1: | 8F782E56DD9077E1388EC2AAF9EA680AA1352915 |
| SHA-256: | D9DE84E422D9A9EAAA42BE51E8D3029597CA555044597A6D4EE24F2BB44AFAD1 |
| SHA-512: | A169CBB21E825EF46E0223FA0D02ADC917A47E7A3A70447D46AB5794F27D568100B210503DF034A1206B1C93FD6B8ACC28A09EB1421CA19B9E10B3F89BB2ABB4 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 43502 |
| Entropy (8bit): | 5.583970359912841 |
| Encrypted: | false |
| SSDEEP: | 768:xwAbmEw+jAJFnSCZ9vWdmIfhjQucISYsU8/F+:bAJFnSC3W1QXISYsU8t+ |
| MD5: | 9E914FD11C5238C50EBA741A873F0896 |
| SHA1: | 950316FFEF900CEECCA4CF847C9A8C14231271DA |
| SHA-256: | 8684A32D1A10D050A26FC33192EDF427A5F0C6874C590A68D77AE6E0D186BD8A |
| SHA-512: | 362B96B27D3286396F53ECE74B1685FA915FC9A73E83F28E782B3F6A2B9F851BA9E37D79D93BD97AB7B3DC3C2D9B66B5E8F81151C8B65A17F4483E1484428E5F |
| Malicious: | false |
| IE Cache URL: | https://www.google.com/css/maia.css |
| Preview: |
|
| Process: | C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2428 |
| Entropy (8bit): | 4.5690250441365095 |
| Encrypted: | false |
| SSDEEP: | 48:8Cs/XT3IkEJTvCHYRMTvYaQh2Cs/XT3IkEJTvCHYRMTvYaQ/:8J/XLIkEJTvdaTvYaQh2J/XLIkEJTvdb |
| MD5: | A6BED29A1A533EC5B03254962D7B8CAA |
| SHA1: | 3029A586C98B94BC9E55A93C0DC3BA20C5BB4436 |
| SHA-256: | C77818C1011ADC8E11D08D6AD6AE619FECA698A87E374288AFA1060A764B15C4 |
| SHA-512: | 2095E779A2C29F6543B7981AD3B1CDD06D1C6DB0B95C21805ABAF1847B8D808643ABD2726F4226321626BEDFFD9707DECD87F140644DBB7CBD9485FFCC7F8750 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 188 |
| Entropy (8bit): | 4.961493235437001 |
| Encrypted: | false |
| SSDEEP: | 3:e1wJQ/MQTMUTFicTfNIMdruYCvd/MQTMUTFicTfNIMdruYCmZ1wJQ/MQTMUTFice:e1GsBpJJNrXWJBpJJNrXvGsBpJJNrXs |
| MD5: | 2A290876431913C519E8ED6F67D75CAF |
| SHA1: | C3973DEBBD3EAC1F07D31E7BD64686A8BCF5D605 |
| SHA-256: | FE530D40B3D09035F9F28E3CA63E3ABDC821C3056D636D9BE7EFA2AE6DEEBF7D |
| SHA-512: | 8C4E0811BE58AE1D2D4C865A5D839B46C47493408B06A60D2685E9765A0671F776B345235F76AAA17DD5F081E67E71ABC30EAFAA7A7AF374AC6D89D8B2003BD0 |
| Malicious: | false |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 2.104193863028795 |
| TrID: |
|
| File name: | Request for Quotation via ShipServ 7465649870 RFQ).ppt |
| File size: | 67584 |
| MD5: | e4405847f94ce7a7ff1cf42754030467 |
| SHA1: | 3c183881bab3a09576a24da6c6aceaf106e97f1b |
| SHA256: | bc692c42c9c300e9ea559d6cdd74239d85339b60918b1c712db7078c1298421a |
| SHA512: | cf8f7b945ae3df26e929cb28c1eeb0e3dd27620dd92c4c8749e2d18a226bcda6540ce36fcedd02c4f0d0333e5129b66d12e86b8a8d7298662d6b2dc3c027c6b9 |
| SSDEEP: | 384:AeOgq96fKMkEWFXCupLXQuLuwOKYFhDwj:ZZ7CMv2genj |
| File Content Preview: | ........................>.......................................................,.............................................................................................................................................................................. |
File Icon |
|---|
 | |
| Icon Hash: | e4eaeaaaa4bcbcb4 |
Static OLE Info |
|---|
General | ||
|---|---|---|
| Document Type: | OLE | |
| Number of OLE Files: | 1 | |
OLE File "Request for Quotation via ShipServ 7465649870 RFQ).ppt" |
|---|
Indicators | |
|---|---|
| Has Summary Info: | True |
| Application Name: | Microsoft Office PowerPoint |
| Encrypted Document: | False |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | False |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | |
| Flash Objects Count: | |
| Contains VBA Macros: | True |
Summary | |
|---|---|
| Code Page: | 1252 |
| Title: | |
| Author: | |
| Keywords: | |
| Last Saved By: | |
| Revion Number: | 6 |
| Total Edit Time: | 863 |
| Create Time: | 2021-03-01 22:30:06.191794 |
| Last Saved Time: | 2021-03-01 22:44:29.985000 |
| Number of Words: | 0 |
| Thumbnail: | ;qTTTA Z(Z |
| Creating Application: | |
Document Summary | |
|---|---|
| Document Code Page: | 1252 |
| Presentation Target Format: | Widescreen |
| Number of Bytes: | 0 |
| Number of Paragraphs: | 0 |
| Number of Slides: | 1 |
| Number of Pages with Notes: | 0 |
| Number of Hidden Slides: | 0 |
| Number of Sound/Video Clips: | 0 |
| Thumbnail Scaling Desired: | False |
| Contains Dirty Links: | False |
| Shared Document: | False |
| Changed Hyperlinks: | False |
| Application Version: | 1048576 |
Streams with VBA |
|---|
VBA File Name: Module1.bas, Stream Size: 1558 |
|---|
General | |
|---|---|
| Stream Path: | VBA/Module1 |
| VBA File Name: | Module1.bas |
| Stream Size: | 1558 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . 4 . . . . . . . . . . . . . . . c . V . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 01 16 01 00 06 f0 00 00 00 cc 03 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 34 04 00 00 a8 05 00 00 00 00 00 00 01 00 00 00 63 b5 56 1c 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 04 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
VBA Code Keywords |
|---|
| Keyword |
|---|
| Shell |
| Attribute |
| AUto_Open() |
| VB_Name |
| "ping |
VBA Code |
|---|
|
VBA File Name: Module2.bas, Stream Size: 1541 |
|---|
General | |
|---|---|
| Stream Path: | VBA/Module2 |
| VBA File Name: | Module2.bas |
| Stream Size: | 1541 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . . . . c . 5 I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 01 16 01 00 06 f0 00 00 00 bc 03 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 24 04 00 00 a4 05 00 00 00 00 00 00 01 00 00 00 63 b5 35 49 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 04 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
VBA Code Keywords |
|---|
| Keyword |
|---|
| Shell |
| Attribute |
| VB_Name |
| "ping |
VBA Code |
|---|
|
VBA File Name: Module3.bas, Stream Size: 4989 |
|---|
General | |
|---|---|
| Stream Path: | VBA/Module3 |
| VBA File Name: | Module3.bas |
| Stream Size: | 4989 |
| Data ASCII: | . . . . . . . . . . . . . . . . . ( . . . . . . . . . . . . . . . . . . . . . . . c . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . |
| Data Raw: | 01 16 01 00 06 f0 00 00 00 dc 06 00 00 d4 00 00 00 28 02 00 00 ff ff ff ff 01 08 00 00 c5 0f 00 00 00 00 00 00 01 00 00 00 63 b5 e1 13 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 04 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
VBA Code Keywords |
|---|
| Keyword |
|---|
| "fvgjadagj" |
| 'UPDATE |
| shape |
| through |
| Shell |
| Resume |
| chosen |
| Object |
| source |
| crash |
| checking |
| .Shapes(k).LinkFormat.AutoUpdate |
| every |
| (ActivePresentation.Path |
| False |
| LINKS |
| ActivePresentation.Save |
| ActivePresentation.Slides(i) |
| slide |
| lodhi |
| "dbgvahsksadgka": |
| "\test.xlsx") |
| current |
| opening |
| change |
| ppUpdateOptionAutomatic |
| dialog |
| 'Turn |
| automatically |
| already |
| ActivePresentation.Slides.Count |
| "calc" |
| COMPLETE |
| doesn't |
| ExcelFile |
| "ping |
| Integer |
| option |
| successful |
| 'other |
| Application.DisplayAlerts |
| Error |
| Attribute |
| error |
| MsgBox |
| VB_Name |
| doesn |
| '-------------------------------------------------------------- |
| "Loading....": |
| .Shapes.Count |
| update |
| .Shapes(k).LinkFormat.SourceFullName |
| CreateObject("Excel.Application") |
| ppUpdateOptionManual |
VBA Code |
|---|
|
Streams |
|---|
Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 472 |
|---|
General | |
|---|---|
| Stream Path: | \x5DocumentSummaryInformation |
| File Type: | data |
| Stream Size: | 472 |
| Entropy: | 3.32363951704 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . W i d e s c r e e n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 a8 01 00 00 0f 00 00 00 01 00 00 00 80 00 00 00 03 00 00 00 88 00 00 00 04 00 00 00 9c 00 00 00 06 00 00 00 a4 00 00 00 07 00 00 00 ac 00 00 00 08 00 00 00 b4 00 00 00 09 00 00 00 bc 00 00 00 0a 00 00 00 c4 00 00 00 17 00 00 00 cc 00 00 00 |
Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 43680 |
|---|
General | |
|---|---|
| Stream Path: | \x5SummaryInformation |
| File Type: | data |
| Stream Size: | 43680 |
| Entropy: | 0.125819252019 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . p . . . . . . . . . . . h . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P o w e r P o i n t P r e s e n t a t i o n . . . . . . . . . h o m e . . . . . . . . . . . . l o d h i . . . . . . . . . . . M a s t e r M a n a . . . . . . . . . 6 . . . |
| Data Raw: | fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 70 aa 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 02 00 00 00 70 00 00 00 04 00 00 00 90 00 00 00 05 00 00 00 a0 00 00 00 08 00 00 00 b0 00 00 00 09 00 00 00 c4 00 00 00 12 00 00 00 d0 00 00 00 0a 00 00 00 f4 00 00 00 0c 00 00 00 00 01 00 00 |
Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 438 |
|---|
General | |
|---|---|
| Stream Path: | PROJECT |
| File Type: | ASCII text, with CRLF line terminators |
| Stream Size: | 438 |
| Entropy: | 5.31283639206 |
| Base64 Encoded: | True |
| Data ASCII: | I D = " { 3 7 7 0 0 0 B 3 - 1 1 2 2 - 4 B 3 E - 8 9 E 2 - 3 E F C F 1 F 7 9 2 7 9 } " . . M o d u l e = M o d u l e 1 . . M o d u l e = M o d u l e 2 . . M o d u l e = M o d u l e 3 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " D 1 D 3 6 F 9 5 7 3 9 5 7 3 9 5 7 3 9 5 7 3 " . . D P B = " 9 5 9 7 2 B 9 1 2 B 5 4 2 C 5 4 2 C 5 4 " . . G C = " 5 9 5 B E 7 1 8 E 8 1 8 E 8 E 7 " . . . . [ H o s t E x t |
| Data Raw: | 49 44 3d 22 7b 33 37 37 30 30 30 42 33 2d 31 31 32 32 2d 34 42 33 45 2d 38 39 45 32 2d 33 45 46 43 46 31 46 37 39 32 37 39 7d 22 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 31 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 32 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 33 0d 0a 4e 61 6d 65 3d 22 56 42 41 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 |
Stream Path: PROJECTwm, File Type: data, Stream Size: 74 |
|---|
General | |
|---|---|
| Stream Path: | PROJECTwm |
| File Type: | data |
| Stream Size: | 74 |
| Entropy: | 2.70866079771 |
| Base64 Encoded: | False |
| Data ASCII: | M o d u l e 1 . M . o . d . u . l . e . 1 . . . M o d u l e 2 . M . o . d . u . l . e . 2 . . . M o d u l e 3 . M . o . d . u . l . e . 3 . . . . . |
| Data Raw: | 4d 6f 64 75 6c 65 31 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 31 00 00 00 4d 6f 64 75 6c 65 32 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 32 00 00 00 4d 6f 64 75 6c 65 33 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 33 00 00 00 00 00 |
Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 3053 |
|---|
General | |
|---|---|
| Stream Path: | VBA/_VBA_PROJECT |
| File Type: | data |
| Stream Size: | 3053 |
| Entropy: | 4.36197575776 |
| Base64 Encoded: | False |
| Data ASCII: | . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . . ( . x . 8 . 6 . ) . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . |
| Data Raw: | cc 61 af 00 00 01 00 ff 09 04 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 2c 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00 |
Stream Path: VBA/__SRP_0, File Type: data, Stream Size: 2222 |
|---|
General | |
|---|---|
| Stream Path: | VBA/__SRP_0 |
| File Type: | data |
| Stream Size: | 2222 |
| Entropy: | 4.20942312406 |
| Base64 Encoded: | False |
| Data ASCII: | . K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . r U . . . . . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ [ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . c ? ? l . 3 F . . 6 a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . |
| Data Raw: | 93 4b 2a af 01 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 01 00 02 00 01 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 01 00 02 00 02 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 00 00 72 55 00 02 00 00 80 00 00 00 80 00 00 00 80 00 00 00 04 00 00 7e |
Stream Path: VBA/__SRP_1, File Type: data, Stream Size: 82 |
|---|
General | |
|---|---|
| Stream Path: | VBA/__SRP_1 |
| File Type: | data |
| Stream Size: | 82 |
| Entropy: | 1.79963466615 |
| Base64 Encoded: | False |
| Data ASCII: | r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . t . . . . . . . |
| Data Raw: | 72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 0a 00 00 00 09 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 09 00 00 00 00 00 03 00 09 00 00 00 00 00 05 00 09 00 00 00 00 00 07 00 74 00 00 7f 00 00 00 00 |
Stream Path: VBA/__SRP_2, File Type: data, Stream Size: 292 |
|---|
General | |
|---|---|
| Stream Path: | VBA/__SRP_2 |
| File Type: | data |
| Stream Size: | 292 |
| Entropy: | 3.10915929686 |
| Base64 Encoded: | False |
| Data ASCII: | r U . . . . . . . . . . . . . . . . . . . ~ | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . : l . . . N \\ . . \\ . . . . . . t T . 5 \\ . . . . . . . . : l . . . N \\ . . \\ . . . . . . t T . 5 \\ . . . . . . . . : l . . . N \\ . . \\ . . . . . . t T . 5 \\ . . . . . . . . : l . . . N \\ . . \\ . . . . . . t T . 5 \\ . . . . . . . . . . . . . . . . . ( . . . $ . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 02 00 00 7e 7c 00 00 7f 00 00 00 00 0e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 03 00 08 00 00 00 00 00 02 00 01 00 01 00 03 00 00 00 d1 05 00 00 00 00 00 00 51 06 00 00 00 00 00 00 81 00 00 00 00 00 04 00 b4 00 00 00 80 00 00 00 00 02 00 1d f5 02 00 00 00 3a 6c ff 00 00 4e 5c ff 04 5c ff 0a 01 00 08 00 74 54 ff 35 5c |
Stream Path: VBA/__SRP_3, File Type: data, Stream Size: 103 |
|---|
General | |
|---|---|
| Stream Path: | VBA/__SRP_3 |
| File Type: | data |
| Stream Size: | 103 |
| Entropy: | 1.89141813866 |
| Base64 Encoded: | False |
| Data ASCII: | r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . n . . . . . . . |
| Data Raw: | 72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff 00 00 00 00 08 00 00 00 04 00 24 00 81 00 00 00 00 00 02 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6e 00 00 7f 00 00 00 00 |
Stream Path: VBA/__SRP_4, File Type: data, Stream Size: 352 |
|---|
General | |
|---|---|
| Stream Path: | VBA/__SRP_4 |
| File Type: | data |
| Stream Size: | 352 |
| Entropy: | 3.28000466204 |
| Base64 Encoded: | False |
| Data ASCII: | r U . . . . . . . . . . . . . . . . . . . ~ | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . : l . . . N \\ . . \\ . . . . . . t T . 5 \\ . . . . . . . . : l . . . N \\ . . \\ . . . . . . t T . 5 \\ . . . . . . . . : l . . . N \\ . . \\ . . . . . . t T . 5 \\ . . . . . . . . : l . . . N \\ . . \\ . . . . . . t T . 5 \\ . . . . . . . . : l . . . N \\ . . \\ . . . . . . t T . 5 \\ . . . . . . . . : l . . |
| Data Raw: | 72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 02 00 00 7e 7c 00 00 7f 00 00 00 00 0e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 05 00 08 00 00 00 00 00 04 00 01 00 01 00 03 00 00 00 d1 05 00 00 00 00 00 00 51 06 00 00 00 00 00 00 81 00 00 00 00 00 06 00 f0 00 00 00 bc 00 00 00 00 02 00 1d f5 02 00 00 00 3a 6c ff 00 00 4e 5c ff 04 5c ff 0a 01 00 08 00 74 54 ff 35 5c |
Stream Path: VBA/__SRP_5, File Type: data, Stream Size: 103 |
|---|
General | |
|---|---|
| Stream Path: | VBA/__SRP_5 |
| File Type: | data |
| Stream Size: | 103 |
| Entropy: | 1.86467165805 |
| Base64 Encoded: | False |
| Data ASCII: | r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . n . . . . . . . |
| Data Raw: | 72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 04 00 ff ff ff ff ff ff ff ff 00 00 00 00 08 00 00 00 04 00 24 00 81 00 00 00 00 00 04 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6e 00 00 7f 00 00 00 00 |
Stream Path: VBA/__SRP_6, File Type: data, Stream Size: 1428 |
|---|
General | |
|---|---|
| Stream Path: | VBA/__SRP_6 |
| File Type: | data |
| Stream Size: | 1428 |
| Entropy: | 4.66239727306 |
| Base64 Encoded: | False |
| Data ASCII: | r U . . . . . . . . . . . . . . . . . . . ~ | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . Q . . . . . . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ) . . . . . . . q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . y . . . . . . . Y . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 . . . . . |
| Data Raw: | 72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 02 00 00 7e 7c 00 00 7f 00 00 00 00 0e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 07 00 08 00 00 00 00 00 06 00 01 00 00 00 23 00 00 00 d1 06 00 00 00 00 00 00 e9 06 00 00 00 00 00 00 01 07 00 00 00 00 00 00 19 07 00 00 00 00 00 00 31 07 00 00 00 00 00 00 d1 05 00 00 00 00 00 00 51 06 00 00 00 00 00 00 49 07 00 00 00 00 |
Stream Path: VBA/__SRP_7, File Type: data, Stream Size: 103 |
|---|
General | |
|---|---|
| Stream Path: | VBA/__SRP_7 |
| File Type: | data |
| Stream Size: | 103 |
| Entropy: | 1.89141813866 |
| Base64 Encoded: | False |
| Data ASCII: | r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . n . . . . . . . |
| Data Raw: | 72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 06 00 ff ff ff ff ff ff ff ff 00 00 00 00 08 00 00 00 04 00 24 00 81 00 00 00 00 00 06 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6e 00 00 7f 00 00 00 00 |
Stream Path: VBA/dir, File Type: data, Stream Size: 513 |
|---|
General | |
|---|---|
| Stream Path: | VBA/dir |
| File Type: | data |
| Stream Size: | 513 |
| Entropy: | 6.26491440414 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . V B A P r o j e . c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . Y 1 b . . . . . J < . . . . . r . s t d o l e > . . . s . t . d . o . . l . e . . . h . % . ^ . . * \\ G { 0 0 . 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . . E O f f D i c . E O . f . . i . . c . E . . . . . . . E . 2 D F 8 D 0 4 C . - |
| Data Raw: | 01 fd b1 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 d6 59 31 62 07 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Snort IDS Alerts |
|---|
| Timestamp | Protocol | SID | Message | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|---|---|---|
| 03/05/21-02:29:21.095914 | ICMP | 382 | ICMP PING Windows | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:29:21.095914 | ICMP | 384 | ICMP PING | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:29:21.134113 | ICMP | 408 | ICMP Echo Reply | 172.217.16.142 | 192.168.2.22 | ||
| 03/05/21-02:29:25.563435 | ICMP | 382 | ICMP PING Windows | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:29:25.563435 | ICMP | 384 | ICMP PING | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:29:25.601519 | ICMP | 408 | ICMP Echo Reply | 172.217.16.142 | 192.168.2.22 | ||
| 03/05/21-02:29:32.783224 | ICMP | 382 | ICMP PING Windows | 192.168.2.22 | 216.58.207.174 | ||
| 03/05/21-02:29:32.783224 | ICMP | 384 | ICMP PING | 192.168.2.22 | 216.58.207.174 | ||
| 03/05/21-02:29:32.823909 | ICMP | 408 | ICMP Echo Reply | 216.58.207.174 | 192.168.2.22 | ||
| 03/05/21-02:29:44.878618 | ICMP | 382 | ICMP PING Windows | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:29:44.878618 | ICMP | 384 | ICMP PING | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:29:44.916750 | ICMP | 408 | ICMP Echo Reply | 172.217.16.142 | 192.168.2.22 | ||
| 03/05/21-02:29:53.174857 | ICMP | 382 | ICMP PING Windows | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:29:53.174857 | ICMP | 384 | ICMP PING | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:29:53.213151 | ICMP | 408 | ICMP Echo Reply | 172.217.16.142 | 192.168.2.22 | ||
| 03/05/21-02:30:16.494744 | ICMP | 382 | ICMP PING Windows | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:30:16.494744 | ICMP | 384 | ICMP PING | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:30:16.532928 | ICMP | 408 | ICMP Echo Reply | 172.217.16.142 | 192.168.2.22 | ||
| 03/05/21-02:30:24.286470 | ICMP | 382 | ICMP PING Windows | 192.168.2.22 | 216.58.207.174 | ||
| 03/05/21-02:30:24.286470 | ICMP | 384 | ICMP PING | 192.168.2.22 | 216.58.207.174 | ||
| 03/05/21-02:30:24.329915 | ICMP | 408 | ICMP Echo Reply | 216.58.207.174 | 192.168.2.22 | ||
| 03/05/21-02:30:35.885673 | ICMP | 382 | ICMP PING Windows | 192.168.2.22 | 216.58.207.174 | ||
| 03/05/21-02:30:35.885673 | ICMP | 384 | ICMP PING | 192.168.2.22 | 216.58.207.174 | ||
| 03/05/21-02:30:35.926606 | ICMP | 408 | ICMP Echo Reply | 216.58.207.174 | 192.168.2.22 | ||
| 03/05/21-02:30:42.814478 | ICMP | 402 | ICMP Destination Unreachable Port Unreachable | 192.168.2.22 | 8.8.8.8 | ||
| 03/05/21-02:30:42.937619 | ICMP | 382 | ICMP PING Windows | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:30:42.937619 | ICMP | 384 | ICMP PING | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:30:42.975895 | ICMP | 408 | ICMP Echo Reply | 172.217.16.142 | 192.168.2.22 | ||
| 03/05/21-02:31:06.715562 | ICMP | 382 | ICMP PING Windows | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:31:06.715562 | ICMP | 384 | ICMP PING | 192.168.2.22 | 172.217.16.142 | ||
| 03/05/21-02:31:06.753703 | ICMP | 408 | ICMP Echo Reply | 172.217.16.142 | 192.168.2.22 |
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 5, 2021 02:29:16.214198112 CET | 49165 | 80 | 192.168.2.22 | 67.199.248.17 |
| Mar 5, 2021 02:29:16.262187958 CET | 80 | 49165 | 67.199.248.17 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.262350082 CET | 49165 | 80 | 192.168.2.22 | 67.199.248.17 |
| Mar 5, 2021 02:29:16.278887033 CET | 49165 | 80 | 192.168.2.22 | 67.199.248.17 |
| Mar 5, 2021 02:29:16.324636936 CET | 80 | 49165 | 67.199.248.17 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.416655064 CET | 80 | 49165 | 67.199.248.17 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.416776896 CET | 49165 | 80 | 192.168.2.22 | 67.199.248.17 |
| Mar 5, 2021 02:29:16.649279118 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:16.689958096 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.690155983 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:16.723162889 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:16.763787031 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.777448893 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.777481079 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.777513027 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.777522087 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:16.777534008 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.777559042 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:16.777565002 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:16.777570009 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:16.786079884 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:16.829140902 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.829487085 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:17.520467043 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:17.565968037 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.740109921 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.740206003 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.747665882 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.747729063 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.747778893 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.747821093 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.747903109 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.747961998 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.747970104 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.749165058 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.766834021 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.767060995 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.767513990 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.767601013 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.767606020 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.767653942 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.770292044 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.770355940 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.770396948 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.770426035 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.773116112 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.773174047 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.773196936 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.773220062 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.811611891 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.854566097 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.854681969 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.855293036 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.855349064 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.855357885 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.855401039 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.865434885 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.865495920 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.865520954 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.865545034 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.865550041 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.865603924 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.865605116 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.865654945 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.865659952 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.865709066 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.865715981 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.865766048 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.866797924 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.866861105 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.866867065 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.866918087 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.869595051 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.869649887 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.869688988 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.869710922 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.870713949 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.901247025 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.901340961 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.901858091 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.901886940 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.901917934 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.901933908 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.904738903 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.904763937 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.904789925 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.904844046 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.907586098 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.907608032 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.907636881 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.907664061 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.910453081 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.910474062 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.910520077 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.910546064 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.913311958 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.913341045 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.913367033 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.913409948 CET | 49166 | 443 | 192.168.2.22 | 216.58.207.129 |
| Mar 5, 2021 02:29:18.916126013 CET | 443 | 49166 | 216.58.207.129 | 192.168.2.22 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 5, 2021 02:29:16.131344080 CET | 52197 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:16.177581072 CET | 53 | 52197 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:16.575632095 CET | 53099 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:16.642647982 CET | 53 | 53099 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.852366924 CET | 52838 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:18.915735960 CET | 53 | 52838 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:18.931947947 CET | 52838 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:18.988276005 CET | 53 | 52838 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:19.053706884 CET | 52838 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:19.108043909 CET | 53 | 52838 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:20.340635061 CET | 61200 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:20.415890932 CET | 53 | 61200 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:20.460393906 CET | 49548 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:20.525734901 CET | 53 | 49548 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:20.969980001 CET | 55627 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:21.029292107 CET | 53 | 55627 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:21.034488916 CET | 56009 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:21.094259024 CET | 53 | 56009 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:21.272134066 CET | 61865 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:21.329041958 CET | 53 | 61865 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:23.050043106 CET | 55171 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:23.126547098 CET | 53 | 55171 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:24.059233904 CET | 52496 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:24.121946096 CET | 53 | 52496 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:25.449033976 CET | 57564 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:25.504858017 CET | 53 | 57564 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:25.508104086 CET | 63009 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:25.562320948 CET | 53 | 63009 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:25.870248079 CET | 59319 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:25.930020094 CET | 53 | 59319 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:27.895828962 CET | 53070 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:27.943901062 CET | 53 | 53070 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:27.960174084 CET | 59770 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:28.005626917 CET | 61523 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:28.005987883 CET | 53 | 59770 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:28.070745945 CET | 53 | 61523 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:32.661228895 CET | 62791 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:32.723165035 CET | 53 | 62791 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:32.725430965 CET | 50667 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:32.782511950 CET | 53 | 50667 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:33.129745007 CET | 54129 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:33.184268951 CET | 53 | 54129 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:42.421541929 CET | 65329 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:42.465718985 CET | 60718 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:42.477543116 CET | 53 | 65329 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:42.529459000 CET | 53 | 60718 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:43.552191019 CET | 49157 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:43.609081030 CET | 53 | 49157 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:44.764659882 CET | 57391 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:44.820533037 CET | 53 | 57391 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:44.823235035 CET | 61858 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:44.877548933 CET | 53 | 61858 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:45.228442907 CET | 62500 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:45.283432007 CET | 53 | 62500 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:50.698143959 CET | 51652 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:50.760907888 CET | 53 | 51652 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:51.797499895 CET | 62762 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:51.854104996 CET | 53 | 62762 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:53.070353985 CET | 56905 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:53.119093895 CET | 53 | 56905 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:53.127721071 CET | 54609 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:53.173873901 CET | 53 | 54609 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:53.544876099 CET | 58101 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:53.604188919 CET | 53 | 58101 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:58.792584896 CET | 64329 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:58.854357958 CET | 53 | 64329 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:29:59.783992052 CET | 64881 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:29:59.838025093 CET | 53 | 64881 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:06.398964882 CET | 55327 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:06.455871105 CET | 53 | 55327 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:16.354485035 CET | 59150 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:16.400477886 CET | 53 | 59150 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:16.447223902 CET | 63439 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:16.493338108 CET | 53 | 63439 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:16.774985075 CET | 65040 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:16.946705103 CET | 53 | 65040 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:17.266942978 CET | 61369 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:17.321172953 CET | 53 | 61369 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:24.185188055 CET | 65515 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:24.231368065 CET | 53 | 65515 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:24.237095118 CET | 60236 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:24.283092022 CET | 53 | 60236 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:24.447722912 CET | 53198 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:24.504903078 CET | 53 | 53198 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:24.823945999 CET | 50027 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:24.881366014 CET | 53 | 50027 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:32.747869015 CET | 59245 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:32.763811111 CET | 55840 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:32.764209032 CET | 61667 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:32.802254915 CET | 53 | 59245 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:32.832870960 CET | 53 | 61667 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:32.841945887 CET | 53 | 55840 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:35.775671959 CET | 63736 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:35.823627949 CET | 53 | 63736 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:35.827310085 CET | 59805 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:35.884392977 CET | 53 | 59805 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:36.148708105 CET | 62322 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:36.203330040 CET | 53 | 62322 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:36.523206949 CET | 52819 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:36.584517956 CET | 53 | 52819 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:40.716989040 CET | 51215 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:40.717510939 CET | 60312 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:40.718061924 CET | 63463 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:40.780194044 CET | 53 | 60312 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:40.782635927 CET | 53 | 51215 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:40.783195019 CET | 53 | 63463 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:42.738068104 CET | 62224 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:42.814372063 CET | 53 | 62224 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:42.828358889 CET | 59064 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:42.874439955 CET | 53 | 59064 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:42.877367973 CET | 59885 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:42.934762955 CET | 53 | 59885 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:43.186656952 CET | 63749 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:43.241293907 CET | 53 | 63749 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:43.555874109 CET | 50878 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:43.604597092 CET | 53 | 50878 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:48.851636887 CET | 58469 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:48.856137991 CET | 54773 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:48.860212088 CET | 52166 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:48.902041912 CET | 53 | 54773 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:48.914081097 CET | 53 | 58469 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:48.914382935 CET | 53 | 52166 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:30:51.641911983 CET | 54589 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:30:51.696400881 CET | 53 | 54589 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:31:06.606147051 CET | 58113 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:31:06.653410912 CET | 53 | 58113 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:31:06.657458067 CET | 53533 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:31:06.714812040 CET | 53 | 53533 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:31:07.393848896 CET | 57696 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:31:07.448476076 CET | 53 | 57696 | 8.8.8.8 | 192.168.2.22 |
| Mar 5, 2021 02:31:07.799719095 CET | 51068 | 53 | 192.168.2.22 | 8.8.8.8 |
| Mar 5, 2021 02:31:07.848411083 CET | 53 | 51068 | 8.8.8.8 | 192.168.2.22 |
ICMP Packets |
|---|
| Timestamp | Source IP | Dest IP | Checksum | Code | Type |
|---|---|---|---|---|---|
| Mar 5, 2021 02:30:42.814477921 CET | 192.168.2.22 | 8.8.8.8 | d019 | (Port unreachable) | Destination Unreachable |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| Mar 5, 2021 02:29:16.131344080 CET | 192.168.2.22 | 8.8.8.8 | 0xf916 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:16.575632095 CET | 192.168.2.22 | 8.8.8.8 | 0x44f5 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:18.852366924 CET | 192.168.2.22 | 8.8.8.8 | 0x937d | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:18.931947947 CET | 192.168.2.22 | 8.8.8.8 | 0x937d | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:19.053706884 CET | 192.168.2.22 | 8.8.8.8 | 0x937d | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:20.340635061 CET | 192.168.2.22 | 8.8.8.8 | 0xcd54 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:21.272134066 CET | 192.168.2.22 | 8.8.8.8 | 0x3331 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:23.050043106 CET | 192.168.2.22 | 8.8.8.8 | 0x1d24 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:24.059233904 CET | 192.168.2.22 | 8.8.8.8 | 0x8732 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:25.870248079 CET | 192.168.2.22 | 8.8.8.8 | 0x1f6b | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:33.129745007 CET | 192.168.2.22 | 8.8.8.8 | 0x2abf | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:42.421541929 CET | 192.168.2.22 | 8.8.8.8 | 0xfa0e | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:42.465718985 CET | 192.168.2.22 | 8.8.8.8 | 0xc27 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:43.552191019 CET | 192.168.2.22 | 8.8.8.8 | 0x311a | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:45.228442907 CET | 192.168.2.22 | 8.8.8.8 | 0x1e60 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:50.698143959 CET | 192.168.2.22 | 8.8.8.8 | 0xe1f2 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:51.797499895 CET | 192.168.2.22 | 8.8.8.8 | 0xc82a | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:53.544876099 CET | 192.168.2.22 | 8.8.8.8 | 0x9057 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:58.792584896 CET | 192.168.2.22 | 8.8.8.8 | 0x54f0 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:29:59.783992052 CET | 192.168.2.22 | 8.8.8.8 | 0xd67b | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:06.398964882 CET | 192.168.2.22 | 8.8.8.8 | 0x3e7a | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:16.774985075 CET | 192.168.2.22 | 8.8.8.8 | 0x627f | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:17.266942978 CET | 192.168.2.22 | 8.8.8.8 | 0x70c6 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:24.447722912 CET | 192.168.2.22 | 8.8.8.8 | 0x5122 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:24.823945999 CET | 192.168.2.22 | 8.8.8.8 | 0xb90c | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:32.747869015 CET | 192.168.2.22 | 8.8.8.8 | 0x2557 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:32.763811111 CET | 192.168.2.22 | 8.8.8.8 | 0x9e90 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:32.764209032 CET | 192.168.2.22 | 8.8.8.8 | 0x68f1 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:36.148708105 CET | 192.168.2.22 | 8.8.8.8 | 0xe0d7 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:36.523206949 CET | 192.168.2.22 | 8.8.8.8 | 0xe51 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:40.716989040 CET | 192.168.2.22 | 8.8.8.8 | 0xea7d | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:40.717510939 CET | 192.168.2.22 | 8.8.8.8 | 0x72d9 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:40.718061924 CET | 192.168.2.22 | 8.8.8.8 | 0x7254 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:43.186656952 CET | 192.168.2.22 | 8.8.8.8 | 0xaac9 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:43.555874109 CET | 192.168.2.22 | 8.8.8.8 | 0x8c5 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:48.851636887 CET | 192.168.2.22 | 8.8.8.8 | 0xfe5c | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:48.856137991 CET | 192.168.2.22 | 8.8.8.8 | 0xe303 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:30:48.860212088 CET | 192.168.2.22 | 8.8.8.8 | 0x2692 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:31:07.393848896 CET | 192.168.2.22 | 8.8.8.8 | 0x1557 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Mar 5, 2021 02:31:07.799719095 CET | 192.168.2.22 | 8.8.8.8 | 0x5644 | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| Mar 5, 2021 02:29:16.177581072 CET | 8.8.8.8 | 192.168.2.22 | 0xf916 | No error (0) | 67.199.248.17 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:16.177581072 CET | 8.8.8.8 | 192.168.2.22 | 0xf916 | No error (0) | 67.199.248.16 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:16.642647982 CET | 8.8.8.8 | 192.168.2.22 | 0x44f5 | No error (0) | blogspot.l.googleusercontent.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:16.642647982 CET | 8.8.8.8 | 192.168.2.22 | 0x44f5 | No error (0) | 216.58.207.129 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:18.915735960 CET | 8.8.8.8 | 192.168.2.22 | 0x937d | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:18.988276005 CET | 8.8.8.8 | 192.168.2.22 | 0x937d | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:19.108043909 CET | 8.8.8.8 | 192.168.2.22 | 0x937d | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:20.415890932 CET | 8.8.8.8 | 192.168.2.22 | 0xcd54 | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:21.329041958 CET | 8.8.8.8 | 192.168.2.22 | 0x3331 | No error (0) | 192.254.74.210 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:23.126547098 CET | 8.8.8.8 | 192.168.2.22 | 0x1d24 | No error (0) | blogspot.l.googleusercontent.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:23.126547098 CET | 8.8.8.8 | 192.168.2.22 | 0x1d24 | No error (0) | 216.58.207.129 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:24.121946096 CET | 8.8.8.8 | 192.168.2.22 | 0x8732 | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:25.930020094 CET | 8.8.8.8 | 192.168.2.22 | 0x1f6b | No error (0) | 207.241.228.144 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:33.184268951 CET | 8.8.8.8 | 192.168.2.22 | 0x2abf | No error (0) | 207.241.228.144 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:42.477543116 CET | 8.8.8.8 | 192.168.2.22 | 0xfa0e | No error (0) | 207.241.228.144 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:42.529459000 CET | 8.8.8.8 | 192.168.2.22 | 0xc27 | No error (0) | blogspot.l.googleusercontent.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:42.529459000 CET | 8.8.8.8 | 192.168.2.22 | 0xc27 | No error (0) | 216.58.207.129 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:43.609081030 CET | 8.8.8.8 | 192.168.2.22 | 0x311a | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:45.283432007 CET | 8.8.8.8 | 192.168.2.22 | 0x1e60 | No error (0) | 192.254.74.210 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:50.760907888 CET | 8.8.8.8 | 192.168.2.22 | 0xe1f2 | No error (0) | blogspot.l.googleusercontent.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:50.760907888 CET | 8.8.8.8 | 192.168.2.22 | 0xe1f2 | No error (0) | 216.58.207.129 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:51.854104996 CET | 8.8.8.8 | 192.168.2.22 | 0xc82a | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:53.604188919 CET | 8.8.8.8 | 192.168.2.22 | 0x9057 | No error (0) | 207.241.228.152 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:58.854357958 CET | 8.8.8.8 | 192.168.2.22 | 0x54f0 | No error (0) | blogspot.l.googleusercontent.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:29:58.854357958 CET | 8.8.8.8 | 192.168.2.22 | 0x54f0 | No error (0) | 216.58.207.129 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:29:59.838025093 CET | 8.8.8.8 | 192.168.2.22 | 0xd67b | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:06.455871105 CET | 8.8.8.8 | 192.168.2.22 | 0x3e7a | No error (0) | 207.241.228.152 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:16.946705103 CET | 8.8.8.8 | 192.168.2.22 | 0x627f | No error (0) | linkpc.net | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:16.946705103 CET | 8.8.8.8 | 192.168.2.22 | 0x627f | No error (0) | 67.214.175.69 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:17.321172953 CET | 8.8.8.8 | 192.168.2.22 | 0x70c6 | No error (0) | 207.241.228.152 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:24.504903078 CET | 8.8.8.8 | 192.168.2.22 | 0x5122 | No error (0) | linkpc.net | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:24.504903078 CET | 8.8.8.8 | 192.168.2.22 | 0x5122 | No error (0) | 67.214.175.69 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:24.881366014 CET | 8.8.8.8 | 192.168.2.22 | 0xb90c | No error (0) | 207.241.228.144 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:32.802254915 CET | 8.8.8.8 | 192.168.2.22 | 0x2557 | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:32.832870960 CET | 8.8.8.8 | 192.168.2.22 | 0x68f1 | No error (0) | blogspot.l.googleusercontent.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:32.832870960 CET | 8.8.8.8 | 192.168.2.22 | 0x68f1 | No error (0) | 216.58.207.129 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:32.841945887 CET | 8.8.8.8 | 192.168.2.22 | 0x9e90 | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:36.203330040 CET | 8.8.8.8 | 192.168.2.22 | 0xe0d7 | No error (0) | linkpc.net | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:36.203330040 CET | 8.8.8.8 | 192.168.2.22 | 0xe0d7 | No error (0) | 67.214.175.69 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:36.584517956 CET | 8.8.8.8 | 192.168.2.22 | 0xe51 | No error (0) | 207.241.228.152 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:40.780194044 CET | 8.8.8.8 | 192.168.2.22 | 0x72d9 | No error (0) | blogspot.l.googleusercontent.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:40.780194044 CET | 8.8.8.8 | 192.168.2.22 | 0x72d9 | No error (0) | 216.58.207.129 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:40.782635927 CET | 8.8.8.8 | 192.168.2.22 | 0xea7d | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:40.783195019 CET | 8.8.8.8 | 192.168.2.22 | 0x7254 | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:43.241293907 CET | 8.8.8.8 | 192.168.2.22 | 0xaac9 | No error (0) | linkpc.net | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:43.241293907 CET | 8.8.8.8 | 192.168.2.22 | 0xaac9 | No error (0) | 67.214.175.69 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:43.604597092 CET | 8.8.8.8 | 192.168.2.22 | 0x8c5 | No error (0) | 207.241.228.152 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:48.902041912 CET | 8.8.8.8 | 192.168.2.22 | 0xe303 | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:48.914081097 CET | 8.8.8.8 | 192.168.2.22 | 0xfe5c | No error (0) | blogspot.l.googleusercontent.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:30:48.914081097 CET | 8.8.8.8 | 192.168.2.22 | 0xfe5c | No error (0) | 216.58.207.129 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:30:48.914382935 CET | 8.8.8.8 | 192.168.2.22 | 0x2692 | No error (0) | blogger.l.google.com | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:31:07.448476076 CET | 8.8.8.8 | 192.168.2.22 | 0x1557 | No error (0) | linkpc.net | CNAME (Canonical name) | IN (0x0001) | ||
| Mar 5, 2021 02:31:07.448476076 CET | 8.8.8.8 | 192.168.2.22 | 0x1557 | No error (0) | 67.214.175.69 | A (IP address) | IN (0x0001) | ||
| Mar 5, 2021 02:31:07.848411083 CET | 8.8.8.8 | 192.168.2.22 | 0x5644 | No error (0) | 207.241.228.152 | A (IP address) | IN (0x0001) |
HTTP Request Dependency Graph |
|---|
|
HTTP Packets |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 0 | 192.168.2.22 | 49165 | 67.199.248.17 | 80 | C:\Windows\System32\mshta.exe |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Mar 5, 2021 02:29:16.278887033 CET | 0 | OUT | |
| Mar 5, 2021 02:29:16.416655064 CET | 1 | IN |
HTTPS Packets |
|---|
| Timestamp | Source IP | Source Port | Dest IP | Dest Port | Subject | Issuer | Not Before | Not After | JA3 SSL Client Fingerprint | JA3 SSL Client Digest |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 5, 2021 02:29:16.777534008 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49166 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 | |||||||
| Mar 5, 2021 02:29:23.231055975 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49176 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 | |||||||
| Mar 5, 2021 02:29:42.641458988 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49184 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 | |||||||
| Mar 5, 2021 02:29:50.869175911 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49187 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 | |||||||
| Mar 5, 2021 02:29:58.958079100 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49190 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 | |||||||
| Mar 5, 2021 02:30:33.781835079 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49199 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 | |||||||
| Mar 5, 2021 02:30:33.787146091 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49197 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 | |||||||
| Mar 5, 2021 02:30:40.883064985 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49202 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 | |||||||
| Mar 5, 2021 02:30:40.883903027 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49204 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 | |||||||
| Mar 5, 2021 02:30:49.009556055 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49208 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 | |||||||
| Mar 5, 2021 02:30:49.011461973 CET | 216.58.207.129 | 443 | 192.168.2.22 | 49209 | CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Wed Feb 17 13:32:16 CET 2021 Thu Jun 15 02:00:42 CEST 2017 | Wed May 12 14:32:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021 | 771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0 | 7dcce5b76c8b17472d024758970a406b |
| CN=GTS CA 1O1, O=Google Trust Services, C=US | CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 | Thu Jun 15 02:00:42 CEST 2017 | Wed Dec 15 01:00:42 CET 2021 |
Code Manipulations |
|---|
Statistics |
|---|
Behavior |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 02:28:31 |
| Start date: | 05/03/2021 |
| Path: | C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x13fb50000 |
| File size: | 2163560 bytes |
| MD5 hash: | EBBBEF2CCA67822395E24D6E18A3BDF6 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:34 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\SysWOW64\cmd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4a130000 |
| File size: | 302592 bytes |
| MD5 hash: | AD7B9C14083B52BC532FBA5948342B98 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 02:28:35 |
| Start date: | 05/03/2021 |
| Path: | C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x13f3f0000 |
| File size: | 2163560 bytes |
| MD5 hash: | EBBBEF2CCA67822395E24D6E18A3BDF6 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:36 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:37 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:37 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:37 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:38 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:38 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:38 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:39 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:39 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:39 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:40 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:40 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:40 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:41 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
General |
|---|
| Start time: | 02:28:41 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
General |
|---|
| Start time: | 02:28:41 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\PING.EXE |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xff970000 |
| File size: | 16896 bytes |
| MD5 hash: | 5FB30FE90736C7FC77DE637021B1CE7C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
General |
|---|
| Start time: | 02:28:44 |
| Start date: | 05/03/2021 |
| Path: | C:\Windows\System32\mshta.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x13f910000 |
| File size: | 13824 bytes |
| MD5 hash: | 95828D670CFD3B16EE188168E083C3C5 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
Disassembly |
|---|
Code Analysis |
|---|