Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 108.177.125.84 | Active | Moloch |
| 142.250.204.110 | Active | Moloch |
| 142.250.206.234 | Active | Moloch |
| 142.250.76.131 | Active | Moloch |
| 142.250.76.142 | Active | Moloch |
| 142.251.222.195 | Active | Moloch |
| 164.124.101.2 | Active | Moloch |
| 172.217.161.225 | Active | Moloch |
| 172.217.24.78 | Active | Moloch |
| 172.217.24.97 | Active | Moloch |
| 172.217.25.170 | Active | Moloch |
| 172.217.25.174 | Active | Moloch |
| 172.217.27.36 | Active | Moloch |
| 172.217.27.46 | Active | Moloch |
| 211.114.64.12 | Active | Moloch |
| 216.58.200.228 | Active | Moloch |
| 34.104.35.123 | Active | Moloch |
| 45.33.6.223 | Active | Moloch |
- TCP Requests
-
-
192.168.56.101:49330 108.177.125.84:443accounts.google.com
-
192.168.56.101:49328 142.250.204.110:443
-
192.168.56.101:49348 142.250.206.234:443
-
192.168.56.101:49352 142.250.76.131:443
-
192.168.56.101:49349 142.250.76.142:443
-
192.168.56.101:49327 142.251.222.195:443www.gstatic.com
-
192.168.56.101:49336 142.251.222.195:443www.gstatic.com
-
192.168.56.101:49337 142.251.222.195:443www.gstatic.com
-
192.168.56.101:49338 142.251.222.195:443www.gstatic.com
-
192.168.56.101:49245 172.217.24.227:443
-
192.168.56.101:49246 172.217.24.227:443
-
192.168.56.101:49339 172.217.24.227:443
-
192.168.56.101:49342 172.217.24.78:443play.google.com
-
192.168.56.101:49343 172.217.24.97:443clients2.googleusercontent.com
-
192.168.56.101:49351 172.217.25.170:443
-
192.168.56.101:49350 172.217.25.174:443
-
192.168.56.101:49326 172.217.27.36:443www.google.com
-
192.168.56.101:49340 172.217.27.46:443apis.google.com
-
192.168.56.101:49332 211.114.64.12:443r1---sn-3u-bh2ss.gvt1.com
-
192.168.56.101:49331 216.58.200.228:443www.google.com
-
192.168.56.101:49333 216.58.200.228:443www.google.com
-
192.168.56.101:49334 216.58.200.228:443www.google.com
-
192.168.56.101:49329 216.58.203.67:443
-
192.168.56.101:49250 34.104.35.123:80edgedl.me.gvt1.com
-
192.168.56.101:49353 34.104.35.123:80edgedl.me.gvt1.com
-
8.8.4.4:443 192.168.56.101:49345
-
8.8.8.8:443 192.168.56.101:49344
-
8.8.8.8:443 192.168.56.101:49346
-
- UDP Requests
-
-
192.168.56.101:61246 142.250.206.234:443
-
192.168.56.101:54189 142.250.76.131:443
-
192.168.56.101:59909 142.250.76.142:443
-
192.168.56.101:49209 164.124.101.2:53
-
192.168.56.101:49278 164.124.101.2:53
-
192.168.56.101:51901 164.124.101.2:53
-
192.168.56.101:52753 164.124.101.2:53
-
192.168.56.101:52797 164.124.101.2:53
-
192.168.56.101:52815 164.124.101.2:53
-
192.168.56.101:53381 164.124.101.2:53
-
192.168.56.101:53767 164.124.101.2:53
-
192.168.56.101:53850 164.124.101.2:53
-
192.168.56.101:54148 164.124.101.2:53
-
192.168.56.101:54883 164.124.101.2:53
-
192.168.56.101:54915 164.124.101.2:53
-
192.168.56.101:55146 164.124.101.2:53
-
192.168.56.101:56334 164.124.101.2:53
-
192.168.56.101:57986 164.124.101.2:53
-
192.168.56.101:58120 164.124.101.2:53
-
192.168.56.101:58166 164.124.101.2:53
-
192.168.56.101:58269 164.124.101.2:53
-
192.168.56.101:58297 164.124.101.2:53
-
192.168.56.101:58887 164.124.101.2:53
-
192.168.56.101:59002 164.124.101.2:53
-
192.168.56.101:60022 164.124.101.2:53
-
192.168.56.101:60411 164.124.101.2:53
-
192.168.56.101:60501 164.124.101.2:53
-
192.168.56.101:60595 164.124.101.2:53
-
192.168.56.101:60811 164.124.101.2:53
-
192.168.56.101:61950 164.124.101.2:53
-
192.168.56.101:63438 164.124.101.2:53
-
192.168.56.101:63891 164.124.101.2:53
-
192.168.56.101:64447 164.124.101.2:53
-
192.168.56.101:53447 172.217.161.225:443clients2.googleusercontent.com
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:57081 211.114.64.12:443r1---sn-3u-bh2ss.gvt1.com
-
192.168.56.101:60079 216.58.203.67:443
-
192.168.56.101:5353 224.0.0.251:5353
-
192.168.56.101:54884 239.255.255.250:1900
-
192.168.56.101:59005 239.255.255.250:1900
-
192.168.56.103:137 192.168.56.101:137
-
8.8.4.4:443 192.168.56.101:49854
-
8.8.8.8:443 192.168.56.101:52121
-
POST
200
https://update.googleapis.com/service/update2
REQUEST
RESPONSE
BODY
POST /service/update2 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
User-Agent: Google Update/1.3.36.152;winhttp
X-Old-UID: age=-1; cnt=1
X-Goog-Update-Updater: Omaha-1.3.36.152
X-Goog-Update-Interactivity: bg
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Content-Length: 787
Host: update.googleapis.com
HTTP/1.1 200 OK
Content-Security-Policy: script-src 'report-sample' 'nonce-kUoFZuS-w-5xN41gYXtHtw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 23 May 2024 22:40:39 GMT
Content-Type: text/xml; charset=UTF-8
X-Daynum: 6352
X-Daystart: 56439
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
POST
200
https://update.googleapis.com/service/update2?cup2key=12:n6EyV-uvoCaVgxFxDQet4WSYiBFRf-2C5HNBwb81dao&cup2hreq=1617e93f4cc0a87c8eec0ba442964150753038fe712f2774cc7d587abbdc23fd
REQUEST
RESPONSE
BODY
POST /service/update2?cup2key=12:n6EyV-uvoCaVgxFxDQet4WSYiBFRf-2C5HNBwb81dao&cup2hreq=1617e93f4cc0a87c8eec0ba442964150753038fe712f2774cc7d587abbdc23fd HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
User-Agent: Google Update/1.3.36.152;winhttp;cup-ecdsa
X-Old-UID: cnt=1
X-Goog-Update-AppId: {8A69D345-D564-463C-AFF1-A69D9E530F96}
X-Goog-Update-Updater: Omaha-1.3.36.152
X-Goog-Update-Interactivity: fg
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Content-Length: 793
Host: update.googleapis.com
HTTP/1.1 200 OK
Content-Security-Policy: script-src 'report-sample' 'nonce-Pd2JpipbMlq2DC4fo8SHPA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 23 May 2024 22:40:40 GMT
X-Cup-Server-Proof: 304402201348cacf817c544e7f372b75468cfae7b6129f7f2efd1a7f2647d542e647774c022032a909e9b4004d3af0c97953de179892ecfd3cd94eb9fcbb16b1eb35a914a629:1617e93f4cc0a87c8eec0ba442964150753038fe712f2774cc7d587abbdc23fd
Content-Type: text/xml; charset=UTF-8
X-Daynum: 6352
X-Daystart: 56440
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
POST
200
https://update.googleapis.com/service/update2
REQUEST
RESPONSE
BODY
POST /service/update2 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
User-Agent: Google Update/1.3.36.152;winhttp
X-Old-UID: cnt=1
X-Goog-Update-Updater: Omaha-1.3.36.152
X-Goog-Update-Interactivity: bg
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Content-Length: 1554
Host: update.googleapis.com
HTTP/1.1 200 OK
Content-Security-Policy: script-src 'report-sample' 'nonce-AcKwaR9vR1qEH0SdVfJjLw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 23 May 2024 22:41:02 GMT
Content-Type: text/xml; charset=UTF-8
X-Daynum: 6352
X-Daystart: 56462
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
HEAD
200
http://edgedl.me.gvt1.com/edgedl/release2/chrome/czao2hrvpk5wgqrkz4kks5r734_109.0.5414.120/109.0.5414.120_chrome_installer.exe
REQUEST
RESPONSE
BODY
HEAD /edgedl/release2/chrome/czao2hrvpk5wgqrkz4kks5r734_109.0.5414.120/109.0.5414.120_chrome_installer.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=1
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: edgedl.me.gvt1.com
HTTP/1.1 200 OK
accept-ranges: bytes
content-disposition: attachment
content-security-policy: default-src 'none'
server: Google-Edge-Cache
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0
content-length: 93122600
x-request-id: 82eef58b-4a1d-4efb-9867-276b5c17987d
date: Thu, 23 May 2024 01:25:35 GMT
age: 76508
last-modified: Tue, 24 Jan 2023 00:18:52 GMT
etag: "12739dd"
content-type: application/octet-stream
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
cache-control: public,max-age=86400
GET
200
http://edgedl.me.gvt1.com/edgedl/release2/chrome/czao2hrvpk5wgqrkz4kks5r734_109.0.5414.120/109.0.5414.120_chrome_installer.exe
REQUEST
RESPONSE
BODY
GET /edgedl/release2/chrome/czao2hrvpk5wgqrkz4kks5r734_109.0.5414.120/109.0.5414.120_chrome_installer.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 24 Jan 2023 00:18:52 GMT
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=1
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: edgedl.me.gvt1.com
HTTP/1.1 200 OK
accept-ranges: bytes
content-disposition: attachment
content-security-policy: default-src 'none'
server: Google-Edge-Cache
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0
content-length: 93122600
x-request-id: dcd304a2-08aa-4c3f-9524-95aff370237f
date: Thu, 23 May 2024 01:25:35 GMT
age: 76509
last-modified: Tue, 24 Jan 2023 00:18:52 GMT
etag: "12739dd"
content-type: application/octet-stream
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
cache-control: public,max-age=86400
HEAD
200
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
REQUEST
RESPONSE
BODY
HEAD /edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
Host: edgedl.me.gvt1.com
HTTP/1.1 200 OK
accept-ranges: bytes
content-disposition: attachment
content-security-policy: default-src 'none'
server: Google-Edge-Cache
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-request-id: f5df497a-8746-4fd9-ac60-5717afbd8242
content-length: 3144
date: Thu, 23 May 2024 01:07:36 GMT
age: 77665
last-modified: Fri, 02 Feb 2024 14:17:24 GMT
etag: "231bba6"
content-type: application/x-chrome-extension
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
cache-control: public,max-age=86400
GET
200
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
REQUEST
RESPONSE
BODY
GET /edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Fri, 02 Feb 2024 14:17:24 GMT
User-Agent: Microsoft BITS/7.5
Host: edgedl.me.gvt1.com
HTTP/1.1 200 OK
accept-ranges: bytes
content-disposition: attachment
content-security-policy: default-src 'none'
server: Google-Edge-Cache
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-request-id: 123b37f5-9df0-4248-a259-d779c3bf9cd0
content-length: 3144
date: Thu, 23 May 2024 01:07:36 GMT
age: 77678
last-modified: Fri, 02 Feb 2024 14:17:24 GMT
etag: "231bba6"
content-type: application/x-chrome-extension
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
cache-control: public,max-age=86400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49245 -> 172.217.24.227:443 | 906200022 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49246 -> 172.217.24.227:443 | 906200022 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 34.104.35.123:80 -> 192.168.56.101:49250 | 2018959 | ET POLICY PE EXE or DLL Windows file download HTTP | Potential Corporate Privacy Violation |
| TCP 34.104.35.123:80 -> 192.168.56.101:49250 | 2014520 | ET INFO EXE - Served Attached HTTP | Misc activity |
| TCP 192.168.56.101:49339 -> 172.217.24.227:443 | 906200022 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49344 -> 8.8.8.8:443 | 2047866 | ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI) | Misc activity |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.2 192.168.56.101:49245 172.217.24.227:443 |
C=US, O=Google Trust Services, CN=WR2 | CN=upload.video.google.com | 87:a0:28:7a:78:8a:cb:af:25:26:65:fb:d1:da:f0:82:e6:66:7c:71 |
|
TLS 1.2 192.168.56.101:49246 172.217.24.227:443 |
C=US, O=Google Trust Services, CN=WR2 | CN=upload.video.google.com | 87:a0:28:7a:78:8a:cb:af:25:26:65:fb:d1:da:f0:82:e6:66:7c:71 |
|
TLS 1.3 192.168.56.101:49328 142.250.204.110:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49327 142.251.222.195:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49329 216.58.203.67:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49332 211.114.64.12:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49334 216.58.200.228:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49336 142.251.222.195:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49340 172.217.27.46:443 |
None | None | None |
|
TLS 1.2 192.168.56.101:49339 172.217.24.227:443 |
C=US, O=Google Trust Services, CN=WR2 | CN=upload.video.google.com | 87:a0:28:7a:78:8a:cb:af:25:26:65:fb:d1:da:f0:82:e6:66:7c:71 |
|
TLS 1.3 192.168.56.101:49342 172.217.24.78:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49331 216.58.200.228:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49348 142.250.206.234:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49352 142.250.76.131:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49345 8.8.4.4:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49344 8.8.8.8:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49346 8.8.8.8:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49349 142.250.76.142:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49350 172.217.25.174:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49351 172.217.25.170:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49326 172.217.27.36:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49330 108.177.125.84:443 |
None | None | None |
|
TLS 1.3 192.168.56.101:49343 172.217.24.97:443 |
None | None | None |
|
UNDETERMINED 192.168.56.101:49338 142.251.222.195:443 |
None | None | None |
|
UNDETERMINED 192.168.56.101:49333 216.58.200.228:443 |
None | None | None |
|
UNDETERMINED 192.168.56.101:49337 142.251.222.195:443 |
None | None | None |
Snort Alerts
No Snort Alerts