NetWork | ZeroBOX

Network Analysis

IP Address Status Action
142.250.34.2 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
Name Response Post-Analysis Lookup
edgedl.gvt1.com 142.250.34.2
POST 200 https://update.googleapis.com/service/update2?cup2key=10:1406602533&cup2hreq=b4a4aa0bb84680f4c7628593531edebc96b8e3a1761733fc1aad09c2de38a3c1
REQUEST
RESPONSE
HEAD 200 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE
GET 206 http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 142.250.34.2:80 -> 192.168.56.102:49816 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 142.250.34.2:80 -> 192.168.56.102:49816 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 192.168.56.102:49815 -> 216.58.200.3:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.102:49815
216.58.200.3:443
C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com 4f:cf:dd:03:b1:91:8c:80:31:c6:81:55:56:99:09:8d:2e:99:33:f0

Snort Alerts

No Snort Alerts