Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://firebasestorage.googleapis.com/v0/b/godofdavid-5496b.appspot.com/o/BETA_Version_Plain%20(1).html?alt=media&token=86cc2a07-3bd8-4db1-afc6-b8baac5e56dc

Overview

General Information

Sample URL:https://firebasestorage.googleapis.com/v0/b/godofdavid-5496b.appspot.com/o/BETA_Version_Plain%20(1).html?alt=media&token=86cc2a07-3bd8-4db1-afc6-b8baac5e56dc
Analysis ID:1417292
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

No high impact signatures.

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 5100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 3236 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2176,i,10713326028764485362,1664639009554710148,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firebasestorage.googleapis.com/v0/b/godofdavid-5496b.appspot.com/o/BETA_Version_Plain%20(1).html?alt=media&token=86cc2a07-3bd8-4db1-afc6-b8baac5e56dc" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://firebasestorage.googleapis.com/v0/b/godofdavid-5496b.appspot.com/o/BETA_Version_Plain%20(1).html?alt=media&token=86cc2a07-3bd8-4db1-afc6-b8baac5e56dcHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.227.46
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.227.46
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.227.46
Source: unknownTCP traffic detected without corresponding DNS query: 23.221.227.46
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: unknownDNS traffic detected: queries for: www.google.com
Source: chromecache_41.2.drString found in binary or memory: https://console.firebase.google.com/project/godofdavid-5496b/storage/rules
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: classification engineClassification label: clean0.win@16/4@2/3
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2176,i,10713326028764485362,1664639009554710148,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firebasestorage.googleapis.com/v0/b/godofdavid-5496b.appspot.com/o/BETA_Version_Plain%20(1).html?alt=media&token=86cc2a07-3bd8-4db1-afc6-b8baac5e56dc"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2176,i,10713326028764485362,1664639009554710148,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1417292 URL: https://firebasestorage.goo... Startdate: 28/03/2024 Architecture: WINDOWS Score: 0 5 chrome.exe 1 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.4, 138, 443, 49723 unknown unknown 5->13 15 239.255.255.250 unknown Reserved 5->15 10 chrome.exe 5->10         started        process4 dnsIp5 17 www.google.com 172.253.122.104, 443, 49738, 49749 GOOGLEUS United States 10->17

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://firebasestorage.googleapis.com/v0/b/godofdavid-5496b.appspot.com/o/BETA_Version_Plain%20(1).html?alt=media&token=86cc2a07-3bd8-4db1-afc6-b8baac5e56dc0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
www.google.com
172.253.122.104
truefalse
    		high
    fp2e7a.wpc.phicdn.net
    		192.229.211.108
    		truefalse
      		unknown
      windowsupdatebg.s.llnwi.net
      		69.164.0.128
      		truefalse
        		unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://console.firebase.google.com/project/godofdavid-5496b/storage/ruleschromecache_41.2.drfalse
          		high

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          172.253.122.104
          		www.google.comUnited States
          		15169GOOGLEUSfalse
          239.255.255.250
          		unknownReserved
          		unknownunknownfalse

          Private

          IP
          192.168.2.4

          General Information

          Joe Sandbox version:40.0.0 Tourmaline
          Analysis ID:1417292
          Start date and time:2024-03-28 21:46:45 +01:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:0h 3m 4s
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:browseurl.jbs
          Sample URL:https://firebasestorage.googleapis.com/v0/b/godofdavid-5496b.appspot.com/o/BETA_Version_Plain%20(1).html?alt=media&token=86cc2a07-3bd8-4db1-afc6-b8baac5e56dc
          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
          Number of analysed new started processes analysed:8
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Detection:CLEAN
          Classification:clean0.win@16/4@2/3
          EGA Information:Failed
          HCA Information:
          • Successful, ratio: 100%
          • Number of executed functions: 0
          • Number of non-executed functions: 0

          Warnings

          • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
          • Excluded IPs from analysis (whitelisted): 142.251.167.94, 142.251.167.138, 142.251.167.100, 142.251.167.113, 142.251.167.101, 142.251.167.139, 142.251.167.102, 142.251.163.84, 34.104.35.123, 172.253.115.95, 142.251.111.95, 142.250.31.95, 142.251.167.95, 172.253.122.95, 142.251.16.95, 142.251.179.95, 172.253.62.95, 172.253.63.95, 142.251.163.95, 40.68.123.157, 69.164.0.128, 192.229.211.108, 20.3.187.198, 20.166.126.56, 142.251.16.94
          • Not all processes where analyzed, report is missing behavior information
          • Report size getting too big, too many NtSetInformationFile calls found.
          • VT rate limit hit for: https://firebasestorage.googleapis.com/v0/b/godofdavid-5496b.appspot.com/o/BETA_Version_Plain%20(1).html?alt=media&token=86cc2a07-3bd8-4db1-afc6-b8baac5e56dc

          Simulations

          Behavior and APIs

          ⊘No simulations

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          ⊘No context

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          Chrome Cache Entry: 41

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:JSON data
          Category:downloaded
          Size (bytes):233
          Entropy (8bit):4.665619307562845
          Encrypted:false
          SSDEEP:6:v/+aNSVFLtAVEeeyQ1FVDlxNWYvAjBJOJKR+zRLPFFb:JOuEeeyQXVPNfvAjBJPRO9Z
          MD5:2F8811D6F11768886205CA14CAE24115
          SHA1:738222263958E7A54AEAB420DEB59B8FD207CC0C
          SHA-256:14577CD854EA434B80D44A57061DBF3F60C4F7C22EDEAAA8F9FBFA2C37AF2F26
          SHA-512:C26580CE7811B189F52F3DB0DF482E2604E9FB8DF6EA97DEF725FD1683897F464282159FD4260A96A32BE1AB32D59B75CE27627CA76DFF0B7E857EF7F8D3CF69
          Malicious:false
          Reputation:low
          URL:https://firebasestorage.googleapis.com/v0/b/godofdavid-5496b.appspot.com/o/BETA_Version_Plain%20(1).html?alt=media&token=86cc2a07-3bd8-4db1-afc6-b8baac5e56dc
          Preview:{. "error": {. "code": 400,. "message": "Your bucket has not been set up properly for Firebase Storage. Please visit 'https://console.firebase.google.com/project/godofdavid-5496b/storage/rules' to set up security rules.". }.}

          Chrome Cache Entry: 42

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1136)
          Category:downloaded
          Size (bytes):1572
          Entropy (8bit):5.2647442020070505
          Encrypted:false
          SSDEEP:24:hY6svD+6zSU6pedQf3Zvcn1BZdAe1nCr1LTHI5z8xTOS8f:3qD+2+pUAew85zsT9A
          MD5:13FEC0C2FBF5C47C4608CE0C9405E5A7
          SHA1:DAFB6CA27CFD22E88A2D53150C4350FCA3D32A21
          SHA-256:7F25FD0260C4EF8C26A87A5A126634E846BA539C75E5D508103F4D98831654A5
          SHA-512:7B9C5B92CDB7C3CEA0B6B862EBE67F75D92C1F1A8D5AAFE771CA50A724E4AF7F3C1CA280CBC53BF3EA3FB6344C41D1BA06BC032FC9B408C3B30BD301239CD001
          Malicious:false
          Reputation:low
          URL:https://firebasestorage.googleapis.com/favicon.ico
          Preview:<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.

          Static File Info

          ⊘No static file info

          Network Behavior

          Network Port Distribution

          TCP Packets

          TimestampSource PortDest PortSource IPDest IP
          Mar 28, 2024 21:47:27.561950922 CET49675443192.168.2.4173.222.162.32
          Mar 28, 2024 21:47:27.671248913 CET49678443192.168.2.4104.46.162.224
          Mar 28, 2024 21:47:37.170389891 CET49675443192.168.2.4173.222.162.32
          Mar 28, 2024 21:47:38.018151999 CET49738443192.168.2.4172.253.122.104
          Mar 28, 2024 21:47:38.018182993 CET44349738172.253.122.104192.168.2.4
          Mar 28, 2024 21:47:38.018359900 CET49738443192.168.2.4172.253.122.104
          Mar 28, 2024 21:47:38.021271944 CET49738443192.168.2.4172.253.122.104
          Mar 28, 2024 21:47:38.021286964 CET44349738172.253.122.104192.168.2.4
          Mar 28, 2024 21:47:38.224606991 CET49739443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.224636078 CET4434973923.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.224973917 CET49739443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.226901054 CET49739443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.226910114 CET4434973923.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.243803978 CET44349738172.253.122.104192.168.2.4
          Mar 28, 2024 21:47:38.244466066 CET49738443192.168.2.4172.253.122.104
          Mar 28, 2024 21:47:38.244482040 CET44349738172.253.122.104192.168.2.4
          Mar 28, 2024 21:47:38.245476007 CET44349738172.253.122.104192.168.2.4
          Mar 28, 2024 21:47:38.245666981 CET49738443192.168.2.4172.253.122.104
          Mar 28, 2024 21:47:38.247536898 CET49738443192.168.2.4172.253.122.104
          Mar 28, 2024 21:47:38.247602940 CET44349738172.253.122.104192.168.2.4
          Mar 28, 2024 21:47:38.294972897 CET49738443192.168.2.4172.253.122.104
          Mar 28, 2024 21:47:38.294984102 CET44349738172.253.122.104192.168.2.4
          Mar 28, 2024 21:47:38.342372894 CET49738443192.168.2.4172.253.122.104
          Mar 28, 2024 21:47:38.447865009 CET4434973923.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.448240042 CET49739443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.451725006 CET49739443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.451740026 CET4434973923.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.452022076 CET4434973923.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.498409033 CET49739443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.581042051 CET49739443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.628226995 CET4434973923.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.691591978 CET4434973923.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.691649914 CET4434973923.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.691689014 CET49739443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.691735983 CET49739443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.691749096 CET4434973923.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.691761017 CET49739443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.691766977 CET4434973923.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.721038103 CET49740443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.721069098 CET4434974023.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.721133947 CET49740443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.721395016 CET49740443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.721406937 CET4434974023.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.930790901 CET4434974023.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.930859089 CET49740443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.932046890 CET49740443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.932056904 CET4434974023.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.932285070 CET4434974023.51.58.94192.168.2.4
          Mar 28, 2024 21:47:38.933314085 CET49740443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:38.976242065 CET4434974023.51.58.94192.168.2.4
          Mar 28, 2024 21:47:39.135124922 CET4434974023.51.58.94192.168.2.4
          Mar 28, 2024 21:47:39.135256052 CET4434974023.51.58.94192.168.2.4
          Mar 28, 2024 21:47:39.135381937 CET49740443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:39.136653900 CET49740443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:39.136674881 CET4434974023.51.58.94192.168.2.4
          Mar 28, 2024 21:47:39.136683941 CET49740443192.168.2.423.51.58.94
          Mar 28, 2024 21:47:39.136688948 CET4434974023.51.58.94192.168.2.4
          Mar 28, 2024 21:47:48.251852036 CET44349738172.253.122.104192.168.2.4
          Mar 28, 2024 21:47:48.251924992 CET44349738172.253.122.104192.168.2.4
          Mar 28, 2024 21:47:48.251987934 CET49738443192.168.2.4172.253.122.104
          Mar 28, 2024 21:47:49.797066927 CET49738443192.168.2.4172.253.122.104
          Mar 28, 2024 21:47:49.797090054 CET44349738172.253.122.104192.168.2.4
          Mar 28, 2024 21:48:37.970756054 CET49749443192.168.2.4172.253.122.104
          Mar 28, 2024 21:48:37.970777035 CET44349749172.253.122.104192.168.2.4
          Mar 28, 2024 21:48:37.970901012 CET49749443192.168.2.4172.253.122.104
          Mar 28, 2024 21:48:37.971575975 CET49749443192.168.2.4172.253.122.104
          Mar 28, 2024 21:48:37.971587896 CET44349749172.253.122.104192.168.2.4
          Mar 28, 2024 21:48:38.216054916 CET44349749172.253.122.104192.168.2.4
          Mar 28, 2024 21:48:38.216384888 CET49749443192.168.2.4172.253.122.104
          Mar 28, 2024 21:48:38.216397047 CET44349749172.253.122.104192.168.2.4
          Mar 28, 2024 21:48:38.216685057 CET44349749172.253.122.104192.168.2.4
          Mar 28, 2024 21:48:38.217955112 CET49749443192.168.2.4172.253.122.104
          Mar 28, 2024 21:48:38.218010902 CET44349749172.253.122.104192.168.2.4
          Mar 28, 2024 21:48:38.263995886 CET49749443192.168.2.4172.253.122.104
          Mar 28, 2024 21:48:46.608059883 CET4972380192.168.2.423.221.227.46
          Mar 28, 2024 21:48:46.608401060 CET4972480192.168.2.423.221.227.46
          Mar 28, 2024 21:48:46.702629089 CET804972323.221.227.46192.168.2.4
          Mar 28, 2024 21:48:46.702689886 CET4972380192.168.2.423.221.227.46
          Mar 28, 2024 21:48:46.702909946 CET804972423.221.227.46192.168.2.4
          Mar 28, 2024 21:48:46.702958107 CET4972480192.168.2.423.221.227.46
          Mar 28, 2024 21:48:48.208796024 CET44349749172.253.122.104192.168.2.4
          Mar 28, 2024 21:48:48.208858967 CET44349749172.253.122.104192.168.2.4
          Mar 28, 2024 21:48:48.208939075 CET49749443192.168.2.4172.253.122.104
          Mar 28, 2024 21:48:49.914020061 CET49749443192.168.2.4172.253.122.104
          Mar 28, 2024 21:48:49.914047956 CET44349749172.253.122.104192.168.2.4

          UDP Packets

          TimestampSource PortDest PortSource IPDest IP
          Mar 28, 2024 21:47:33.471057892 CET53503521.1.1.1192.168.2.4
          Mar 28, 2024 21:47:33.474250078 CET53619771.1.1.1192.168.2.4
          Mar 28, 2024 21:47:34.307097912 CET53506921.1.1.1192.168.2.4
          Mar 28, 2024 21:47:35.687072992 CET53650181.1.1.1192.168.2.4
          Mar 28, 2024 21:47:37.920166969 CET4993653192.168.2.41.1.1.1
          Mar 28, 2024 21:47:37.920166969 CET6117353192.168.2.41.1.1.1
          Mar 28, 2024 21:47:38.015265942 CET53499361.1.1.1192.168.2.4
          Mar 28, 2024 21:47:38.015420914 CET53611731.1.1.1192.168.2.4
          Mar 28, 2024 21:47:51.346295118 CET53503401.1.1.1192.168.2.4
          Mar 28, 2024 21:47:58.192509890 CET138138192.168.2.4192.168.2.255
          Mar 28, 2024 21:48:10.610791922 CET53524141.1.1.1192.168.2.4
          Mar 28, 2024 21:48:33.342133999 CET53503261.1.1.1192.168.2.4
          Mar 28, 2024 21:48:33.627000093 CET53521251.1.1.1192.168.2.4

          DNS Queries

          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Mar 28, 2024 21:47:37.920166969 CET192.168.2.41.1.1.10x8503Standard query (0)www.google.comA (IP address)IN (0x0001)false
          Mar 28, 2024 21:47:37.920166969 CET192.168.2.41.1.1.10x40f0Standard query (0)www.google.com65IN (0x0001)false

          DNS Answers

          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Mar 28, 2024 21:47:38.015265942 CET1.1.1.1192.168.2.40x8503No error (0)www.google.com172.253.122.104A (IP address)IN (0x0001)false
          Mar 28, 2024 21:47:38.015265942 CET1.1.1.1192.168.2.40x8503No error (0)www.google.com172.253.122.105A (IP address)IN (0x0001)false
          Mar 28, 2024 21:47:38.015265942 CET1.1.1.1192.168.2.40x8503No error (0)www.google.com172.253.122.106A (IP address)IN (0x0001)false
          Mar 28, 2024 21:47:38.015265942 CET1.1.1.1192.168.2.40x8503No error (0)www.google.com172.253.122.147A (IP address)IN (0x0001)false
          Mar 28, 2024 21:47:38.015265942 CET1.1.1.1192.168.2.40x8503No error (0)www.google.com172.253.122.99A (IP address)IN (0x0001)false
          Mar 28, 2024 21:47:38.015265942 CET1.1.1.1192.168.2.40x8503No error (0)www.google.com172.253.122.103A (IP address)IN (0x0001)false
          Mar 28, 2024 21:47:38.015420914 CET1.1.1.1192.168.2.40x40f0No error (0)www.google.com65IN (0x0001)false
          Mar 28, 2024 21:47:52.531423092 CET1.1.1.1192.168.2.40xc7bcNo error (0)windowsupdatebg.s.llnwi.net69.164.0.128A (IP address)IN (0x0001)false
          Mar 28, 2024 21:47:52.891165018 CET1.1.1.1192.168.2.40xb1adNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
          Mar 28, 2024 21:47:52.891165018 CET1.1.1.1192.168.2.40xb1adNo error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
          Mar 28, 2024 21:48:05.817991018 CET1.1.1.1192.168.2.40x7283No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
          Mar 28, 2024 21:48:05.817991018 CET1.1.1.1192.168.2.40x7283No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
          Mar 28, 2024 21:48:25.688292980 CET1.1.1.1192.168.2.40xc243No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
          Mar 28, 2024 21:48:25.688292980 CET1.1.1.1192.168.2.40xc243No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
          Mar 28, 2024 21:48:46.110223055 CET1.1.1.1192.168.2.40xcb82No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
          Mar 28, 2024 21:48:46.110223055 CET1.1.1.1192.168.2.40xcb82No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false

          HTTP Request Dependency Graph

          • fs.microsoft.com

          HTTPS Proxied Packets

          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          0192.168.2.44973923.51.58.94443
          TimestampBytes transferredDirectionData
          2024-03-28 20:47:38 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          Accept-Encoding: identity
          User-Agent: Microsoft BITS/7.8
          Host: fs.microsoft.com
          2024-03-28 20:47:38 UTC468INHTTP/1.1 200 OK
          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
          Content-Type: application/octet-stream
          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
          Server: ECAcc (chd/0758)
          X-CID: 11
          X-Ms-ApiVersion: Distribute 1.2
          X-Ms-Region: prod-eus2-z1
          Cache-Control: public, max-age=209795
          Date: Thu, 28 Mar 2024 20:47:38 GMT
          Connection: close
          X-CID: 2


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          1192.168.2.44974023.51.58.94443
          TimestampBytes transferredDirectionData
          2024-03-28 20:47:38 UTC239OUTGET /fs/windows/config.json HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          Accept-Encoding: identity
          If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
          Range: bytes=0-2147483646
          User-Agent: Microsoft BITS/7.8
          Host: fs.microsoft.com
          2024-03-28 20:47:39 UTC456INHTTP/1.1 200 OK
          ApiVersion: Distribute 1.1
          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
          Content-Type: application/octet-stream
          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
          Server: ECAcc (chd/0778)
          X-CID: 11
          Cache-Control: public, max-age=209661
          Date: Thu, 28 Mar 2024 20:47:39 GMT
          Content-Length: 55
          Connection: close
          X-CID: 2
          2024-03-28 20:47:39 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
          Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


          Statistics

          CPU Usage

          Click to jump to process

          Memory Usage

          Click to jump to process

          Behavior

          Click to jump to process

          System Behavior

          General

          Target ID:0
          Start time:21:47:30
          Start date:28/03/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
          Imagebase:0x7ff76e190000
          File size:3'242'272 bytes
          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:false

          General

          Target ID:2
          Start time:21:47:32
          Start date:28/03/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2176,i,10713326028764485362,1664639009554710148,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
          Imagebase:0x7ff76e190000
          File size:3'242'272 bytes
          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:false

          General

          Target ID:3
          Start time:21:47:34
          Start date:28/03/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firebasestorage.googleapis.com/v0/b/godofdavid-5496b.appspot.com/o/BETA_Version_Plain%20(1).html?alt=media&token=86cc2a07-3bd8-4db1-afc6-b8baac5e56dc"
          Imagebase:0x7ff76e190000
          File size:3'242'272 bytes
          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:true

          Disassembly

          ⊘No disassembly