Hosts
No hosts contacted.
TCP
| Source |
Source Port |
Destination |
Destination Port |
| 192.168.56.101 |
49187 |
113.108.239.194 r1---sn-j5o7dn7e.gvt1.com |
80 |
| 192.168.56.101 |
49188 |
113.108.239.196 r3---sn-j5o7dn7e.gvt1.com |
80 |
| 192.168.56.101 |
49185 |
203.208.40.34 update.googleapis.com |
443 |
| 192.168.56.101 |
49186 |
203.208.41.65 redirector.gvt1.com |
80 |
| 192.168.56.101 |
49195 |
213.176.36.147 |
8080 |
UDP
| Source |
Source Port |
Destination |
Destination Port |
| 192.168.56.101 |
51808 |
114.114.114.114 |
53 |
| 192.168.56.101 |
51963 |
114.114.114.114 |
53 |
| 192.168.56.101 |
54260 |
114.114.114.114 |
53 |
| 192.168.56.101 |
54991 |
114.114.114.114 |
53 |
| 192.168.56.101 |
55368 |
114.114.114.114 |
53 |
| 192.168.56.101 |
60088 |
114.114.114.114 |
53 |
| 192.168.56.101 |
60123 |
114.114.114.114 |
53 |
| 192.168.56.101 |
60221 |
114.114.114.114 |
53 |
| 192.168.56.101 |
60384 |
114.114.114.114 |
53 |
| 192.168.56.101 |
137 |
192.168.56.255 |
137 |
| 192.168.56.101 |
138 |
192.168.56.255 |
138 |
| 192.168.56.101 |
123 |
20.189.79.72 time.windows.com |
123 |
| 192.168.56.101 |
49713 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
51378 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
53237 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
53380 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
56743 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
56804 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
57236 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
58367 |
224.0.0.252 |
5355 |
HTTP & HTTPS Requests
| URI |
Data |
| http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe |
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
|
| http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=f598ff10212f46&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619691854&mv=m |
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=f598ff10212f46&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619691854&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
|
| http://213.176.36.147:8080/eIOxvKYQKLwM7SL/99iBZwMDj/cpQ1yfoQqezcja/80FH5oQ2e8D/69WtLFBwvDmnzg702ij/2RQZg58JHsc5BI8/ |
POST /eIOxvKYQKLwM7SL/99iBZwMDj/cpQ1yfoQqezcja/80FH5oQ2e8D/69WtLFBwvDmnzg702ij/2RQZg58JHsc5BI8/ HTTP/1.1
Referer: http://213.176.36.147/eIOxvKYQKLwM7SL/99iBZwMDj/cpQ1yfoQqezcja/80FH5oQ2e8D/69WtLFBwvDmnzg702ij/2RQZg58JHsc5BI8/
Content-Type: multipart/form-data; boundary=---------------------------666492358911475
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 213.176.36.147:8080
Content-Length: 4532
Connection: Keep-Alive
Cache-Control: no-cache
|
| http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=f598ff10212f46&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619691854&mv=m |
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=f598ff10212f46&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619691854&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-7842
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
|
| http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619691613&mv=m&mvi=1&pl=23&shardbypass=yes |
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619691613&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com
|
| http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=f598ff10212f46&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619691854&mv=m |
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=f598ff10212f46&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619691854&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=7843-20726
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
|
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts