Edit tour

Windows Analysis Report
https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21

Overview

General Information

Sample URL:	https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21
Analysis ID:	1654912
Infos:

Detection

Phisher

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected Phisher

Creates files inside the system directory

Deletes files inside the Windows folder

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2436,i,8113637040498458872,6929868780144491918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2476 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6960 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_50	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security

Suricata Signatures

ETPRO EXPLOIT_KIT FoxTDS Initial Check

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-02T19:10:04.357069+0200	2859622	1	Exploit Kit Activity Detected	104.21.112.1	443	192.168.2.4	49735	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Apr 2025 17:10:05 GMTContent-Type: text/plain; charset=utf-8Content-Length: 0Connection: closeServer: cloudflareCache-Control: max-age=14400Cf-Cache-Status: EXPIREDCF-RAY: 92a1f00898fc18f2-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_50.2.dr

String found in binary or memory: https://www.solepo.com/26L8KP4B/7F8BZHTB/?sub1=21&sub2=674-109344&sub3=377-187807-18377

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 142.250.81.228:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.9.64:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.9.64:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.254:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir2672_607291378

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir2672_607291378

Jump to behavior

Source: classification engine

Classification label: mal56.phis.win@24/6@8/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2436,i,8113637040498458872,6929868780144491918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2476 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2436,i,8113637040498458872,6929868780144491918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2476 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
https://montgomeryan.click/favicon.ico	0%	Avira URL Cloud	safe
https://www.solepo.com/26L8KP4B/7F8BZHTB/?sub1=21&sub2=674-109344&sub3=377-187807-18377	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.solepo.com	104.21.9.64	true	false	unknown
www.google.com	142.250.81.228	true	false	high
montgomeryan.click	104.21.80.1	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.solepo.com/26L8KP4B/7F8BZHTB/?sub1=21&sub2=674-109344&sub3=377-187807-18377	false	Avira URL Cloud: safe	unknown
https://montgomeryan.click/t/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21	false		unknown
https://montgomeryan.click/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21	false		unknown
https://montgomeryan.click/favicon.ico	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.112.1	unknown	United States	13335	CLOUDFLARENETUS	true
104.21.9.64	www.solepo.com	United States	13335	CLOUDFLARENETUS	false
142.250.81.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1654912
Start date and time:	2025-04-02 19:08:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@24/6@8/4

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.35.174, 142.251.40.238, 142.251.167.84, 142.250.80.35, 142.250.81.238, 172.217.165.142, 142.251.41.14, 142.250.80.78, 142.251.32.123, 142.251.40.251, 142.250.80.123, 142.251.35.187, 142.251.40.187, 142.250.80.91, 142.250.176.219, 142.250.64.91, 142.251.40.155, 142.251.40.123, 142.250.80.27, 142.250.80.59, 142.250.72.123, 142.251.40.219, 142.251.41.27, 142.250.64.123, 23.203.176.221, 142.251.40.174, 142.250.80.14, 172.217.165.131, 142.250.65.163, 184.31.69.3, 172.202.163.200
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (398)
Category:	downloaded
Size (bytes):	458
Entropy (8bit):	5.131460290374407
Encrypted:	false
SSDEEP:	12:8AaJ+dAW1FTWoK9xGixFoBwdNDJNZUSbZkXCABHRsqq+7p:8bJOAWYragNvZUSuzRsqZp
MD5:	0A3E69B8B37A6DF0ACD7E7F5D9D3B854
SHA1:	680DE96CFE2AFF1B030BFBD4A7CFA2529993EA61
SHA-256:	0F3A07F36D6BDDEE418F7D7548BC165B09817E10764A359D2773388CDEC9FF8A
SHA-512:	9C5C0679E082A5776536835110B90436CD6531E3B2C4FC7A15BDCE7F550D6647447C904E68D660FAF81E39C108E17198830E8B133E86D8559180FA6FB5CE25C7
Malicious:	false
Reputation:	low
URL:	https://montgomeryan.click/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21
Preview:	<script>.let e=new URL(window.location.href);e.pathname="/t"+e.pathname;let o=e.toString();navigator.cookieEnabled&&!function(e){for(var o=["googlebot","bingbot","yandexbot","duckduckbot","slurp","baiduspider","facebot","ia_archiver"],t=e.toLowerCase(),n=0;n<o.length;n++)if(t.indexOf(o[n])>-1)return!0;return!1}(navigator.userAgent)?setTimeout((function(){document.location.href=o}),1e3):console.log("bt");.</script>..<p style="color:gray;">redirect...</p>.

Chrome Cache Entry: 49

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	248
Entropy (8bit):	5.016754793032702
Encrypted:	false
SSDEEP:	6:7iQI4ySmfrVQTlUFFVjx7YCL7YmmTwWYvLYb:7lkZQob7MxTjYDYb
MD5:	4D8CD659566F9D5A6712FBC1A89A6D25
SHA1:	C6EF2AECAC529B60EFA9A3F4F48017C4BDB03898
SHA-256:	B47A658F91F43DA24763FFBB0FE873590FA927B97E48A56CF2519B721112F79F
SHA-512:	4ADF72C1695E079E26143EBDC9C7F5B4AAD8801353914CB2F5D32E9C53A009DE1749AA694FC44F5211D8D0367A1B75615E9D52A39B7760C716EE6923FDA797E5
Malicious:	false
Reputation:	low
URL:	https://storage.googleapis.com/m030325nw/0203010214585.html
Preview:	<script>..var tarcking_param = window.location.href.split('#')[1];..var srv_ip = "montgomeryan.click";..if(!tarcking_param){..alert("please set tracking params!");..}else{..document.location.href = 'http://'+srv_ip+'/'+tarcking_param;..}..</script>

Chrome Cache Entry: 50

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	300
Entropy (8bit):	5.428347272416274
Encrypted:	false
SSDEEP:	6:uIRnXHFmmmUL+s73nzXHZJKSK1YGL+s73nzXHfu/VMCGYoVL:lXHAxAX1pyXy9IL
MD5:	4B25849C84C3FD86227B562313FB5E8E
SHA1:	336078E5BE420EF9B2D8F3A204DBEC9B7A7BD15A
SHA-256:	83728473588929ED6ABE40689432EE5CB8D99808B0782B0A271C4BA085EDD508
SHA-512:	EB67C5411C52E8C1DB93B874A1E7FB144F8A713C2C625D51592CF12D7AE6871753AAD947558206773BC710A04D4F32D055E6A33435A65AE59D4CADC49DB41D9B
Malicious:	false
Reputation:	low
URL:	https://montgomeryan.click/t/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21
Preview:	<script>.setTimeout(function(){. window.location.href = 'https://www.solepo.com/26L8KP4B/7F8BZHTB/?sub1=21&sub2=674-109344&sub3=377-187807-18377'; . console.log('redirecting to https://www.solepo.com/26L8KP4B/7F8BZHTB/?sub1=21&sub2=674-109344&sub3=377-187807-18377');.}, 1000);.</script>.<p></p>.

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-04-02T19:10:04.357069+0200	2859622	ETPRO EXPLOIT_KIT FoxTDS Initial Check	1	104.21.112.1	443	192.168.2.4	49735	TCP

Network Port Distribution

Total Packets: 102
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2025 19:09:55.410475016 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 19:09:55.720091105 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 19:09:56.376627922 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 19:09:57.619090080 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 19:09:59.897188902 CEST	49728	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:09:59.897237062 CEST	443	49728	142.250.81.228	192.168.2.4
Apr 2, 2025 19:09:59.897294044 CEST	49728	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:09:59.897514105 CEST	49728	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:09:59.897524118 CEST	443	49728	142.250.81.228	192.168.2.4
Apr 2, 2025 19:10:00.032278061 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 19:10:00.155230045 CEST	443	49728	142.250.81.228	192.168.2.4
Apr 2, 2025 19:10:00.155312061 CEST	49728	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:10:00.156482935 CEST	49728	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:10:00.156493902 CEST	443	49728	142.250.81.228	192.168.2.4
Apr 2, 2025 19:10:00.156887054 CEST	443	49728	142.250.81.228	192.168.2.4
Apr 2, 2025 19:10:00.204112053 CEST	49728	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:10:03.557559013 CEST	49735	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:03.557647943 CEST	443	49735	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:03.557734013 CEST	49735	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:03.558034897 CEST	49735	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:03.558093071 CEST	443	49735	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:03.794697046 CEST	443	49735	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:03.794898033 CEST	49735	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:03.795903921 CEST	49735	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:03.795931101 CEST	443	49735	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:03.796442986 CEST	443	49735	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:03.796720028 CEST	49735	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:03.840265989 CEST	443	49735	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:04.128966093 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 19:10:04.356515884 CEST	443	49735	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:04.356807947 CEST	443	49735	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:04.356900930 CEST	49735	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:04.424339056 CEST	49735	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:04.424401999 CEST	443	49735	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:04.437330008 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 19:10:04.491683006 CEST	49736	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:04.491784096 CEST	443	49736	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:04.491863012 CEST	49736	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:04.492001057 CEST	49736	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:04.492024899 CEST	443	49736	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:04.717488050 CEST	443	49736	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:04.717896938 CEST	49736	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:04.717953920 CEST	443	49736	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:04.717998981 CEST	49736	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:04.718010902 CEST	443	49736	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:04.844444990 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 19:10:05.039112091 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 19:10:05.276726007 CEST	443	49736	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.276865005 CEST	443	49736	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.276942968 CEST	49736	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.282995939 CEST	49736	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.283061028 CEST	443	49736	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.476782084 CEST	49738	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.476876020 CEST	443	49738	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.476949930 CEST	49738	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.477082014 CEST	49739	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.477138996 CEST	443	49739	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.477184057 CEST	49739	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.477682114 CEST	49739	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.477699995 CEST	443	49739	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.477777004 CEST	49738	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.477807999 CEST	443	49738	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.775609016 CEST	443	49739	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.799730062 CEST	49739	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.799770117 CEST	443	49739	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.800267935 CEST	49739	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.800275087 CEST	443	49739	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.848372936 CEST	443	49738	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:05.848612070 CEST	49738	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:05.848649025 CEST	443	49738	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:06.250948906 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 19:10:06.584147930 CEST	443	49739	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:06.584290981 CEST	443	49739	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:06.584350109 CEST	49739	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:06.585602045 CEST	49739	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:06.585621119 CEST	443	49739	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:07.589553118 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 19:10:07.755970955 CEST	49741	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.756056070 CEST	443	49741	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:07.756169081 CEST	49741	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.756297112 CEST	49742	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.756383896 CEST	443	49742	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:07.756468058 CEST	49742	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.756503105 CEST	49741	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.756526947 CEST	443	49741	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:07.756587982 CEST	49742	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.756612062 CEST	443	49742	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:07.896562099 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 19:10:07.987303972 CEST	443	49742	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:07.987520933 CEST	49742	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.988822937 CEST	49742	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.988848925 CEST	443	49742	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:07.989262104 CEST	443	49742	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:07.989506006 CEST	49742	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.995242119 CEST	443	49741	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:07.995331049 CEST	49741	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.996570110 CEST	49741	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:07.996597052 CEST	443	49741	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:07.997004032 CEST	443	49741	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:08.032314062 CEST	443	49742	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:08.048938990 CEST	49741	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:08.290163040 CEST	49709	443	192.168.2.4	131.253.33.254
Apr 2, 2025 19:10:08.290502071 CEST	49709	443	192.168.2.4	131.253.33.254
Apr 2, 2025 19:10:08.290503025 CEST	49709	443	192.168.2.4	131.253.33.254
Apr 2, 2025 19:10:08.396452904 CEST	443	49709	131.253.33.254	192.168.2.4
Apr 2, 2025 19:10:08.396840096 CEST	443	49709	131.253.33.254	192.168.2.4
Apr 2, 2025 19:10:08.396974087 CEST	443	49709	131.253.33.254	192.168.2.4
Apr 2, 2025 19:10:08.397030115 CEST	49743	443	192.168.2.4	131.253.33.254
Apr 2, 2025 19:10:08.397115946 CEST	443	49743	131.253.33.254	192.168.2.4
Apr 2, 2025 19:10:08.397197008 CEST	49743	443	192.168.2.4	131.253.33.254
Apr 2, 2025 19:10:08.399405956 CEST	49743	443	192.168.2.4	131.253.33.254
Apr 2, 2025 19:10:08.399432898 CEST	443	49743	131.253.33.254	192.168.2.4
Apr 2, 2025 19:10:08.501236916 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 19:10:08.658288002 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 19:10:08.737571001 CEST	443	49743	131.253.33.254	192.168.2.4
Apr 2, 2025 19:10:08.737658024 CEST	49743	443	192.168.2.4	131.253.33.254
Apr 2, 2025 19:10:08.842999935 CEST	443	49742	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:08.843152046 CEST	443	49742	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:08.843230963 CEST	49742	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:08.843776941 CEST	49742	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:08.843815088 CEST	443	49742	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:09.703668118 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 19:10:10.140486002 CEST	443	49728	142.250.81.228	192.168.2.4
Apr 2, 2025 19:10:10.140600920 CEST	443	49728	142.250.81.228	192.168.2.4
Apr 2, 2025 19:10:10.140650034 CEST	49728	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:10:10.770481110 CEST	49728	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:10:10.770509958 CEST	443	49728	142.250.81.228	192.168.2.4
Apr 2, 2025 19:10:12.110443115 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 19:10:13.469935894 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 19:10:14.454293966 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 19:10:16.923018932 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 19:10:20.834857941 CEST	443	49738	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:20.835042000 CEST	443	49738	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:20.835114002 CEST	49738	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:22.773349047 CEST	49738	443	192.168.2.4	104.21.112.1
Apr 2, 2025 19:10:22.773437977 CEST	443	49738	104.21.112.1	192.168.2.4
Apr 2, 2025 19:10:22.972058058 CEST	443	49741	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:22.972137928 CEST	443	49741	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:22.972343922 CEST	49741	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:23.072839975 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 19:10:24.763592958 CEST	49741	443	192.168.2.4	104.21.9.64
Apr 2, 2025 19:10:24.763655901 CEST	443	49741	104.21.9.64	192.168.2.4
Apr 2, 2025 19:10:26.528903961 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 19:10:43.032130003 CEST	49713	80	192.168.2.4	142.250.65.195
Apr 2, 2025 19:10:43.032222033 CEST	49715	80	192.168.2.4	199.232.210.172
Apr 2, 2025 19:10:43.032248020 CEST	49717	80	192.168.2.4	199.232.210.172
Apr 2, 2025 19:10:43.128091097 CEST	80	49715	199.232.210.172	192.168.2.4
Apr 2, 2025 19:10:43.128145933 CEST	80	49715	199.232.210.172	192.168.2.4
Apr 2, 2025 19:10:43.128307104 CEST	49715	80	192.168.2.4	199.232.210.172
Apr 2, 2025 19:10:43.129395008 CEST	80	49713	142.250.65.195	192.168.2.4
Apr 2, 2025 19:10:43.129471064 CEST	49713	80	192.168.2.4	142.250.65.195
Apr 2, 2025 19:10:43.130125046 CEST	80	49717	199.232.210.172	192.168.2.4
Apr 2, 2025 19:10:43.130158901 CEST	80	49717	199.232.210.172	192.168.2.4
Apr 2, 2025 19:10:43.130213976 CEST	49717	80	192.168.2.4	199.232.210.172
Apr 2, 2025 19:10:43.738470078 CEST	49714	443	192.168.2.4	23.33.40.132
Apr 2, 2025 19:10:43.738480091 CEST	49716	80	192.168.2.4	199.232.210.172
Apr 2, 2025 19:10:59.830451012 CEST	49749	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:10:59.830506086 CEST	443	49749	142.250.81.228	192.168.2.4
Apr 2, 2025 19:10:59.830858946 CEST	49749	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:10:59.831017971 CEST	49749	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:10:59.831032991 CEST	443	49749	142.250.81.228	192.168.2.4
Apr 2, 2025 19:11:00.036948919 CEST	443	49749	142.250.81.228	192.168.2.4
Apr 2, 2025 19:11:00.037369013 CEST	49749	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:11:00.037409067 CEST	443	49749	142.250.81.228	192.168.2.4
Apr 2, 2025 19:11:10.035696983 CEST	443	49749	142.250.81.228	192.168.2.4
Apr 2, 2025 19:11:10.035823107 CEST	443	49749	142.250.81.228	192.168.2.4
Apr 2, 2025 19:11:10.035881996 CEST	49749	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:11:10.769483089 CEST	49749	443	192.168.2.4	142.250.81.228
Apr 2, 2025 19:11:10.769514084 CEST	443	49749	142.250.81.228	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2025 19:09:56.637607098 CEST	53	63716	1.1.1.1	192.168.2.4
Apr 2, 2025 19:09:56.638257027 CEST	53	63061	1.1.1.1	192.168.2.4
Apr 2, 2025 19:09:57.306520939 CEST	53	61808	1.1.1.1	192.168.2.4
Apr 2, 2025 19:09:57.439644098 CEST	53	54032	1.1.1.1	192.168.2.4
Apr 2, 2025 19:09:59.768044949 CEST	60631	53	192.168.2.4	1.1.1.1
Apr 2, 2025 19:09:59.768181086 CEST	54856	53	192.168.2.4	1.1.1.1
Apr 2, 2025 19:09:59.873651981 CEST	53	60631	1.1.1.1	192.168.2.4
Apr 2, 2025 19:09:59.896295071 CEST	53	54856	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:02.779448986 CEST	53	64424	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:03.392473936 CEST	62252	53	192.168.2.4	1.1.1.1
Apr 2, 2025 19:10:03.392595053 CEST	58895	53	192.168.2.4	1.1.1.1
Apr 2, 2025 19:10:03.425229073 CEST	54793	53	192.168.2.4	1.1.1.1
Apr 2, 2025 19:10:03.425450087 CEST	58630	53	192.168.2.4	1.1.1.1
Apr 2, 2025 19:10:03.512598991 CEST	53	58895	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:03.521509886 CEST	53	62252	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:03.544693947 CEST	53	54793	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:03.556987047 CEST	53	58630	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:07.638668060 CEST	57768	53	192.168.2.4	1.1.1.1
Apr 2, 2025 19:10:07.639094114 CEST	54409	53	192.168.2.4	1.1.1.1
Apr 2, 2025 19:10:07.754838943 CEST	53	54409	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:07.755352974 CEST	53	57768	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:14.466742992 CEST	53	52719	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:33.394610882 CEST	53	55968	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:55.845840931 CEST	53	59939	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:56.337413073 CEST	53	58106	1.1.1.1	192.168.2.4
Apr 2, 2025 19:10:58.143425941 CEST	53	57782	1.1.1.1	192.168.2.4
Apr 2, 2025 19:11:03.649005890 CEST	138	138	192.168.2.4	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 2, 2025 19:10:03.521560907 CEST	192.168.2.4	1.1.1.1	c258	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 2, 2025 19:09:59.768044949 CEST	192.168.2.4	1.1.1.1	0x3827	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:09:59.768181086 CEST	192.168.2.4	1.1.1.1	0xdc0b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 2, 2025 19:10:03.392473936 CEST	192.168.2.4	1.1.1.1	0x7a9d	Standard query (0)	montgomeryan.click	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.392595053 CEST	192.168.2.4	1.1.1.1	0xa8f2	Standard query (0)	montgomeryan.click	65	IN (0x0001)	false
Apr 2, 2025 19:10:03.425229073 CEST	192.168.2.4	1.1.1.1	0x1388	Standard query (0)	montgomeryan.click	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.425450087 CEST	192.168.2.4	1.1.1.1	0x92fe	Standard query (0)	montgomeryan.click	65	IN (0x0001)	false
Apr 2, 2025 19:10:07.638668060 CEST	192.168.2.4	1.1.1.1	0x74cf	Standard query (0)	www.solepo.com	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:07.639094114 CEST	192.168.2.4	1.1.1.1	0x8110	Standard query (0)	www.solepo.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 2, 2025 19:09:59.873651981 CEST	1.1.1.1	192.168.2.4	0x3827	No error (0)	www.google.com	142.250.81.228	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:09:59.896295071 CEST	1.1.1.1	192.168.2.4	0xdc0b	No error (0)	www.google.com		65	IN (0x0001)	false
Apr 2, 2025 19:10:03.512598991 CEST	1.1.1.1	192.168.2.4	0xa8f2	No error (0)	montgomeryan.click		65	IN (0x0001)	false
Apr 2, 2025 19:10:03.521509886 CEST	1.1.1.1	192.168.2.4	0x7a9d	No error (0)	montgomeryan.click	104.21.80.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.521509886 CEST	1.1.1.1	192.168.2.4	0x7a9d	No error (0)	montgomeryan.click	104.21.112.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.521509886 CEST	1.1.1.1	192.168.2.4	0x7a9d	No error (0)	montgomeryan.click	104.21.16.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.521509886 CEST	1.1.1.1	192.168.2.4	0x7a9d	No error (0)	montgomeryan.click	104.21.32.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.521509886 CEST	1.1.1.1	192.168.2.4	0x7a9d	No error (0)	montgomeryan.click	104.21.48.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.521509886 CEST	1.1.1.1	192.168.2.4	0x7a9d	No error (0)	montgomeryan.click	104.21.64.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.521509886 CEST	1.1.1.1	192.168.2.4	0x7a9d	No error (0)	montgomeryan.click	104.21.96.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.544693947 CEST	1.1.1.1	192.168.2.4	0x1388	No error (0)	montgomeryan.click	104.21.112.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.544693947 CEST	1.1.1.1	192.168.2.4	0x1388	No error (0)	montgomeryan.click	104.21.16.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.544693947 CEST	1.1.1.1	192.168.2.4	0x1388	No error (0)	montgomeryan.click	104.21.96.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.544693947 CEST	1.1.1.1	192.168.2.4	0x1388	No error (0)	montgomeryan.click	104.21.48.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.544693947 CEST	1.1.1.1	192.168.2.4	0x1388	No error (0)	montgomeryan.click	104.21.32.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.544693947 CEST	1.1.1.1	192.168.2.4	0x1388	No error (0)	montgomeryan.click	104.21.80.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.544693947 CEST	1.1.1.1	192.168.2.4	0x1388	No error (0)	montgomeryan.click	104.21.64.1	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:03.556987047 CEST	1.1.1.1	192.168.2.4	0x92fe	No error (0)	montgomeryan.click		65	IN (0x0001)	false
Apr 2, 2025 19:10:07.754838943 CEST	1.1.1.1	192.168.2.4	0x8110	No error (0)	www.solepo.com		65	IN (0x0001)	false
Apr 2, 2025 19:10:07.755352974 CEST	1.1.1.1	192.168.2.4	0x74cf	No error (0)	www.solepo.com	104.21.9.64	A (IP address)	IN (0x0001)	false
Apr 2, 2025 19:10:07.755352974 CEST	1.1.1.1	192.168.2.4	0x74cf	No error (0)	www.solepo.com	172.67.159.49	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

montgomeryan.click

www.solepo.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	104.21.112.1	443	6132	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-02 17:10:03 UTC	719	OUT	GET /4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21 HTTP/1.1 Host: montgomeryan.click Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 17:10:04 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 17:10:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cf-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 92a1f002c944dafc-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 17:10:04 UTC	465	IN	Data Raw: 31 63 61 0d 0a 3c 73 63 72 69 70 74 3e 0a 6c 65 74 20 65 3d 6e 65 77 20 55 52 4c 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 65 2e 70 61 74 68 6e 61 6d 65 3d 22 2f 74 22 2b 65 2e 70 61 74 68 6e 61 6d 65 3b 6c 65 74 20 6f 3d 65 2e 74 6f 53 74 72 69 6e 67 28 29 3b 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 26 26 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 6f 3d 5b 22 67 6f 6f 67 6c 65 62 6f 74 22 2c 22 62 69 6e 67 62 6f 74 22 2c 22 79 61 6e 64 65 78 62 6f 74 22 2c 22 64 75 63 6b 64 75 63 6b 62 6f 74 22 2c 22 73 6c 75 72 70 22 2c 22 62 61 69 64 75 73 70 69 64 65 72 22 2c 22 66 61 63 65 62 6f 74 22 2c 22 69 61 5f 61 72 63 68 69 76 65 72 22 5d 2c 74 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 Data Ascii: 1ca<script>let e=new URL(window.location.href);e.pathname="/t"+e.pathname;let o=e.toString();navigator.cookieEnabled&&!function(e){for(var o=["googlebot","bingbot","yandexbot","duckduckbot","slurp","baiduspider","facebot","ia_archiver"],t=e.toLowerCase
2025-04-02 17:10:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	104.21.112.1	443	6132	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-02 17:10:04 UTC	664	OUT	GET /favicon.ico HTTP/1.1 Host: montgomeryan.click Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://montgomeryan.click/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 17:10:05 UTC	278	IN	HTTP/1.1 404 Not Found Date: Wed, 02 Apr 2025 17:10:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 0 Connection: close Server: cloudflare Cache-Control: max-age=14400 Cf-Cache-Status: EXPIRED CF-RAY: 92a1f00898fc18f2-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	104.21.112.1	443	6132	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-02 17:10:05 UTC	825	OUT	GET /t/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21 HTTP/1.1 Host: montgomeryan.click Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://montgomeryan.click/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 17:10:06 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 17:10:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cf-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 92a1f00f9e9b2e7f-DFW alt-svc: h3=":443"; ma=86400
2025-04-02 17:10:06 UTC	307	IN	Data Raw: 31 32 63 0d 0a 3c 73 63 72 69 70 74 3e 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 6f 6c 65 70 6f 2e 63 6f 6d 2f 32 36 4c 38 4b 50 34 42 2f 37 46 38 42 5a 48 54 42 2f 3f 73 75 62 31 3d 32 31 26 73 75 62 32 3d 36 37 34 2d 31 30 39 33 34 34 26 73 75 62 33 3d 33 37 37 2d 31 38 37 38 30 37 2d 31 38 33 37 37 27 3b 20 0a 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 72 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 6f 6c 65 70 6f 2e 63 6f 6d 2f 32 36 4c 38 4b 50 34 42 2f 37 46 38 42 5a 48 54 42 2f 3f 73 75 62 31 3d 32 31 26 73 75 62 32 3d 36 37 34 2d 31 30 39 33 34 34 26 73 75 62 Data Ascii: 12c<script>setTimeout(function(){ window.location.href = 'https://www.solepo.com/26L8KP4B/7F8BZHTB/?sub1=21&sub2=674-109344&sub3=377-187807-18377'; console.log('redirecting to https://www.solepo.com/26L8KP4B/7F8BZHTB/?sub1=21&sub2=674-109344&sub
2025-04-02 17:10:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	104.21.9.64	443	6132	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-02 17:10:07 UTC	752	OUT	GET /26L8KP4B/7F8BZHTB/?sub1=21&sub2=674-109344&sub3=377-187807-18377 HTTP/1.1 Host: www.solepo.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://montgomeryan.click/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 17:10:08 UTC	316	IN	HTTP/1.1 204 No Content Date: Wed, 02 Apr 2025 17:10:08 GMT Connection: close Server: cloudflare Accept-Ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model Vary: Origin X-Eflow-Request-Id: 254a7455-48d2-476d-902f-83998d1eff93 Cf-Cache-Status: DYNAMIC CF-RAY: 92a1f01d09f4187f-EWR alt-svc: h3=":443"; ma=86400

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	1
Start time:	13:09:52
Start date:	02/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:09:54
Start date:	02/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2436,i,8113637040498458872,6929868780144491918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2476 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	13:10:01
Start date:	02/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Source: https://montgomeryan.click/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21	HTTP Parser: No favicon
Source: https://montgomeryan.click/t/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21	HTTP Parser: No favicon

Source: global traffic	HTTP traffic detected: GET /4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21 HTTP/1.1Host: montgomeryan.clickConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: montgomeryan.clickConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://montgomeryan.click/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /t/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21 HTTP/1.1Host: montgomeryan.clickConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://montgomeryan.click/4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /26L8KP4B/7F8BZHTB/?sub1=21&sub2=674-109344&sub3=377-187807-18377 HTTP/1.1Host: www.solepo.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://montgomeryan.click/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: montgomeryan.click
Source: global traffic	DNS traffic detected: DNS query: www.solepo.com

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.195
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.40.132
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 48

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Static File Info

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 2672, Parent PID: 3448

General

File Activities

File Opened

File Created

File Deleted

File Moved

Other File Operations

Registry Activities

Key Deleted

Windows Analysis Report
https://storage.googleapis.com/m030325nw/0203010214585.html#4dgBPD109344NHwX674ydbhwbcdjf377WZWJVQGWFRXHUDM187807FNMP18377G21