Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://stratamedica.com/oHcP2R-tjmD2-zFwwR-XmQtT-vd0eQ80An1.php

Overview

General Information

Sample URL:https://stratamedica.com/oHcP2R-tjmD2-zFwwR-XmQtT-vd0eQ80An1.php
Analysis ID:1540330
Infos:
Errors
  • URL not reachable

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

No high impact signatures.

Classification

  • System is w10x64
  • chrome.exe (PID: 2084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 3448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1948,i,16906880219776420729,8256778495259294107,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://stratamedica.com/oHcP2R-tjmD2-zFwwR-XmQtT-vd0eQ80An1.php" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 2.16.100.168
Source: unknownTCP traffic detected without corresponding DNS query: 2.16.100.168
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficDNS traffic detected: DNS query: stratamedica.com
Source: global trafficDNS traffic detected: DNS query: google.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: classification engineClassification label: unknown0.win@19/0@12/3
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1948,i,16906880219776420729,8256778495259294107,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://stratamedica.com/oHcP2R-tjmD2-zFwwR-XmQtT-vd0eQ80An1.php"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1948,i,16906880219776420729,8256778495259294107,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection
1
Process Injection
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer
Traffic DuplicationData Destruction
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
google.com
216.58.206.78
truefalse
    unknown
    www.google.com
    216.58.206.36
    truefalse
      unknown
      fp2e7a.wpc.phicdn.net
      192.229.221.95
      truefalse
        unknown
        stratamedica.com
        unknown
        unknownfalse
          unknown
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          239.255.255.250
          unknownReserved
          unknownunknownfalse
          216.58.206.36
          www.google.comUnited States
          15169GOOGLEUSfalse
          IP
          192.168.2.4
          Joe Sandbox version:41.0.0 Charoite
          Analysis ID:1540330
          Start date and time:2024-10-23 16:54:08 +02:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:0h 2m 0s
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:browseurl.jbs
          Sample URL:https://stratamedica.com/oHcP2R-tjmD2-zFwwR-XmQtT-vd0eQ80An1.php
          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
          Number of analysed new started processes analysed:7
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • EGA enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Detection:UNKNOWN
          Classification:unknown0.win@19/0@12/3
          Cookbook Comments:
          • URL browsing timeout or error
          • URL not reachable
          • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
          • Excluded IPs from analysis (whitelisted): 142.250.185.131, 142.250.186.78, 64.233.184.84, 34.104.35.123, 4.175.87.197, 93.184.221.240, 20.242.39.171, 192.229.221.95
          • Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
          • Not all processes where analyzed, report is missing behavior information
          • Report size getting too big, too many NtSetInformationFile calls found.
          • VT rate limit hit for: https://stratamedica.com/oHcP2R-tjmD2-zFwwR-XmQtT-vd0eQ80An1.php
          No simulations
          No context
          No context
          No context
          No context
          No context
          No created / dropped files found
          No static file info
          TimestampSource PortDest PortSource IPDest IP
          Oct 23, 2024 16:55:21.505608082 CEST49737443192.168.2.4216.58.206.36
          Oct 23, 2024 16:55:21.505655050 CEST44349737216.58.206.36192.168.2.4
          Oct 23, 2024 16:55:21.505763054 CEST49737443192.168.2.4216.58.206.36
          Oct 23, 2024 16:55:21.506014109 CEST49737443192.168.2.4216.58.206.36
          Oct 23, 2024 16:55:21.506031036 CEST44349737216.58.206.36192.168.2.4
          Oct 23, 2024 16:55:21.740220070 CEST49738443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:21.740319014 CEST44349738184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:21.740425110 CEST49738443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:21.742137909 CEST49738443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:21.742177963 CEST44349738184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:22.363651991 CEST44349737216.58.206.36192.168.2.4
          Oct 23, 2024 16:55:22.363933086 CEST49737443192.168.2.4216.58.206.36
          Oct 23, 2024 16:55:22.363971949 CEST44349737216.58.206.36192.168.2.4
          Oct 23, 2024 16:55:22.364957094 CEST44349737216.58.206.36192.168.2.4
          Oct 23, 2024 16:55:22.365022898 CEST49737443192.168.2.4216.58.206.36
          Oct 23, 2024 16:55:22.366149902 CEST49737443192.168.2.4216.58.206.36
          Oct 23, 2024 16:55:22.366214991 CEST44349737216.58.206.36192.168.2.4
          Oct 23, 2024 16:55:22.419024944 CEST49737443192.168.2.4216.58.206.36
          Oct 23, 2024 16:55:22.419054985 CEST44349737216.58.206.36192.168.2.4
          Oct 23, 2024 16:55:22.464508057 CEST49737443192.168.2.4216.58.206.36
          Oct 23, 2024 16:55:22.605262041 CEST44349738184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:22.605359077 CEST49738443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:22.609153032 CEST49738443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:22.609178066 CEST44349738184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:22.609512091 CEST44349738184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:22.648494005 CEST49738443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:22.691376925 CEST44349738184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:22.893717051 CEST44349738184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:22.893780947 CEST44349738184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:22.893851995 CEST49738443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:22.893990993 CEST49738443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:22.894021988 CEST44349738184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:22.894048929 CEST49738443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:22.894063950 CEST44349738184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:22.931327105 CEST49739443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:22.931397915 CEST44349739184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:22.931688070 CEST49739443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:22.931953907 CEST49739443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:22.931988955 CEST44349739184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:24.672827005 CEST44349739184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:24.672904968 CEST49739443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:24.674410105 CEST49739443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:24.674422026 CEST44349739184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:24.674702883 CEST44349739184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:24.675873041 CEST49739443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:24.723330975 CEST44349739184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:25.171684027 CEST44349739184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:25.171751022 CEST44349739184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:25.171849012 CEST49739443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:25.173902988 CEST49739443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:25.173929930 CEST44349739184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:25.173966885 CEST49739443192.168.2.4184.28.90.27
          Oct 23, 2024 16:55:25.173973083 CEST44349739184.28.90.27192.168.2.4
          Oct 23, 2024 16:55:31.019644022 CEST4972380192.168.2.42.16.100.168
          Oct 23, 2024 16:55:31.025547981 CEST80497232.16.100.168192.168.2.4
          Oct 23, 2024 16:55:31.025599003 CEST4972380192.168.2.42.16.100.168
          Oct 23, 2024 16:55:32.356127977 CEST44349737216.58.206.36192.168.2.4
          Oct 23, 2024 16:55:32.356206894 CEST44349737216.58.206.36192.168.2.4
          Oct 23, 2024 16:55:32.356291056 CEST49737443192.168.2.4216.58.206.36
          Oct 23, 2024 16:55:33.457562923 CEST49737443192.168.2.4216.58.206.36
          Oct 23, 2024 16:55:33.457595110 CEST44349737216.58.206.36192.168.2.4
          TimestampSource PortDest PortSource IPDest IP
          Oct 23, 2024 16:55:17.221765041 CEST53578601.1.1.1192.168.2.4
          Oct 23, 2024 16:55:17.239337921 CEST53560931.1.1.1192.168.2.4
          Oct 23, 2024 16:55:18.662761927 CEST53579101.1.1.1192.168.2.4
          Oct 23, 2024 16:55:19.165719986 CEST5718653192.168.2.41.1.1.1
          Oct 23, 2024 16:55:19.165865898 CEST5662353192.168.2.41.1.1.1
          Oct 23, 2024 16:55:19.176584959 CEST53566231.1.1.1192.168.2.4
          Oct 23, 2024 16:55:19.176610947 CEST53571861.1.1.1192.168.2.4
          Oct 23, 2024 16:55:19.177308083 CEST6110453192.168.2.41.1.1.1
          Oct 23, 2024 16:55:19.209252119 CEST53611041.1.1.1192.168.2.4
          Oct 23, 2024 16:55:19.275505066 CEST6194153192.168.2.48.8.8.8
          Oct 23, 2024 16:55:19.276035070 CEST5353353192.168.2.41.1.1.1
          Oct 23, 2024 16:55:19.282740116 CEST53619418.8.8.8192.168.2.4
          Oct 23, 2024 16:55:19.284075022 CEST53535331.1.1.1192.168.2.4
          Oct 23, 2024 16:55:20.286120892 CEST5345453192.168.2.41.1.1.1
          Oct 23, 2024 16:55:20.286633015 CEST5491353192.168.2.41.1.1.1
          Oct 23, 2024 16:55:20.294842958 CEST53549131.1.1.1192.168.2.4
          Oct 23, 2024 16:55:20.297471046 CEST53534541.1.1.1192.168.2.4
          Oct 23, 2024 16:55:21.496408939 CEST5159253192.168.2.41.1.1.1
          Oct 23, 2024 16:55:21.496582031 CEST4941253192.168.2.41.1.1.1
          Oct 23, 2024 16:55:21.503822088 CEST53515921.1.1.1192.168.2.4
          Oct 23, 2024 16:55:21.504707098 CEST53494121.1.1.1192.168.2.4
          Oct 23, 2024 16:55:21.830125093 CEST138138192.168.2.4192.168.2.255
          Oct 23, 2024 16:55:25.309592009 CEST6269153192.168.2.41.1.1.1
          Oct 23, 2024 16:55:25.341029882 CEST6433253192.168.2.41.1.1.1
          Oct 23, 2024 16:55:25.341906071 CEST53626911.1.1.1192.168.2.4
          Oct 23, 2024 16:55:25.373651981 CEST53643321.1.1.1192.168.2.4
          Oct 23, 2024 16:55:25.388674021 CEST5829553192.168.2.41.1.1.1
          Oct 23, 2024 16:55:25.400336027 CEST53582951.1.1.1192.168.2.4
          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Oct 23, 2024 16:55:19.165719986 CEST192.168.2.41.1.1.10x6385Standard query (0)stratamedica.comA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:19.165865898 CEST192.168.2.41.1.1.10xef00Standard query (0)stratamedica.com65IN (0x0001)false
          Oct 23, 2024 16:55:19.177308083 CEST192.168.2.41.1.1.10xa4a5Standard query (0)stratamedica.comA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:19.275505066 CEST192.168.2.48.8.8.80x268aStandard query (0)google.comA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:19.276035070 CEST192.168.2.41.1.1.10x8d61Standard query (0)google.comA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:20.286120892 CEST192.168.2.41.1.1.10x3062Standard query (0)stratamedica.comA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:20.286633015 CEST192.168.2.41.1.1.10xc35aStandard query (0)stratamedica.com65IN (0x0001)false
          Oct 23, 2024 16:55:21.496408939 CEST192.168.2.41.1.1.10xe9b4Standard query (0)www.google.comA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:21.496582031 CEST192.168.2.41.1.1.10x612eStandard query (0)www.google.com65IN (0x0001)false
          Oct 23, 2024 16:55:25.309592009 CEST192.168.2.41.1.1.10x50a1Standard query (0)stratamedica.comA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:25.341029882 CEST192.168.2.41.1.1.10x606bStandard query (0)stratamedica.com65IN (0x0001)false
          Oct 23, 2024 16:55:25.388674021 CEST192.168.2.41.1.1.10xac58Standard query (0)stratamedica.comA (IP address)IN (0x0001)false
          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Oct 23, 2024 16:55:19.176584959 CEST1.1.1.1192.168.2.40xef00Name error (3)stratamedica.comnonenone65IN (0x0001)false
          Oct 23, 2024 16:55:19.176610947 CEST1.1.1.1192.168.2.40x6385Name error (3)stratamedica.comnonenoneA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:19.209252119 CEST1.1.1.1192.168.2.40xa4a5Name error (3)stratamedica.comnonenoneA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:19.282740116 CEST8.8.8.8192.168.2.40x268aNo error (0)google.com216.58.206.78A (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:19.284075022 CEST1.1.1.1192.168.2.40x8d61No error (0)google.com142.250.186.110A (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:20.294842958 CEST1.1.1.1192.168.2.40xc35aName error (3)stratamedica.comnonenone65IN (0x0001)false
          Oct 23, 2024 16:55:20.297471046 CEST1.1.1.1192.168.2.40x3062Name error (3)stratamedica.comnonenoneA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:21.503822088 CEST1.1.1.1192.168.2.40xe9b4No error (0)www.google.com216.58.206.36A (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:21.504707098 CEST1.1.1.1192.168.2.40x612eNo error (0)www.google.com65IN (0x0001)false
          Oct 23, 2024 16:55:25.341906071 CEST1.1.1.1192.168.2.40x50a1Name error (3)stratamedica.comnonenoneA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:25.373651981 CEST1.1.1.1192.168.2.40x606bName error (3)stratamedica.comnonenone65IN (0x0001)false
          Oct 23, 2024 16:55:25.400336027 CEST1.1.1.1192.168.2.40xac58Name error (3)stratamedica.comnonenoneA (IP address)IN (0x0001)false
          Oct 23, 2024 16:55:32.551167011 CEST1.1.1.1192.168.2.40x3421No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
          Oct 23, 2024 16:55:32.551167011 CEST1.1.1.1192.168.2.40x3421No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
          • fs.microsoft.com
          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          0192.168.2.449738184.28.90.27443
          TimestampBytes transferredDirectionData
          2024-10-23 14:55:22 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          Accept-Encoding: identity
          User-Agent: Microsoft BITS/7.8
          Host: fs.microsoft.com
          2024-10-23 14:55:22 UTC466INHTTP/1.1 200 OK
          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
          Content-Type: application/octet-stream
          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
          Server: ECAcc (lpl/EF06)
          X-CID: 11
          X-Ms-ApiVersion: Distribute 1.2
          X-Ms-Region: prod-neu-z1
          Cache-Control: public, max-age=93050
          Date: Wed, 23 Oct 2024 14:55:22 GMT
          Connection: close
          X-CID: 2


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          1192.168.2.449739184.28.90.27443
          TimestampBytes transferredDirectionData
          2024-10-23 14:55:24 UTC239OUTGET /fs/windows/config.json HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          Accept-Encoding: identity
          If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
          Range: bytes=0-2147483646
          User-Agent: Microsoft BITS/7.8
          Host: fs.microsoft.com
          2024-10-23 14:55:25 UTC514INHTTP/1.1 200 OK
          ApiVersion: Distribute 1.1
          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
          Content-Type: application/octet-stream
          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
          Server: ECAcc (lpl/EF06)
          X-CID: 11
          X-Ms-ApiVersion: Distribute 1.2
          X-Ms-Region: prod-weu-z1
          Cache-Control: public, max-age=93016
          Date: Wed, 23 Oct 2024 14:55:25 GMT
          Content-Length: 55
          Connection: close
          X-CID: 2
          2024-10-23 14:55:25 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
          Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


          Click to jump to process

          Click to jump to process

          Click to jump to process

          Target ID:0
          Start time:10:55:11
          Start date:23/10/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
          Imagebase:0x7ff76e190000
          File size:3'242'272 bytes
          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:false

          Target ID:2
          Start time:10:55:16
          Start date:23/10/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1948,i,16906880219776420729,8256778495259294107,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
          Imagebase:0x7ff76e190000
          File size:3'242'272 bytes
          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:false

          Target ID:3
          Start time:10:55:18
          Start date:23/10/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://stratamedica.com/oHcP2R-tjmD2-zFwwR-XmQtT-vd0eQ80An1.php"
          Imagebase:0x7ff76e190000
          File size:3'242'272 bytes
          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:true

          No disassembly