Edit tour

Windows Analysis Report
https://dt.r24dmp.de/

Overview

General Information

Sample URL:	https://dt.r24dmp.de/
Analysis ID:	1428707
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2012,i,12741340570266483771,6118006599820063687,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://dt.r24dmp.de/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: dt.r24dmp.de

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for submitted file

Source: https://dt.r24dmp.de/

Virustotal: Detection: 8%

Perma Link

Source: https://dt.r24dmp.de/

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.208.128.100:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.208.128.100:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.100
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: dt.r24dmp.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dt.r24dmp.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dt.r24dmp.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dt.r24dmp.deConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: unknown

DNS traffic detected: queries for: dt.r24dmp.de

Source: chromecache_40.2.dr

String found in binary or memory: https://dt.r24dmp.de/?rptds=

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.208.128.100:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.208.128.100:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@16/2@6/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2012,i,12741340570266483771,6118006599820063687,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://dt.r24dmp.de/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2012,i,12741340570266483771,6118006599820063687,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://dt.r24dmp.de/	9%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dt.r24dmp.de	9%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dt.r24dmp.de	216.239.34.21	true	false	9%, Virustotal, Browse	unknown
www.google.com	172.253.124.99	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://dt.r24dmp.de/	true		unknown
https://dt.r24dmp.de/favicon.ico	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dt.r24dmp.de/?rptds=	chromecache_40.2.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.253.124.99	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.239.34.21	dt.r24dmp.de	United States	15169	GOOGLEUS	false
216.239.36.21	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428707
Start date and time:	2024-04-19 12:29:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://dt.r24dmp.de/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@16/2@6/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.9.94, 172.217.215.102, 172.217.215.101, 172.217.215.139, 172.217.215.100, 172.217.215.113, 172.217.215.138, 172.253.124.84, 34.104.35.123, 52.165.165.26, 72.21.81.240, 192.229.211.108, 13.85.23.206, 13.95.31.18, 74.125.136.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 40

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	492
Entropy (8bit):	4.839474548012948
Encrypted:	false
SSDEEP:	12:EgRECFCljwRpTJqhgYu3Px9dg4TU/gMevDRWmozteKqgne+/je+wo:E7+ykJqhvufPdg4TfMe7RWmopeX+e+/F
MD5:	358FD101CCD6CBA48B4CC929ED47AD2E
SHA1:	A1A4AA3FD75E0CD3F7484D6EC29DB13B943CF9D3
SHA-256:	8BF75B0A73C0A4A7A6159B83188076C323343E74AD51461D5B4CA17F0EBF10F1
SHA-512:	F249C4FA2250AAB573ABEDCBF26897E72AAD55B5BA7E8BE4CAD1270DB00CF990B6E58E521C1B96C79A6A9369A1534A6BD589DED6F3FC045453EB86D0166E7A36
Malicious:	false
Reputation:	low
URL:	https://dt.r24dmp.de/
Preview:	.var rptdsref = "";.if(document.referrer) {. rptdsref = document.referrer.toString();.}.else {. rptdsref = window.location.href;.}.if(rptdsref != "") {. var rptds = document.createElement('script'); rptds.async = true; rptds.type = 'text/javascript';. rptds.src = 'https://dt.r24dmp.de/?rptds=' + encodeURIComponent(rptdsref);. var bodyElement = document.getElementsByTagName('body');. if (bodyElement && bodyElement[0]) {. bodyElement[0].appendChild(rptds);. }.}.

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 12:30:15.559087992 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 19, 2024 12:30:23.372277021 CEST	49735	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.372313976 CEST	443	49735	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.372391939 CEST	49735	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.373060942 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.373159885 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.373233080 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.373831034 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.373864889 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.374131918 CEST	49735	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.374150991 CEST	443	49735	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.595398903 CEST	443	49735	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.595772982 CEST	49735	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.595804930 CEST	443	49735	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.596761942 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.596894979 CEST	443	49735	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.596972942 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.597019911 CEST	49735	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.597033978 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.598170042 CEST	49735	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.598246098 CEST	443	49735	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.598339081 CEST	49735	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.598349094 CEST	443	49735	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.600445986 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.600522041 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.600790977 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.600878000 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.653181076 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.653227091 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.700608969 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.715890884 CEST	49735	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.917145014 CEST	443	49735	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.917232990 CEST	443	49735	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.917392969 CEST	49735	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.918121099 CEST	49735	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:23.918164015 CEST	443	49735	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:23.971322060 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:24.012162924 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:24.194220066 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:24.194505930 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:24.194611073 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:24.195599079 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:24.195647955 CEST	443	49736	216.239.34.21	192.168.2.4
Apr 19, 2024 12:30:24.195676088 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:24.195730925 CEST	49736	443	192.168.2.4	216.239.34.21
Apr 19, 2024 12:30:24.470093012 CEST	49739	443	192.168.2.4	216.239.36.21
Apr 19, 2024 12:30:24.470118046 CEST	443	49739	216.239.36.21	192.168.2.4
Apr 19, 2024 12:30:24.470196962 CEST	49739	443	192.168.2.4	216.239.36.21
Apr 19, 2024 12:30:24.470736027 CEST	49739	443	192.168.2.4	216.239.36.21
Apr 19, 2024 12:30:24.470748901 CEST	443	49739	216.239.36.21	192.168.2.4
Apr 19, 2024 12:30:24.693360090 CEST	443	49739	216.239.36.21	192.168.2.4
Apr 19, 2024 12:30:24.710051060 CEST	49739	443	192.168.2.4	216.239.36.21
Apr 19, 2024 12:30:24.710067034 CEST	443	49739	216.239.36.21	192.168.2.4
Apr 19, 2024 12:30:24.711168051 CEST	443	49739	216.239.36.21	192.168.2.4
Apr 19, 2024 12:30:24.711255074 CEST	49739	443	192.168.2.4	216.239.36.21
Apr 19, 2024 12:30:24.786711931 CEST	49739	443	192.168.2.4	216.239.36.21
Apr 19, 2024 12:30:24.786855936 CEST	443	49739	216.239.36.21	192.168.2.4
Apr 19, 2024 12:30:24.820769072 CEST	49739	443	192.168.2.4	216.239.36.21
Apr 19, 2024 12:30:24.820789099 CEST	443	49739	216.239.36.21	192.168.2.4
Apr 19, 2024 12:30:24.870651960 CEST	49739	443	192.168.2.4	216.239.36.21
Apr 19, 2024 12:30:25.027803898 CEST	443	49739	216.239.36.21	192.168.2.4
Apr 19, 2024 12:30:25.027890921 CEST	443	49739	216.239.36.21	192.168.2.4
Apr 19, 2024 12:30:25.027956009 CEST	49739	443	192.168.2.4	216.239.36.21
Apr 19, 2024 12:30:25.053481102 CEST	49739	443	192.168.2.4	216.239.36.21
Apr 19, 2024 12:30:25.053493023 CEST	443	49739	216.239.36.21	192.168.2.4
Apr 19, 2024 12:30:25.167501926 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 19, 2024 12:30:26.004545927 CEST	49741	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:30:26.004575014 CEST	443	49741	172.253.124.99	192.168.2.4
Apr 19, 2024 12:30:26.004651070 CEST	49741	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:30:26.006567001 CEST	49741	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:30:26.006575108 CEST	443	49741	172.253.124.99	192.168.2.4
Apr 19, 2024 12:30:26.223114014 CEST	443	49741	172.253.124.99	192.168.2.4
Apr 19, 2024 12:30:26.223555088 CEST	49741	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:30:26.223568916 CEST	443	49741	172.253.124.99	192.168.2.4
Apr 19, 2024 12:30:26.224580050 CEST	443	49741	172.253.124.99	192.168.2.4
Apr 19, 2024 12:30:26.224647999 CEST	49741	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:30:26.487799883 CEST	49741	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:30:26.487971067 CEST	443	49741	172.253.124.99	192.168.2.4
Apr 19, 2024 12:30:26.545823097 CEST	49741	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:30:26.545836926 CEST	443	49741	172.253.124.99	192.168.2.4
Apr 19, 2024 12:30:26.605142117 CEST	49741	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:30:26.977194071 CEST	49742	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:26.977298975 CEST	443	49742	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:26.977448940 CEST	49742	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:26.990386963 CEST	49742	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:26.990401983 CEST	443	49742	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.216270924 CEST	443	49742	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.216412067 CEST	49742	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.226497889 CEST	49742	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.226530075 CEST	443	49742	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.226905107 CEST	443	49742	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.276951075 CEST	49742	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.343807936 CEST	49742	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.384119987 CEST	443	49742	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.449568987 CEST	443	49742	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.449712992 CEST	443	49742	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.449774981 CEST	49742	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.454583883 CEST	49742	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.454623938 CEST	443	49742	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.454679012 CEST	49742	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.454699039 CEST	443	49742	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.507361889 CEST	49743	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.507401943 CEST	443	49743	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.507477999 CEST	49743	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.508677006 CEST	49743	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.508690119 CEST	443	49743	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.728835106 CEST	443	49743	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.729016066 CEST	49743	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.733844042 CEST	49743	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.733856916 CEST	443	49743	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.734169960 CEST	443	49743	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.737622976 CEST	49743	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.780127048 CEST	443	49743	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.934521914 CEST	443	49743	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.934612989 CEST	443	49743	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.934684038 CEST	49743	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.937315941 CEST	49743	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.937315941 CEST	49743	443	192.168.2.4	23.208.128.100
Apr 19, 2024 12:30:27.937371016 CEST	443	49743	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:27.937401056 CEST	443	49743	23.208.128.100	192.168.2.4
Apr 19, 2024 12:30:36.302833080 CEST	443	49741	172.253.124.99	192.168.2.4
Apr 19, 2024 12:30:36.302898884 CEST	443	49741	172.253.124.99	192.168.2.4
Apr 19, 2024 12:30:36.303055048 CEST	49741	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:30:38.468780994 CEST	49741	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:30:38.468805075 CEST	443	49741	172.253.124.99	192.168.2.4
Apr 19, 2024 12:31:25.950489044 CEST	49752	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:31:25.950534105 CEST	443	49752	172.253.124.99	192.168.2.4
Apr 19, 2024 12:31:25.950642109 CEST	49752	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:31:25.950917006 CEST	49752	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:31:25.950930119 CEST	443	49752	172.253.124.99	192.168.2.4
Apr 19, 2024 12:31:26.166157007 CEST	443	49752	172.253.124.99	192.168.2.4
Apr 19, 2024 12:31:26.166449070 CEST	49752	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:31:26.166464090 CEST	443	49752	172.253.124.99	192.168.2.4
Apr 19, 2024 12:31:26.166774988 CEST	443	49752	172.253.124.99	192.168.2.4
Apr 19, 2024 12:31:26.167117119 CEST	49752	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:31:26.167171955 CEST	443	49752	172.253.124.99	192.168.2.4
Apr 19, 2024 12:31:26.214698076 CEST	49752	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:31:32.277190924 CEST	49723	80	192.168.2.4	199.232.214.172
Apr 19, 2024 12:31:32.277456045 CEST	49724	80	192.168.2.4	199.232.214.172
Apr 19, 2024 12:31:32.381216049 CEST	80	49724	199.232.214.172	192.168.2.4
Apr 19, 2024 12:31:32.381241083 CEST	80	49724	199.232.214.172	192.168.2.4
Apr 19, 2024 12:31:32.381252050 CEST	80	49723	199.232.214.172	192.168.2.4
Apr 19, 2024 12:31:32.381263018 CEST	80	49723	199.232.214.172	192.168.2.4
Apr 19, 2024 12:31:32.381313086 CEST	49723	80	192.168.2.4	199.232.214.172
Apr 19, 2024 12:31:32.381427050 CEST	49724	80	192.168.2.4	199.232.214.172
Apr 19, 2024 12:31:36.186543941 CEST	443	49752	172.253.124.99	192.168.2.4
Apr 19, 2024 12:31:36.186619997 CEST	443	49752	172.253.124.99	192.168.2.4
Apr 19, 2024 12:31:36.187881947 CEST	49752	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:31:36.644840956 CEST	49752	443	192.168.2.4	172.253.124.99
Apr 19, 2024 12:31:36.644870043 CEST	443	49752	172.253.124.99	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 12:30:22.100781918 CEST	53	65134	1.1.1.1	192.168.2.4
Apr 19, 2024 12:30:22.107727051 CEST	53	64277	1.1.1.1	192.168.2.4
Apr 19, 2024 12:30:22.704519987 CEST	53	50479	1.1.1.1	192.168.2.4
Apr 19, 2024 12:30:23.208461046 CEST	63539	53	192.168.2.4	1.1.1.1
Apr 19, 2024 12:30:23.208626986 CEST	60111	53	192.168.2.4	1.1.1.1
Apr 19, 2024 12:30:23.337563038 CEST	53	63539	1.1.1.1	192.168.2.4
Apr 19, 2024 12:30:23.548990965 CEST	53	60111	1.1.1.1	192.168.2.4
Apr 19, 2024 12:30:24.230066061 CEST	59262	53	192.168.2.4	1.1.1.1
Apr 19, 2024 12:30:24.230360031 CEST	50620	53	192.168.2.4	1.1.1.1
Apr 19, 2024 12:30:24.335798025 CEST	53	50620	1.1.1.1	192.168.2.4
Apr 19, 2024 12:30:24.469002008 CEST	53	59262	1.1.1.1	192.168.2.4
Apr 19, 2024 12:30:25.896282911 CEST	63487	53	192.168.2.4	1.1.1.1
Apr 19, 2024 12:30:25.896755934 CEST	53612	53	192.168.2.4	1.1.1.1
Apr 19, 2024 12:30:26.000749111 CEST	53	63487	1.1.1.1	192.168.2.4
Apr 19, 2024 12:30:26.000897884 CEST	53	53612	1.1.1.1	192.168.2.4
Apr 19, 2024 12:30:40.757985115 CEST	53	52231	1.1.1.1	192.168.2.4
Apr 19, 2024 12:30:43.862031937 CEST	138	138	192.168.2.4	192.168.2.255
Apr 19, 2024 12:30:59.820328951 CEST	53	63862	1.1.1.1	192.168.2.4
Apr 19, 2024 12:31:21.611238956 CEST	53	61267	1.1.1.1	192.168.2.4
Apr 19, 2024 12:31:22.961030960 CEST	53	50443	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 19, 2024 12:30:23.549066067 CEST	192.168.2.4	1.1.1.1	c23f	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 12:30:23.208461046 CEST	192.168.2.4	1.1.1.1	0x49b4	Standard query (0)	dt.r24dmp.de	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:23.208626986 CEST	192.168.2.4	1.1.1.1	0xca2a	Standard query (0)	dt.r24dmp.de	65	IN (0x0001)	false
Apr 19, 2024 12:30:24.230066061 CEST	192.168.2.4	1.1.1.1	0xe38c	Standard query (0)	dt.r24dmp.de	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:24.230360031 CEST	192.168.2.4	1.1.1.1	0x8120	Standard query (0)	dt.r24dmp.de	65	IN (0x0001)	false
Apr 19, 2024 12:30:25.896282911 CEST	192.168.2.4	1.1.1.1	0xfea6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:25.896755934 CEST	192.168.2.4	1.1.1.1	0x2626	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 12:30:23.337563038 CEST	1.1.1.1	192.168.2.4	0x49b4	No error (0)	dt.r24dmp.de		216.239.34.21	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:23.337563038 CEST	1.1.1.1	192.168.2.4	0x49b4	No error (0)	dt.r24dmp.de		216.239.32.21	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:23.337563038 CEST	1.1.1.1	192.168.2.4	0x49b4	No error (0)	dt.r24dmp.de		216.239.38.21	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:23.337563038 CEST	1.1.1.1	192.168.2.4	0x49b4	No error (0)	dt.r24dmp.de		216.239.36.21	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:24.469002008 CEST	1.1.1.1	192.168.2.4	0xe38c	No error (0)	dt.r24dmp.de		216.239.36.21	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:24.469002008 CEST	1.1.1.1	192.168.2.4	0xe38c	No error (0)	dt.r24dmp.de		216.239.32.21	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:24.469002008 CEST	1.1.1.1	192.168.2.4	0xe38c	No error (0)	dt.r24dmp.de		216.239.34.21	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:24.469002008 CEST	1.1.1.1	192.168.2.4	0xe38c	No error (0)	dt.r24dmp.de		216.239.38.21	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:26.000749111 CEST	1.1.1.1	192.168.2.4	0xfea6	No error (0)	www.google.com		172.253.124.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:26.000749111 CEST	1.1.1.1	192.168.2.4	0xfea6	No error (0)	www.google.com		172.253.124.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:26.000749111 CEST	1.1.1.1	192.168.2.4	0xfea6	No error (0)	www.google.com		172.253.124.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:26.000749111 CEST	1.1.1.1	192.168.2.4	0xfea6	No error (0)	www.google.com		172.253.124.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:26.000749111 CEST	1.1.1.1	192.168.2.4	0xfea6	No error (0)	www.google.com		172.253.124.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:26.000749111 CEST	1.1.1.1	192.168.2.4	0xfea6	No error (0)	www.google.com		172.253.124.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:26.000897884 CEST	1.1.1.1	192.168.2.4	0x2626	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 12:30:39.215373039 CEST	1.1.1.1	192.168.2.4	0x6455	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:30:39.215373039 CEST	1.1.1.1	192.168.2.4	0x6455	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:30:51.946322918 CEST	1.1.1.1	192.168.2.4	0x9abc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:30:51.946322918 CEST	1.1.1.1	192.168.2.4	0x9abc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:31:14.994241953 CEST	1.1.1.1	192.168.2.4	0x697e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:31:14.994241953 CEST	1.1.1.1	192.168.2.4	0x697e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:31:34.788995028 CEST	1.1.1.1	192.168.2.4	0x7920	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:31:34.788995028 CEST	1.1.1.1	192.168.2.4	0x7920	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dt.r24dmp.de

https:

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	216.239.34.21	443	980	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:30:23 UTC	655	OUT	GET / HTTP/1.1 Host: dt.r24dmp.de Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 10:30:23 UTC	345	IN	HTTP/1.1 200 OK x-powered-by: Express access-control-allow-origin: * content-type: text/javascript; charset=utf-8 etag: W/"1ec-oaSqP9deDNP3SE1uwp2xO5Q8+dM" vary: Accept-Encoding X-Cloud-Trace-Context: e064c14abf3e3f4f57100943255915cf Date: Fri, 19 Apr 2024 10:30:23 GMT Server: Google Frontend Content-Length: 492 Connection: close
2024-04-19 10:30:23 UTC	492	IN	Data Raw: 0a 76 61 72 20 72 70 74 64 73 72 65 66 20 3d 20 22 22 3b 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 20 7b 0a 20 20 20 20 72 70 74 64 73 72 65 66 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 2e 74 6f 53 74 72 69 6e 67 28 29 3b 0a 7d 0a 65 6c 73 65 20 7b 0a 20 20 20 20 72 70 74 64 73 72 65 66 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 0a 7d 0a 69 66 28 72 70 74 64 73 72 65 66 20 21 3d 20 22 22 29 20 7b 0a 20 20 20 20 76 61 72 20 72 70 74 64 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 20 72 70 74 64 73 2e 61 73 79 6e 63 20 3d 20 74 72 75 65 3b 20 72 70 74 64 73 2e 74 79 70 65 20 3d 20 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 Data Ascii: var rptdsref = "";if(document.referrer) { rptdsref = document.referrer.toString();}else { rptdsref = window.location.href;}if(rptdsref != "") { var rptds = document.createElement('script'); rptds.async = true; rptds.type = 'text/javascri

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	216.239.34.21	443	980	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:30:23 UTC	580	OUT	GET /favicon.ico HTTP/1.1 Host: dt.r24dmp.de Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dt.r24dmp.de/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 10:30:24 UTC	199	IN	HTTP/1.1 200 OK x-powered-by: Express access-control-allow-origin: * Date: Fri, 19 Apr 2024 10:30:24 GMT Content-Type: text/html Server: Google Frontend Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	216.239.36.21	443	980	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:30:24 UTC	347	OUT	GET /favicon.ico HTTP/1.1 Host: dt.r24dmp.de Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 10:30:25 UTC	199	IN	HTTP/1.1 200 OK x-powered-by: Express access-control-allow-origin: * Date: Fri, 19 Apr 2024 10:30:24 GMT Content-Type: text/html Server: Google Frontend Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	23.208.128.100	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:30:27 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 10:30:27 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=160418 Date: Fri, 19 Apr 2024 10:30:27 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	23.208.128.100	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:30:27 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 10:30:27 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=160282 Date: Fri, 19 Apr 2024 10:30:27 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-19 10:30:27 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5600, Parent PID: 1816

General

Target ID:	0
Start time:	12:30:18
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 980, Parent PID: 5600

General

Target ID:	2
Start time:	12:30:20
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2012,i,12741340570266483771,6118006599820063687,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6452, Parent PID: 1816

General

Target ID:	3
Start time:	12:30:22
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://dt.r24dmp.de/"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://dt.r24dmp.de/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 40

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5600, Parent PID: 1816

General

Chronological Activities

Analysis Process: chrome.exePID: 980, Parent PID: 5600

General

Chronological Activities

Analysis Process: chrome.exePID: 6452, Parent PID: 1816

General

Chronological Activities

Disassembly

Windows Analysis Report
https://dt.r24dmp.de/