Edit tour

Windows Analysis Report
https://tele-gram-gs.rent/

Overview

General Information

Sample URL:	https://tele-gram-gs.rent/
Analysis ID:	1598182
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

AI detected suspicious URL

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2488,i,2308581532159020147,4756925217575398187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tele-gram-gs.rent/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://tele-gram-gs.rent/

Avira URL Cloud: detection malicious, Label: phishing

Phishing

AI detected suspicious URL

Source: https://tele-gram-gs.rent

Joe Sandbox AI: The URL 'https://tele-gram-gs.rent' appears to be a typosquatting attempt targeting the well-known messaging service Telegram. The use of 'tele-gram' with a hyphen is a common tactic to mimic the legitimate brand name 'Telegram'. The addition of '-gs' and the use of the '.rent' domain extension are unusual and do not suggest a legitimate purpose related to the brand. The structural similarity is high due to the visual resemblance and the use of a hyphen to separate 'tele' and 'gram', which could confuse users. The domain extension '.rent' is not typically associated with Telegram, increasing the likelihood of this being a deceptive URL.

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:60393 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:60448 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.6:60307 -> 162.159.36.2:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: tele-gram-gs.rent to https://tele-gram-ty.org

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: tele-gram-gs.rentConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: tele-gram-gs.rent
Source: global traffic	DNS traffic detected: DNS query: tele-gram-ty.org
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 50.23.12.20.in-addr.arpa

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60447

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:60393 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:60448 version: TLS 1.2

Source: classification engine

Classification label: mal52.win@23/0@25/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2488,i,2308581532159020147,4756925217575398187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tele-gram-gs.rent/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2488,i,2308581532159020147,4756925217575398187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://tele-gram-gs.rent/	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Reputation
tele-gram-gs.rent	103.65.181.2	true	true	unknown
google.com	142.250.184.206	true	false	high
www.google.com	142.250.185.68	true	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high
tele-gram-ty.org	unknown	unknown	false	high
50.23.12.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://tele-gram-gs.rent/	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.164	unknown	United States	15169	GOOGLEUS	false
103.65.181.2	tele-gram-gs.rent	Hong Kong	38197	SUNHK-DATA-AS-APSunNetworkHongKongLimited-HongKong	true

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1598182
Start date and time:	2025-01-24 00:59:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://tele-gram-gs.rent/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.win@23/0@25/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 142.250.186.110, 74.125.206.84, 142.250.185.174, 142.250.186.142, 142.250.185.110, 2.23.77.188, 217.20.57.20, 172.217.16.206, 142.250.186.78, 216.58.212.174, 172.217.16.195, 142.250.185.142, 13.107.246.45, 184.28.90.27, 172.202.163.200, 52.165.164.15, 20.12.23.50, 52.149.20.212
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://tele-gram-gs.rent/

Input	Output
URL: https://tele-gram-gs.rent Model: Joe Sandbox AI	```json{ "brand": "Telegram", "brand_classification": "wellknown", "legit_url": "https://telegram.org", "similarity": 7, "spoofed": 8, "reasoning": "The URL 'https://tele-gram-gs.rent' appears to be a typosquatting attempt targeting the well-known messaging service Telegram. The use of 'tele-gram' with a hyphen is a common tactic to mimic the legitimate brand name 'Telegram'. The addition of '-gs' and the use of the '.rent' domain extension are unusual and do not suggest a legitimate purpose related to the brand. The structural similarity is high due to the visual resemblance and the use of a hyphen to separate 'tele' and 'gram', which could confuse users. The domain extension '.rent' is not typically associated with Telegram, increasing the likelihood of this being a deceptive URL."}
URL: https://tele-gram-gs.rent

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 24, 2025 01:00:23.948728085 CET	49673	443	192.168.2.6	173.222.162.64
Jan 24, 2025 01:00:23.948754072 CET	49674	443	192.168.2.6	173.222.162.64
Jan 24, 2025 01:00:24.261224985 CET	49672	443	192.168.2.6	173.222.162.64
Jan 24, 2025 01:00:32.875286102 CET	49716	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:32.875343084 CET	443	49716	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:32.875403881 CET	49716	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:32.876055956 CET	49716	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:32.876074076 CET	443	49716	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:33.556363106 CET	49673	443	192.168.2.6	173.222.162.64
Jan 24, 2025 01:00:33.572098970 CET	49674	443	192.168.2.6	173.222.162.64
Jan 24, 2025 01:00:33.707879066 CET	443	49716	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:33.707961082 CET	49716	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:33.713102102 CET	49716	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:33.713113070 CET	443	49716	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:33.713373899 CET	443	49716	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:33.715329885 CET	49716	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:33.715385914 CET	49716	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:33.715393066 CET	443	49716	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:33.715517044 CET	49716	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:33.759335041 CET	443	49716	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:33.889838934 CET	443	49716	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:33.889935017 CET	443	49716	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:33.889996052 CET	49716	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:33.890124083 CET	49716	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:33.890136957 CET	443	49716	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:33.962606907 CET	49672	443	192.168.2.6	173.222.162.64
Jan 24, 2025 01:00:35.522866011 CET	443	49705	173.222.162.64	192.168.2.6
Jan 24, 2025 01:00:35.522981882 CET	49705	443	192.168.2.6	173.222.162.64
Jan 24, 2025 01:00:36.441034079 CET	49719	443	192.168.2.6	142.250.185.68
Jan 24, 2025 01:00:36.441067934 CET	443	49719	142.250.185.68	192.168.2.6
Jan 24, 2025 01:00:36.441140890 CET	49719	443	192.168.2.6	142.250.185.68
Jan 24, 2025 01:00:36.441365957 CET	49719	443	192.168.2.6	142.250.185.68
Jan 24, 2025 01:00:36.441373110 CET	443	49719	142.250.185.68	192.168.2.6
Jan 24, 2025 01:00:37.138914108 CET	443	49719	142.250.185.68	192.168.2.6
Jan 24, 2025 01:00:37.139266968 CET	49719	443	192.168.2.6	142.250.185.68
Jan 24, 2025 01:00:37.139273882 CET	443	49719	142.250.185.68	192.168.2.6
Jan 24, 2025 01:00:37.140363932 CET	443	49719	142.250.185.68	192.168.2.6
Jan 24, 2025 01:00:37.140423059 CET	49719	443	192.168.2.6	142.250.185.68
Jan 24, 2025 01:00:37.145184040 CET	49719	443	192.168.2.6	142.250.185.68
Jan 24, 2025 01:00:37.145247936 CET	443	49719	142.250.185.68	192.168.2.6
Jan 24, 2025 01:00:37.196945906 CET	49719	443	192.168.2.6	142.250.185.68
Jan 24, 2025 01:00:37.196963072 CET	443	49719	142.250.185.68	192.168.2.6
Jan 24, 2025 01:00:37.243828058 CET	49719	443	192.168.2.6	142.250.185.68
Jan 24, 2025 01:00:37.355546951 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:37.355601072 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:37.355885029 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:37.356067896 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:37.356097937 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:37.356297970 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:37.356312037 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:37.356328964 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:37.356489897 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:37.356520891 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.329164028 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.329459906 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.329466105 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.329952002 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.330014944 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.330553055 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.330590010 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.331506014 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.331561089 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.331743002 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.331749916 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.371860027 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.382716894 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.382940054 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.382960081 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.384037018 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.384088993 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.384706020 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.384748936 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.384919882 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.384975910 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.434360027 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.434376001 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.481785059 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.923722982 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.923803091 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:38.923856974 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.925924063 CET	49722	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:00:38.925939083 CET	443	49722	103.65.181.2	192.168.2.6
Jan 24, 2025 01:00:40.784295082 CET	49747	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:40.784337997 CET	443	49747	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:40.784537077 CET	49747	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:40.785161018 CET	49747	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:40.785181046 CET	443	49747	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:41.733664989 CET	443	49747	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:41.733743906 CET	49747	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:41.735706091 CET	49747	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:41.735717058 CET	443	49747	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:41.736521959 CET	443	49747	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:41.738605022 CET	49747	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:41.738662004 CET	49747	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:41.738670111 CET	443	49747	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:41.738822937 CET	49747	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:41.779329062 CET	443	49747	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:41.917326927 CET	443	49747	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:41.917598963 CET	443	49747	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:41.917659044 CET	49747	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:41.917789936 CET	49747	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:41.917805910 CET	443	49747	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:47.025615931 CET	443	49719	142.250.185.68	192.168.2.6
Jan 24, 2025 01:00:47.025768995 CET	443	49719	142.250.185.68	192.168.2.6
Jan 24, 2025 01:00:47.025873899 CET	49719	443	192.168.2.6	142.250.185.68
Jan 24, 2025 01:00:48.542597055 CET	49719	443	192.168.2.6	142.250.185.68
Jan 24, 2025 01:00:48.542624950 CET	443	49719	142.250.185.68	192.168.2.6
Jan 24, 2025 01:00:53.268271923 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:53.268309116 CET	443	49826	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:53.268407106 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:53.269020081 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:53.269038916 CET	443	49826	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:54.092618942 CET	443	49826	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:54.092820883 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:54.097501993 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:54.097516060 CET	443	49826	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:54.097732067 CET	443	49826	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:54.099837065 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:54.099901915 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:54.099909067 CET	443	49826	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:54.100043058 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:54.147329092 CET	443	49826	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:54.273983955 CET	443	49826	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:54.275032043 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:54.275043011 CET	443	49826	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:54.275063038 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:54.275099993 CET	443	49826	40.115.3.253	192.168.2.6
Jan 24, 2025 01:00:54.275099993 CET	49826	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:00:58.692473888 CET	60307	53	192.168.2.6	162.159.36.2
Jan 24, 2025 01:00:58.698754072 CET	53	60307	162.159.36.2	192.168.2.6
Jan 24, 2025 01:00:58.698829889 CET	60307	53	192.168.2.6	162.159.36.2
Jan 24, 2025 01:00:58.705369949 CET	53	60307	162.159.36.2	192.168.2.6
Jan 24, 2025 01:00:59.161525965 CET	60307	53	192.168.2.6	162.159.36.2
Jan 24, 2025 01:00:59.167030096 CET	53	60307	162.159.36.2	192.168.2.6
Jan 24, 2025 01:00:59.167084932 CET	60307	53	192.168.2.6	162.159.36.2
Jan 24, 2025 01:01:12.387792110 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:12.387866020 CET	443	60393	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:12.387967110 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:12.388808966 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:12.388833046 CET	443	60393	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:13.185756922 CET	443	60393	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:13.185853958 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:13.187509060 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:13.187531948 CET	443	60393	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:13.187757969 CET	443	60393	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:13.189548016 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:13.189609051 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:13.189621925 CET	443	60393	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:13.189723015 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:13.231349945 CET	443	60393	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:13.363668919 CET	443	60393	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:13.363750935 CET	443	60393	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:13.364253998 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:13.364253998 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:13.364253998 CET	60393	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:13.364319086 CET	443	60393	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:23.447285891 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:01:23.447349072 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:01:36.493361950 CET	60447	443	192.168.2.6	142.250.185.164
Jan 24, 2025 01:01:36.493446112 CET	443	60447	142.250.185.164	192.168.2.6
Jan 24, 2025 01:01:36.493544102 CET	60447	443	192.168.2.6	142.250.185.164
Jan 24, 2025 01:01:36.493849039 CET	60447	443	192.168.2.6	142.250.185.164
Jan 24, 2025 01:01:36.493877888 CET	443	60447	142.250.185.164	192.168.2.6
Jan 24, 2025 01:01:37.131536007 CET	443	60447	142.250.185.164	192.168.2.6
Jan 24, 2025 01:01:37.131968975 CET	60447	443	192.168.2.6	142.250.185.164
Jan 24, 2025 01:01:37.132018089 CET	443	60447	142.250.185.164	192.168.2.6
Jan 24, 2025 01:01:37.132695913 CET	443	60447	142.250.185.164	192.168.2.6
Jan 24, 2025 01:01:37.133136034 CET	60447	443	192.168.2.6	142.250.185.164
Jan 24, 2025 01:01:37.133232117 CET	443	60447	142.250.185.164	192.168.2.6
Jan 24, 2025 01:01:37.186151981 CET	60447	443	192.168.2.6	142.250.185.164
Jan 24, 2025 01:01:37.320755005 CET	60448	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:37.320802927 CET	443	60448	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:37.320914030 CET	60448	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:37.321675062 CET	60448	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:37.321690083 CET	443	60448	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:38.135595083 CET	443	60448	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:38.135867119 CET	60448	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:38.138513088 CET	60448	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:38.138521910 CET	443	60448	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:38.138724089 CET	443	60448	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:38.140973091 CET	60448	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:38.141052008 CET	60448	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:38.141057968 CET	443	60448	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:38.141196012 CET	60448	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:38.183330059 CET	443	60448	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:38.197690010 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:01:38.197885036 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:01:38.197941065 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:01:38.316132069 CET	443	60448	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:38.316348076 CET	443	60448	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:38.316421986 CET	60448	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:38.316597939 CET	60448	443	192.168.2.6	40.115.3.253
Jan 24, 2025 01:01:38.316616058 CET	443	60448	40.115.3.253	192.168.2.6
Jan 24, 2025 01:01:38.547684908 CET	49721	443	192.168.2.6	103.65.181.2
Jan 24, 2025 01:01:38.547713995 CET	443	49721	103.65.181.2	192.168.2.6
Jan 24, 2025 01:01:47.122092009 CET	443	60447	142.250.185.164	192.168.2.6
Jan 24, 2025 01:01:47.122198105 CET	443	60447	142.250.185.164	192.168.2.6
Jan 24, 2025 01:01:47.122294903 CET	60447	443	192.168.2.6	142.250.185.164
Jan 24, 2025 01:01:48.060857058 CET	60447	443	192.168.2.6	142.250.185.164
Jan 24, 2025 01:01:48.060925961 CET	443	60447	142.250.185.164	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 24, 2025 01:00:32.376378059 CET	53	57783	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:33.626759052 CET	53	49907	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:36.432599068 CET	62788	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:36.432725906 CET	58940	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:36.440021038 CET	53	62788	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:36.440063953 CET	53	58940	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:37.332608938 CET	55071	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:37.340604067 CET	61202	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:37.353590965 CET	53	61202	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:37.354978085 CET	53	55071	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:38.926668882 CET	49189	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:38.926827908 CET	55898	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:38.944901943 CET	53	55898	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:38.944915056 CET	53	49189	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:38.945797920 CET	64542	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:38.963033915 CET	53	64542	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:38.989576101 CET	53044	53	192.168.2.6	8.8.8.8
Jan 24, 2025 01:00:38.989895105 CET	54927	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:38.996428013 CET	53	54927	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:38.996758938 CET	53	53044	8.8.8.8	192.168.2.6
Jan 24, 2025 01:00:40.001293898 CET	51923	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:40.001565933 CET	59833	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:40.016707897 CET	53	59833	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:40.018475056 CET	53	51923	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:45.034465075 CET	63939	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:45.034604073 CET	53850	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:45.049073935 CET	53	63939	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:45.049427032 CET	53	53850	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:45.050072908 CET	57189	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:45.064943075 CET	53	57189	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:50.535545111 CET	53	54785	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:54.131053925 CET	64818	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:54.131172895 CET	50944	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:54.146034002 CET	53	50944	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:54.146653891 CET	53	64818	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:54.147357941 CET	62040	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:54.161942959 CET	53	62040	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:54.172936916 CET	56382	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:54.173419952 CET	58266	53	192.168.2.6	8.8.8.8
Jan 24, 2025 01:00:54.180191994 CET	53	56382	1.1.1.1	192.168.2.6
Jan 24, 2025 01:00:54.180352926 CET	53	58266	8.8.8.8	192.168.2.6
Jan 24, 2025 01:00:58.691816092 CET	53	61481	162.159.36.2	192.168.2.6
Jan 24, 2025 01:00:59.169701099 CET	58626	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:00:59.177670002 CET	53	58626	1.1.1.1	192.168.2.6
Jan 24, 2025 01:01:00.320194960 CET	53957	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:01:00.329075098 CET	53	53957	1.1.1.1	192.168.2.6
Jan 24, 2025 01:01:06.074703932 CET	62107	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:01:06.091861963 CET	53	62107	1.1.1.1	192.168.2.6
Jan 24, 2025 01:01:17.993957043 CET	65255	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:01:18.009372950 CET	53	65255	1.1.1.1	192.168.2.6
Jan 24, 2025 01:01:36.484908104 CET	53609	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:01:36.492140055 CET	53	53609	1.1.1.1	192.168.2.6
Jan 24, 2025 01:01:48.052982092 CET	65373	53	192.168.2.6	1.1.1.1
Jan 24, 2025 01:01:48.067338943 CET	53	65373	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 24, 2025 01:00:36.432599068 CET	192.168.2.6	1.1.1.1	0x8cf3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:36.432725906 CET	192.168.2.6	1.1.1.1	0x29bb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 24, 2025 01:00:37.332608938 CET	192.168.2.6	1.1.1.1	0x55b6	Standard query (0)	tele-gram-gs.rent	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:37.340604067 CET	192.168.2.6	1.1.1.1	0xda6d	Standard query (0)	tele-gram-gs.rent	65	IN (0x0001)	false
Jan 24, 2025 01:00:38.926668882 CET	192.168.2.6	1.1.1.1	0x6991	Standard query (0)	tele-gram-ty.org	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:38.926827908 CET	192.168.2.6	1.1.1.1	0xb698	Standard query (0)	tele-gram-ty.org	65	IN (0x0001)	false
Jan 24, 2025 01:00:38.945797920 CET	192.168.2.6	1.1.1.1	0x6420	Standard query (0)	tele-gram-ty.org	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:38.989576101 CET	192.168.2.6	8.8.8.8	0x6965	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:38.989895105 CET	192.168.2.6	1.1.1.1	0x2bf2	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:40.001293898 CET	192.168.2.6	1.1.1.1	0x7ca0	Standard query (0)	tele-gram-ty.org	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:40.001565933 CET	192.168.2.6	1.1.1.1	0x40c0	Standard query (0)	tele-gram-ty.org	65	IN (0x0001)	false
Jan 24, 2025 01:00:45.034465075 CET	192.168.2.6	1.1.1.1	0x434b	Standard query (0)	tele-gram-ty.org	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:45.034604073 CET	192.168.2.6	1.1.1.1	0xcdcc	Standard query (0)	tele-gram-ty.org	65	IN (0x0001)	false
Jan 24, 2025 01:00:45.050072908 CET	192.168.2.6	1.1.1.1	0x7d26	Standard query (0)	tele-gram-ty.org	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:54.131053925 CET	192.168.2.6	1.1.1.1	0x16f8	Standard query (0)	tele-gram-ty.org	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:54.131172895 CET	192.168.2.6	1.1.1.1	0x2156	Standard query (0)	tele-gram-ty.org	65	IN (0x0001)	false
Jan 24, 2025 01:00:54.147357941 CET	192.168.2.6	1.1.1.1	0xdc3c	Standard query (0)	tele-gram-ty.org	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:54.172936916 CET	192.168.2.6	1.1.1.1	0x4a9c	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:54.173419952 CET	192.168.2.6	8.8.8.8	0x3c19	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:59.169701099 CET	192.168.2.6	1.1.1.1	0x98c8	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 24, 2025 01:01:00.320194960 CET	192.168.2.6	1.1.1.1	0x54bc	Standard query (0)	50.23.12.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 24, 2025 01:01:06.074703932 CET	192.168.2.6	1.1.1.1	0xe8cd	Standard query (0)	tele-gram-ty.org	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:01:17.993957043 CET	192.168.2.6	1.1.1.1	0x7de9	Standard query (0)	tele-gram-ty.org	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:01:36.484908104 CET	192.168.2.6	1.1.1.1	0xfb4c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:01:48.052982092 CET	192.168.2.6	1.1.1.1	0x5095	Standard query (0)	tele-gram-ty.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 24, 2025 01:00:36.440021038 CET	1.1.1.1	192.168.2.6	0x8cf3	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:36.440063953 CET	1.1.1.1	192.168.2.6	0x29bb	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 24, 2025 01:00:37.354978085 CET	1.1.1.1	192.168.2.6	0x55b6	No error (0)	tele-gram-gs.rent		103.65.181.2	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:38.944901943 CET	1.1.1.1	192.168.2.6	0xb698	Name error (3)	tele-gram-ty.org	none	none	65	IN (0x0001)	false
Jan 24, 2025 01:00:38.944915056 CET	1.1.1.1	192.168.2.6	0x6991	Name error (3)	tele-gram-ty.org	none	none	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:38.963033915 CET	1.1.1.1	192.168.2.6	0x6420	Name error (3)	tele-gram-ty.org	none	none	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:38.996428013 CET	1.1.1.1	192.168.2.6	0x2bf2	No error (0)	google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:38.996758938 CET	8.8.8.8	192.168.2.6	0x6965	No error (0)	google.com		142.251.37.14	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:40.016707897 CET	1.1.1.1	192.168.2.6	0x40c0	Name error (3)	tele-gram-ty.org	none	none	65	IN (0x0001)	false
Jan 24, 2025 01:00:40.018475056 CET	1.1.1.1	192.168.2.6	0x7ca0	Name error (3)	tele-gram-ty.org	none	none	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:45.049073935 CET	1.1.1.1	192.168.2.6	0x434b	Name error (3)	tele-gram-ty.org	none	none	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:45.049427032 CET	1.1.1.1	192.168.2.6	0xcdcc	Name error (3)	tele-gram-ty.org	none	none	65	IN (0x0001)	false
Jan 24, 2025 01:00:45.064943075 CET	1.1.1.1	192.168.2.6	0x7d26	Name error (3)	tele-gram-ty.org	none	none	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:54.146034002 CET	1.1.1.1	192.168.2.6	0x2156	Name error (3)	tele-gram-ty.org	none	none	65	IN (0x0001)	false
Jan 24, 2025 01:00:54.146653891 CET	1.1.1.1	192.168.2.6	0x16f8	Name error (3)	tele-gram-ty.org	none	none	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:54.161942959 CET	1.1.1.1	192.168.2.6	0xdc3c	Name error (3)	tele-gram-ty.org	none	none	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:54.180191994 CET	1.1.1.1	192.168.2.6	0x4a9c	No error (0)	google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:54.180352926 CET	8.8.8.8	192.168.2.6	0x3c19	No error (0)	google.com		142.251.37.14	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:00:59.177670002 CET	1.1.1.1	192.168.2.6	0x98c8	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 24, 2025 01:01:00.329075098 CET	1.1.1.1	192.168.2.6	0x54bc	Name error (3)	50.23.12.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 24, 2025 01:01:06.091861963 CET	1.1.1.1	192.168.2.6	0xe8cd	Name error (3)	tele-gram-ty.org	none	none	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:01:18.009372950 CET	1.1.1.1	192.168.2.6	0x7de9	Name error (3)	tele-gram-ty.org	none	none	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:01:36.492140055 CET	1.1.1.1	192.168.2.6	0xfb4c	No error (0)	www.google.com		142.250.185.164	A (IP address)	IN (0x0001)	false
Jan 24, 2025 01:01:48.067338943 CET	1.1.1.1	192.168.2.6	0x5095	Name error (3)	tele-gram-ty.org	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tele-gram-gs.rent

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49716	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-24 00:00:33 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 49 53 43 46 74 77 6c 52 37 45 61 42 76 6c 54 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 31 61 37 65 61 35 63 63 62 64 62 35 38 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: ISCFtwlR7EaBvlT1.1Context: 81a7ea5ccbdb58c
2025-01-24 00:00:33 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-24 00:00:33 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 49 53 43 46 74 77 6c 52 37 45 61 42 76 6c 54 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 31 61 37 65 61 35 63 63 62 64 62 35 38 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 73 71 73 39 75 30 46 74 66 2f 70 37 68 48 36 36 41 61 34 6d 39 4d 4a 56 77 52 48 61 48 78 77 69 56 76 4c 4b 59 70 5a 69 67 43 49 2f 47 66 55 6c 61 6e 4a 5a 50 6a 65 2f 6e 48 51 6b 47 39 44 43 2b 4b 41 63 6f 49 32 45 78 68 6b 73 6c 2b 78 77 4c 32 6e 72 52 68 79 79 4a 4a 72 50 4d 55 57 4e 44 51 73 59 39 75 61 45 34 42 4f 70 58 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: ISCFtwlR7EaBvlT1.2Context: 81a7ea5ccbdb58c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUsqs9u0Ftf/p7hH66Aa4m9MJVwRHaHxwiVvLKYpZigCI/GfUlanJZPje/nHQkG9DC+KAcoI2Exhksl+xwL2nrRhyyJJrPMUWNDQsY9uaE4BOpX
2025-01-24 00:00:33 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 49 53 43 46 74 77 6c 52 37 45 61 42 76 6c 54 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 31 61 37 65 61 35 63 63 62 64 62 35 38 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: ISCFtwlR7EaBvlT1.3Context: 81a7ea5ccbdb58c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-24 00:00:33 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-24 00:00:33 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 42 57 31 72 42 58 52 6a 66 45 43 63 6f 52 4c 57 34 4c 43 31 56 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: BW1rBXRjfECcoRLW4LC1VA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	103.65.181.2	443	5144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-24 00:00:38 UTC	660	OUT	GET / HTTP/1.1 Host: tele-gram-gs.rent Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-24 00:00:38 UTC	410	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 24 Jan 2025 00:00:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bta2kgrr71pno7hldl2olm8m30; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: https://tele-gram-ty.org Strict-Transport-Security: max-age=31536000
2025-01-24 00:00:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49747	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-24 00:00:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 57 50 33 4a 37 55 35 45 72 55 32 79 39 44 43 51 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 38 38 35 32 33 64 63 31 35 32 37 64 32 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: WP3J7U5ErU2y9DCQ.1Context: b288523dc1527d25
2025-01-24 00:00:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-24 00:00:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 57 50 33 4a 37 55 35 45 72 55 32 79 39 44 43 51 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 38 38 35 32 33 64 63 31 35 32 37 64 32 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 73 71 73 39 75 30 46 74 66 2f 70 37 68 48 36 36 41 61 34 6d 39 4d 4a 56 77 52 48 61 48 78 77 69 56 76 4c 4b 59 70 5a 69 67 43 49 2f 47 66 55 6c 61 6e 4a 5a 50 6a 65 2f 6e 48 51 6b 47 39 44 43 2b 4b 41 63 6f 49 32 45 78 68 6b 73 6c 2b 78 77 4c 32 6e 72 52 68 79 79 4a 4a 72 50 4d 55 57 4e 44 51 73 59 39 75 61 45 34 42 4f 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: WP3J7U5ErU2y9DCQ.2Context: b288523dc1527d25<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUsqs9u0Ftf/p7hH66Aa4m9MJVwRHaHxwiVvLKYpZigCI/GfUlanJZPje/nHQkG9DC+KAcoI2Exhksl+xwL2nrRhyyJJrPMUWNDQsY9uaE4BOp
2025-01-24 00:00:41 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 57 50 33 4a 37 55 35 45 72 55 32 79 39 44 43 51 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 38 38 35 32 33 64 63 31 35 32 37 64 32 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: WP3J7U5ErU2y9DCQ.3Context: b288523dc1527d25<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-24 00:00:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-24 00:00:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 64 7a 68 31 4f 4b 43 4a 55 75 42 6f 47 35 32 2f 33 65 63 49 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /dzh1OKCJUuBoG52/3ecIw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49826	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-24 00:00:54 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4d 53 57 34 45 67 34 54 4d 45 75 39 53 75 33 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 62 34 64 35 38 38 36 33 35 65 64 65 62 35 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: MSW4Eg4TMEu9Su3W.1Context: cb4d588635edeb5b
2025-01-24 00:00:54 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-24 00:00:54 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4d 53 57 34 45 67 34 54 4d 45 75 39 53 75 33 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 62 34 64 35 38 38 36 33 35 65 64 65 62 35 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 73 71 73 39 75 30 46 74 66 2f 70 37 68 48 36 36 41 61 34 6d 39 4d 4a 56 77 52 48 61 48 78 77 69 56 76 4c 4b 59 70 5a 69 67 43 49 2f 47 66 55 6c 61 6e 4a 5a 50 6a 65 2f 6e 48 51 6b 47 39 44 43 2b 4b 41 63 6f 49 32 45 78 68 6b 73 6c 2b 78 77 4c 32 6e 72 52 68 79 79 4a 4a 72 50 4d 55 57 4e 44 51 73 59 39 75 61 45 34 42 4f 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: MSW4Eg4TMEu9Su3W.2Context: cb4d588635edeb5b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUsqs9u0Ftf/p7hH66Aa4m9MJVwRHaHxwiVvLKYpZigCI/GfUlanJZPje/nHQkG9DC+KAcoI2Exhksl+xwL2nrRhyyJJrPMUWNDQsY9uaE4BOp
2025-01-24 00:00:54 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4d 53 57 34 45 67 34 54 4d 45 75 39 53 75 33 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 62 34 64 35 38 38 36 33 35 65 64 65 62 35 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: MSW4Eg4TMEu9Su3W.3Context: cb4d588635edeb5b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-24 00:00:54 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-24 00:00:54 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 31 69 5a 70 47 59 77 35 45 57 78 2f 65 41 4c 41 56 54 55 6b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: f1iZpGYw5EWx/eALAVTUkg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	60393	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-24 00:01:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 57 32 54 35 55 33 6d 61 55 4f 78 42 77 58 51 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 32 36 31 30 33 31 66 38 64 39 31 37 62 64 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: BW2T5U3maUOxBwXQ.1Context: f261031f8d917bdc
2025-01-24 00:01:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-24 00:01:13 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 57 32 54 35 55 33 6d 61 55 4f 78 42 77 58 51 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 32 36 31 30 33 31 66 38 64 39 31 37 62 64 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 73 71 73 39 75 30 46 74 66 2f 70 37 68 48 36 36 41 61 34 6d 39 4d 4a 56 77 52 48 61 48 78 77 69 56 76 4c 4b 59 70 5a 69 67 43 49 2f 47 66 55 6c 61 6e 4a 5a 50 6a 65 2f 6e 48 51 6b 47 39 44 43 2b 4b 41 63 6f 49 32 45 78 68 6b 73 6c 2b 78 77 4c 32 6e 72 52 68 79 79 4a 4a 72 50 4d 55 57 4e 44 51 73 59 39 75 61 45 34 42 4f 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: BW2T5U3maUOxBwXQ.2Context: f261031f8d917bdc<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUsqs9u0Ftf/p7hH66Aa4m9MJVwRHaHxwiVvLKYpZigCI/GfUlanJZPje/nHQkG9DC+KAcoI2Exhksl+xwL2nrRhyyJJrPMUWNDQsY9uaE4BOp
2025-01-24 00:01:13 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 57 32 54 35 55 33 6d 61 55 4f 78 42 77 58 51 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 32 36 31 30 33 31 66 38 64 39 31 37 62 64 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: BW2T5U3maUOxBwXQ.3Context: f261031f8d917bdc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-24 00:01:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-24 00:01:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 5a 66 42 64 34 64 36 30 6b 4b 36 69 77 76 30 38 46 35 4a 61 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: TZfBd4d60kK6iwv08F5Jaw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	60448	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-24 00:01:38 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4f 71 4e 45 33 68 42 61 32 55 75 63 62 45 52 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 63 31 31 63 36 62 63 63 33 36 65 32 36 36 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: OqNE3hBa2UucbERA.1Context: 4c11c6bcc36e2665
2025-01-24 00:01:38 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-24 00:01:38 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4f 71 4e 45 33 68 42 61 32 55 75 63 62 45 52 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 63 31 31 63 36 62 63 63 33 36 65 32 36 36 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 73 71 73 39 75 30 46 74 66 2f 70 37 68 48 36 36 41 61 34 6d 39 4d 4a 56 77 52 48 61 48 78 77 69 56 76 4c 4b 59 70 5a 69 67 43 49 2f 47 66 55 6c 61 6e 4a 5a 50 6a 65 2f 6e 48 51 6b 47 39 44 43 2b 4b 41 63 6f 49 32 45 78 68 6b 73 6c 2b 78 77 4c 32 6e 72 52 68 79 79 4a 4a 72 50 4d 55 57 4e 44 51 73 59 39 75 61 45 34 42 4f 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: OqNE3hBa2UucbERA.2Context: 4c11c6bcc36e2665<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUsqs9u0Ftf/p7hH66Aa4m9MJVwRHaHxwiVvLKYpZigCI/GfUlanJZPje/nHQkG9DC+KAcoI2Exhksl+xwL2nrRhyyJJrPMUWNDQsY9uaE4BOp
2025-01-24 00:01:38 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4f 71 4e 45 33 68 42 61 32 55 75 63 62 45 52 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 63 31 31 63 36 62 63 63 33 36 65 32 36 36 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: OqNE3hBa2UucbERA.3Context: 4c11c6bcc36e2665<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-24 00:01:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-24 00:01:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 42 79 71 65 71 43 74 4e 30 47 35 6e 49 59 48 74 66 59 57 58 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: OByqeqCtN0G5nIYHtfYWXg.0Payload parsing failed.

Target ID:	1
Start time:	19:00:25
Start date:	23/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	19:00:30
Start date:	23/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2488,i,2308581532159020147,4756925217575398187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	19:00:36
Start date:	23/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tele-gram-gs.rent/"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://tele-gram-gs.rent/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6656, Parent PID: 5928

General

Chronological Activities

Analysis Process: chrome.exePID: 5144, Parent PID: 6656

General

Chronological Activities

Analysis Process: chrome.exePID: 4420, Parent PID: 5928

General

Chronological Activities

Disassembly

Windows Analysis Report
https://tele-gram-gs.rent/