Edit tour

Windows Analysis Report
http://www.cajamar-soporte.com

Overview

General Information

Sample URL:	http://www.cajamar-soporte.com
Analysis ID:	1466880
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1968,i,4168028207707315712,12834125092476391758,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.cajamar-soporte.com" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /report/v4?s=2ReDujBCiZMW5NfdpoJEvtBz%2B%2Ba8kcV1mpfGCo6Job6m7m2emEn5xu%2Bhk8Xdq%2FgA7RNBZNBOO8UAiCv6zqD6AZ%2Br590YB%2FL%2BYEmikl4jMr1JUtGeTbKLjgLQiEMTmKb8x7fyfG%2FMILgIDQ%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 392Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 12:34:51 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2ReDujBCiZMW5NfdpoJEvtBz%2B%2Ba8kcV1mpfGCo6Job6m7m2emEn5xu%2Bhk8Xdq%2FgA7RNBZNBOO8UAiCv6zqD6AZ%2Br590YB%2FL%2BYEmikl4jMr1JUtGeTbKLjgLQiEMTmKb8x7fyfG%2FMILgIDQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89d6e97dbd574235-EWRalt-svc: h3=":443"; ma=86400

Source: sets.json.0.dr	String found in binary or memory: https://24.hu
Source: sets.json.0.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.0.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.0.dr	String found in binary or memory: https://alice.tw
Source: sets.json.0.dr	String found in binary or memory: https://ambitionbox.com
Source: sets.json.0.dr	String found in binary or memory: https://autobild.de
Source: sets.json.0.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.0.dr	String found in binary or memory: https://bild.de
Source: sets.json.0.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.0.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.0.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.0.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.0.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.0.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.0.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.0.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.0.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.0.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.0.dr	String found in binary or memory: https://chennien.com
Source: sets.json.0.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.0.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.0.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.0.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.0.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.0.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.0.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.0.dr	String found in binary or memory: https://deere.com
Source: sets.json.0.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.0.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.0.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.0.dr	String found in binary or memory: https://een.be
Source: sets.json.0.dr	String found in binary or memory: https://efront.com
Source: sets.json.0.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.0.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.0.dr	String found in binary or memory: https://ella.sv
Source: sets.json.0.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.0.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.0.dr	String found in binary or memory: https://finn.no
Source: sets.json.0.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.0.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.0.dr	String found in binary or memory: https://gettalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.0.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.0.dr	String found in binary or memory: https://grid.id
Source: sets.json.0.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.0.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.0.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.0.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://hapara.com
Source: sets.json.0.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.global
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.0.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.0.dr	String found in binary or memory: https://hearty.app
Source: sets.json.0.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.0.dr	String found in binary or memory: https://hearty.me
Source: sets.json.0.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.0.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.0.dr	String found in binary or memory: https://hj.rs
Source: sets.json.0.dr	String found in binary or memory: https://hjck.com
Source: sets.json.0.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.0.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.0.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.0.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.0.dr	String found in binary or memory: https://intoday.in
Source: sets.json.0.dr	String found in binary or memory: https://iolam.it
Source: sets.json.0.dr	String found in binary or memory: https://ishares.com
Source: sets.json.0.dr	String found in binary or memory: https://jagran.com
Source: sets.json.0.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.0.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.0.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.0.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.0.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.0.dr	String found in binary or memory: https://libero.it
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.0.dr	String found in binary or memory: https://livechat.com
Source: sets.json.0.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.0.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.0.dr	String found in binary or memory: https://livemint.com
Source: sets.json.0.dr	String found in binary or memory: https://max.auto
Source: sets.json.0.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.0.dr	String found in binary or memory: https://meo.pt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.0.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.0.dr	String found in binary or memory: https://money.pl
Source: sets.json.0.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://nacion.com
Source: sets.json.0.dr	String found in binary or memory: https://naukri.com
Source: sets.json.0.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.co
Source: sets.json.0.dr	String found in binary or memory: https://nien.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.org
Source: sets.json.0.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.0.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.0.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.0.dr	String found in binary or memory: https://o2.pl
Source: sets.json.0.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.0.dr	String found in binary or memory: https://onet.pl
Source: sets.json.0.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.0.dr	String found in binary or memory: https://p106.net
Source: sets.json.0.dr	String found in binary or memory: https://p24.hu
Source: sets.json.0.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.0.dr	String found in binary or memory: https://player.pl
Source: sets.json.0.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.0.dr	String found in binary or memory: https://poalim.site
Source: sets.json.0.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.0.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.0.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.0.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://radio1.be
Source: sets.json.0.dr	String found in binary or memory: https://radio2.be
Source: sets.json.0.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://repid.org
Source: sets.json.0.dr	String found in binary or memory: https://reshim.org
Source: sets.json.0.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.0.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.0.dr	String found in binary or memory: https://samayam.com
Source: sets.json.0.dr	String found in binary or memory: https://sapo.io
Source: sets.json.0.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.0.dr	String found in binary or memory: https://shock.co
Source: sets.json.0.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.0.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.0.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.0.dr	String found in binary or memory: https://songshare.com
Source: sets.json.0.dr	String found in binary or memory: https://songstats.com
Source: sets.json.0.dr	String found in binary or memory: https://sporza.be
Source: sets.json.0.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.0.dr	String found in binary or memory: https://stripe.com
Source: sets.json.0.dr	String found in binary or memory: https://stripe.network
Source: sets.json.0.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.0.dr	String found in binary or memory: https://supereva.it
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.0.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.0.dr	String found in binary or memory: https://text.com
Source: sets.json.0.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.0.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.0.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.0.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.0.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://tvid.in
Source: sets.json.0.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.0.dr	String found in binary or memory: https://unotv.com
Source: sets.json.0.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.0.dr	String found in binary or memory: https://vrt.be
Source: sets.json.0.dr	String found in binary or memory: https://vwo.com
Source: sets.json.0.dr	String found in binary or memory: https://welt.de
Source: sets.json.0.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.dr	String found in binary or memory: https://wildix.com
Source: sets.json.0.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.0.dr	String found in binary or memory: https://wingify.com
Source: sets.json.0.dr	String found in binary or memory: https://wordle.at
Source: sets.json.0.dr	String found in binary or memory: https://wp.pl
Source: sets.json.0.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.0.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.0.dr	String found in binary or memory: https://ya.ru
Source: sets.json.0.dr	String found in binary or memory: https://zalo.me
Source: sets.json.0.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://zingmp3.vn

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55227
Source: unknown	Network traffic detected: HTTP traffic on port 55227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55229
Source: unknown	Network traffic detected: HTTP traffic on port 55229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55226
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:63101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:55226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:55229 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_1268_1871923596

Jump to behavior

Source: classification engine

Classification label: mal48.win@19/5@8/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1968,i,4168028207707315712,12834125092476391758,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.cajamar-soporte.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1968,i,4168028207707315712,12834125092476391758,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://www.cajamar-soporte.com	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label
https://wieistmeineip.de	0%	URL Reputation	safe
https://mercadoshops.com.co	0%	URL Reputation	safe
https://gliadomain.com	0%	URL Reputation	safe
https://poalim.xyz	0%	URL Reputation	safe
https://mercadolivre.com	0%	URL Reputation	safe
https://reshim.org	0%	URL Reputation	safe
https://nourishingpursuits.com	0%	URL Reputation	safe
https://medonet.pl	0%	URL Reputation	safe
https://unotv.com	0%	URL Reputation	safe
https://mercadoshops.com.br	0%	URL Reputation	safe
https://zdrowietvn.pl	0%	URL Reputation	safe
https://songstats.com	0%	URL Reputation	safe
https://baomoi.com	0%	URL Reputation	safe
https://supereva.it	0%	URL Reputation	safe
https://elfinancierocr.com	0%	URL Reputation	safe
https://bolasport.com	0%	URL Reputation	safe
https://rws1nvtvt.com	0%	URL Reputation	safe
https://desimartini.com	0%	URL Reputation	safe
https://hearty.app	0%	URL Reputation	safe
https://hearty.gift	0%	URL Reputation	safe
https://mercadoshops.com	0%	URL Reputation	safe
https://heartymail.com	0%	URL Reputation	safe
https://p106.net	0%	URL Reputation	safe
https://radio2.be	0%	URL Reputation	safe
https://finn.no	0%	URL Reputation	safe
https://hc1.com	0%	URL Reputation	safe
https://kompas.tv	0%	URL Reputation	safe
https://mystudentdashboard.com	0%	URL Reputation	safe
https://songshare.com	0%	URL Reputation	safe
https://mercadopago.com.mx	0%	URL Reputation	safe
https://p24.hu	0%	URL Reputation	safe
https://talkdeskqaid.com	0%	URL Reputation	safe
https://mercadopago.com.pe	0%	URL Reputation	safe
https://cardsayings.net	0%	URL Reputation	safe
https://mightytext.net	0%	URL Reputation	safe
https://pudelek.pl	0%	URL Reputation	safe
https://hazipatika.com	0%	URL Reputation	safe
https://joyreactor.com	0%	URL Reputation	safe
https://cookreactor.com	0%	URL Reputation	safe
https://wildixin.com	0%	URL Reputation	safe
https://eworkbookcloud.com	0%	URL Reputation	safe
https://cognitiveai.ru	0%	URL Reputation	safe
https://nacion.com	0%	URL Reputation	safe
https://chennien.com	0%	URL Reputation	safe
https://mercadopago.cl	0%	URL Reputation	safe
https://talkdeskstgid.com	0%	URL Reputation	safe
https://bonvivir.com	0%	URL Reputation	safe
https://carcostadvisor.be	0%	URL Reputation	safe
https://salemovetravel.com	0%	URL Reputation	safe
https://sapo.io	0%	URL Reputation	safe
https://wpext.pl	0%	URL Reputation	safe
https://welt.de	0%	URL Reputation	safe
https://poalim.site	0%	URL Reputation	safe
https://blackrockadvisorelite.it	0%	URL Reputation	safe
https://cognitive-ai.ru	0%	URL Reputation	safe
https://cafemedia.com	0%	URL Reputation	safe
https://thirdspace.org.au	0%	URL Reputation	safe
https://mercadoshops.com.ar	0%	URL Reputation	safe
https://smpn106jkt.sch.id	0%	URL Reputation	safe
https://elpais.uy	0%	URL Reputation	safe
https://landyrev.com	0%	URL Reputation	safe
https://commentcamarche.com	0%	URL Reputation	safe
https://tucarro.com.ve	0%	URL Reputation	safe
https://rws3nvtvt.com	0%	URL Reputation	safe
https://eleconomista.net	0%	URL Reputation	safe
https://clmbtech.com	0%	URL Reputation	safe
https://standardsandpraiserepurpose.com	0%	URL Reputation	safe
https://salemovefinancial.com	0%	URL Reputation	safe
https://mercadopago.com.br	0%	URL Reputation	safe
https://commentcamarche.net	0%	URL Reputation	safe
https://etfacademy.it	0%	URL Reputation	safe
https://mighty-app.appspot.com	0%	URL Reputation	safe
https://hj.rs	0%	URL Reputation	safe
https://hearty.me	0%	URL Reputation	safe
https://mercadolibre.com.gt	0%	URL Reputation	safe
https://timesinternet.in	0%	URL Reputation	safe
https://indiatodayne.in	0%	URL Reputation	safe
https://idbs-staging.com	0%	URL Reputation	safe
https://blackrock.com	0%	URL Reputation	safe
https://idbs-eworkbook.com	0%	URL Reputation	safe
https://mercadolibre.co.cr	0%	URL Reputation	safe
https://hjck.com	0%	URL Reputation	safe
https://vrt.be	0%	URL Reputation	safe
https://prisjakt.no	0%	URL Reputation	safe
https://kompas.com	0%	URL Reputation	safe
https://idbs-dev.com	0%	URL Reputation	safe
https://joyreactor.cc	0%	Avira URL Cloud	safe
https://wingify.com	0%	URL Reputation	safe
https://johndeere.com	0%	Avira URL Cloud	safe
https://mercadolibre.cl	0%	URL Reputation	safe
https://player.pl	0%	URL Reputation	safe
https://nlc.hu	0%	Avira URL Cloud	safe
https://text.com	0%	Avira URL Cloud	safe
https://24.hu	0%	Avira URL Cloud	safe
https://naukri.com	0%	Avira URL Cloud	safe
https://infoedgeindia.com	0%	Avira URL Cloud	safe
https://mercadolivre.com.br	0%	Avira URL Cloud	safe
https://helpdesk.com	0%	Avira URL Cloud	safe
https://mercadopago.com.ar	0%	Avira URL Cloud	safe
https://mercadolibre.com.hn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
www.google.com	142.250.186.164	true	false	unknown
www.cajamar-soporte.com	188.114.96.3	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wieistmeineip.de	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.co	sets.json.0.dr	false	URL Reputation: safe	unknown
https://gliadomain.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://poalim.xyz	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadolivre.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://reshim.org	sets.json.0.dr	false	URL Reputation: safe	unknown
https://nourishingpursuits.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://medonet.pl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://unotv.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.br	sets.json.0.dr	false	URL Reputation: safe	unknown
https://joyreactor.cc	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://zdrowietvn.pl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://johndeere.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://songstats.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://baomoi.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://supereva.it	sets.json.0.dr	false	URL Reputation: safe	unknown
https://elfinancierocr.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://bolasport.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://rws1nvtvt.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://desimartini.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hearty.app	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hearty.gift	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://heartymail.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://nlc.hu	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://p106.net	sets.json.0.dr	false	URL Reputation: safe	unknown
https://radio2.be	sets.json.0.dr	false	URL Reputation: safe	unknown
https://finn.no	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hc1.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://kompas.tv	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mystudentdashboard.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://songshare.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.mx	sets.json.0.dr	false	URL Reputation: safe	unknown
https://p24.hu	sets.json.0.dr	false	URL Reputation: safe	unknown
https://talkdeskqaid.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://24.hu	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadopago.com.pe	sets.json.0.dr	false	URL Reputation: safe	unknown
https://cardsayings.net	sets.json.0.dr	false	URL Reputation: safe	unknown
https://text.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mightytext.net	sets.json.0.dr	false	URL Reputation: safe	unknown
https://pudelek.pl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hazipatika.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://joyreactor.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://cookreactor.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://wildixin.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://eworkbookcloud.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://cognitiveai.ru	sets.json.0.dr	false	URL Reputation: safe	unknown
https://nacion.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://chennien.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadopago.cl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://talkdeskstgid.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://naukri.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://bonvivir.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://carcostadvisor.be	sets.json.0.dr	false	URL Reputation: safe	unknown
https://salemovetravel.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://sapo.io	sets.json.0.dr	false	URL Reputation: safe	unknown
https://wpext.pl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://welt.de	sets.json.0.dr	false	URL Reputation: safe	unknown
https://poalim.site	sets.json.0.dr	false	URL Reputation: safe	unknown
https://infoedgeindia.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://blackrockadvisorelite.it	sets.json.0.dr	false	URL Reputation: safe	unknown
https://cognitive-ai.ru	sets.json.0.dr	false	URL Reputation: safe	unknown
https://cafemedia.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://thirdspace.org.au	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.ar	sets.json.0.dr	false	URL Reputation: safe	unknown
https://smpn106jkt.sch.id	sets.json.0.dr	false	URL Reputation: safe	unknown
https://elpais.uy	sets.json.0.dr	false	URL Reputation: safe	unknown
https://landyrev.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://commentcamarche.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://tucarro.com.ve	sets.json.0.dr	false	URL Reputation: safe	unknown
https://rws3nvtvt.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://eleconomista.net	sets.json.0.dr	false	URL Reputation: safe	unknown
https://helpdesk.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadolivre.com.br	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://clmbtech.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://standardsandpraiserepurpose.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://salemovefinancial.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.br	sets.json.0.dr	false	URL Reputation: safe	unknown
https://commentcamarche.net	sets.json.0.dr	false	URL Reputation: safe	unknown
https://etfacademy.it	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mighty-app.appspot.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hj.rs	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hearty.me	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadolibre.com.gt	sets.json.0.dr	false	URL Reputation: safe	unknown
https://timesinternet.in	sets.json.0.dr	false	URL Reputation: safe	unknown
https://indiatodayne.in	sets.json.0.dr	false	URL Reputation: safe	unknown
https://idbs-staging.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://blackrock.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://idbs-eworkbook.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadolibre.co.cr	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hjck.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://vrt.be	sets.json.0.dr	false	URL Reputation: safe	unknown
https://prisjakt.no	sets.json.0.dr	false	URL Reputation: safe	unknown
https://kompas.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://idbs-dev.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://wingify.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadolibre.cl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://player.pl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.ar	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadolibre.com.hn	sets.json.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	www.cajamar-soporte.com	European Union	13335	CLOUDFLARENETUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.9
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466880
Start date and time:	2024-07-03 14:33:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.cajamar-soporte.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@19/5@8/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.227, 142.250.186.110, 64.233.184.84, 34.104.35.123, 52.165.165.26, 192.229.221.95, 13.85.23.206, 93.184.221.240, 52.165.164.15, 2.16.100.168, 88.221.110.91, 142.250.186.163
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, client.wns.windows.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, 6.d.a.8.b.e.f.b.0.0.0.0.0.0.0.0.4.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: http://www.cajamar-soporte.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	low
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.0157277397082884
Encrypted:	false
SSDEEP:	48:p/hUI15ul1AdIj7ak+wsdrtra1cuUX0eYDAA98gkXhVdEXeXF:RnQQIj7aL11ayjgDzUSXYF
MD5:	4CBD807685B88243CC9EA3E4B60FE8FD
SHA1:	B02FB2A85ECBEA61424F9F14A32590FA2041C068
SHA-256:	8E9B53C9DCD85F58E64164CEAF4E327B52B88C98946EF1067B112B3C9BDC5FEE
SHA-512:	61B4E345BB2AE6BD8907C1D23582709D21089504B23497EC0906D489C096CE981F31CE0D2A2FB5B97E3E5B8D71B36ECC1B0393F55AE9007D36D790FA0B7C4161
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJ4UlFLT0lkOFU5ZzZhTTNZdnlieVpyUVcwUnRvM3JWeXpwaXQ3RjB4YUZnIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiQ1k5VzJMb3NsRkxMQmR3VFhVVFJNYnBxdnVSd2g1SVByT1ZsdG9BSUlFNCJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC42LjI2LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"JwsfiQnUWfcg0_PuT83D82ftcuaZ7vEsE_gMNDBSQyf3yMBDUgfqYwvvVFJbiHScUgP70t-BqLn6UQvY0bPu6W8oxy6WzuhegflPkarNrUr5BrTQ6T6GUQS5rb5hsCNYhNq2yDXc6JRw2fVbWfO5BsQ7VSpW8gO0oN3x3Ju-4Lr72tesPWvv_g2rkIXZLJHw4z1oZoKx1T2xY6ncKsFBbLnmD1gUSN3iAPPZ9zHg41a62wpcpb9uWRD

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.760377931718998
Encrypted:	false
SSDEEP:	3:SURcG3XcDLSHH33BU9DcWTNnn:SUj2SHHBCcWpnn
MD5:	C18D2397B5F0CFF55132B016467CA189
SHA1:	B60B8ADF7CABF73855BB17212831736FB0CB9F74
SHA-256:	5C3233CF05E64742B923685C31E5347CABA89B198FD4A1BBA59A9500C3C16082
SHA-512:	5EF20571951238C960107E0F16ABC3C5FDEAFC6CED038220835B5341C18CEB7C144FB2B2CCA1094C98C5900A15A1B1B1FA3357E011C492805567AE56DE57A1B6
Malicious:	false
Reputation:	low
Preview:	1.1848d9cb81709d6bb8a9612e1cba9fc97bb669c7ef81e2d11c0f937896df8e27

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.424014792499492
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1jvhg:F6VlM8aRWpqS16
MD5:	2C221BDCF91C9C07551499EE4CD15A6F
SHA1:	CBC3CE0947A3D61A7673A7729CA25DB7DB023336
SHA-256:	C5140A38877C53D83A68CDD8BF26F266B416D11B68DEB572CE98ADEC5D316858
SHA-512:	B77656D3D8598FB946F988906FBE4399B30C4B1DB284FA187C617ECAADA0C98EB913572D4361E43058A68D175E95451B05F875372669ACF98DD1BAAE59F8D9BE
Malicious:	false
Reputation:	low
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.6.26.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9068
Entropy (8bit):	4.624080015119112
Encrypted:	false
SSDEEP:	96:Mon4mvCSqX1gs9/BNKLcxbdmf56MFJtRTGXvcxNnuP+8qJq:v5CSqlTBkIVmtRTGXvcx0sq
MD5:	1D67EF4C7F90E1C8A620ADF17C6B6B13
SHA1:	E90E51A4A2305BCBD5016A3CA02CD14F77FDCBBA
SHA-256:	578DF0513FF5FA4080BDFC0B7094DCB444E09CD3AB3DCBC60165D1369681E2C1
SHA-512:	59B80B6A767EA95254CC64A5CDC17DF3ACC2F0B0E52416D86477109A1EDAB7479E0B1AEAB1FF793F8DC1807AAFAB38915A8267D4F31F618E99DF1AB07C095EE9
Malicious:	false
Reputation:	low
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://elpais.com.uy","

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 14:34:39.273895979 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 3, 2024 14:34:39.274677992 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 3, 2024 14:34:39.274739027 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 3, 2024 14:34:39.275130033 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 3, 2024 14:34:39.275146961 CEST	443	49709	40.115.3.253	192.168.2.6
Jul 3, 2024 14:34:39.275163889 CEST	49709	443	192.168.2.6	40.115.3.253
Jul 3, 2024 14:34:42.787651062 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:42.787683964 CEST	443	49710	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:42.787781954 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:42.788866997 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:42.788877010 CEST	443	49710	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:43.381578922 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 3, 2024 14:34:43.381742954 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 3, 2024 14:34:43.572477102 CEST	443	49710	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:43.572619915 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:43.631352901 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:43.631364107 CEST	443	49710	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:43.631678104 CEST	443	49710	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:43.678510904 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:43.680382967 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:43.680444956 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:43.680453062 CEST	443	49710	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:43.680886984 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:43.709687948 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 3, 2024 14:34:43.728507996 CEST	443	49710	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:43.870326996 CEST	443	49710	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:43.871517897 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:43.871526003 CEST	443	49710	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:43.871606112 CEST	49710	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:50.596090078 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 14:34:50.596127987 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 14:34:50.596194983 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 14:34:50.596436977 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 14:34:50.596446991 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 14:34:51.069082975 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 14:34:51.069370031 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 14:34:51.069386005 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 14:34:51.070254087 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 14:34:51.070319891 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 14:34:51.071384907 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 14:34:51.071455956 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 14:34:51.071595907 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 14:34:51.071600914 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 14:34:51.112067938 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 14:34:51.468801975 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 14:34:51.468868017 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 14:34:51.468926907 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 14:34:51.469808102 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 14:34:51.469825029 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 14:34:51.482283115 CEST	49718	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:51.482315063 CEST	443	49718	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:51.482372046 CEST	49718	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:51.482585907 CEST	49718	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:51.482594013 CEST	443	49718	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:51.633677006 CEST	49720	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:51.633717060 CEST	443	49720	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:51.633784056 CEST	49720	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:51.634502888 CEST	49720	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:51.634515047 CEST	443	49720	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:51.961798906 CEST	443	49718	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:51.973145008 CEST	49718	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:51.973160982 CEST	443	49718	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:51.974138975 CEST	443	49718	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:51.974200964 CEST	49718	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:51.975672960 CEST	49718	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:51.975723028 CEST	443	49718	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:51.975905895 CEST	49718	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:51.975910902 CEST	443	49718	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.020087004 CEST	49718	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.145253897 CEST	443	49718	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.145962954 CEST	49718	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.145987034 CEST	443	49718	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.146038055 CEST	49718	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.147341967 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.147362947 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.147428036 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.147928953 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.147936106 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.461287975 CEST	443	49720	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:52.461381912 CEST	49720	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:52.466038942 CEST	49720	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:52.466048002 CEST	443	49720	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:52.466414928 CEST	443	49720	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:52.471050978 CEST	49720	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:52.471236944 CEST	49720	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:52.471242905 CEST	443	49720	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:52.471631050 CEST	49720	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:52.516530991 CEST	443	49720	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:52.605010033 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.605501890 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.605516911 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.607584953 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.607641935 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.608855963 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.609086037 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.609093904 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.609126091 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.645100117 CEST	443	49720	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:52.645217896 CEST	443	49720	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:52.645324945 CEST	49720	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:52.660698891 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.660715103 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.667834997 CEST	49720	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:52.667856932 CEST	443	49720	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:52.707576036 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.733313084 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.733382940 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.733428001 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.733834028 CEST	49721	443	192.168.2.6	35.190.80.1
Jul 3, 2024 14:34:52.733846903 CEST	443	49721	35.190.80.1	192.168.2.6
Jul 3, 2024 14:34:52.988826990 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 3, 2024 14:34:52.988826990 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 3, 2024 14:34:53.316961050 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 3, 2024 14:34:53.423821926 CEST	49722	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:34:53.423871040 CEST	443	49722	142.250.186.164	192.168.2.6
Jul 3, 2024 14:34:53.424236059 CEST	49722	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:34:53.424638987 CEST	49722	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:34:53.424655914 CEST	443	49722	142.250.186.164	192.168.2.6
Jul 3, 2024 14:34:53.762526035 CEST	49723	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:53.762567997 CEST	443	49723	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:53.762700081 CEST	49723	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:53.765863895 CEST	49723	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:53.765877962 CEST	443	49723	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.058985949 CEST	443	49722	142.250.186.164	192.168.2.6
Jul 3, 2024 14:34:54.059406042 CEST	49722	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:34:54.059418917 CEST	443	49722	142.250.186.164	192.168.2.6
Jul 3, 2024 14:34:54.060378075 CEST	443	49722	142.250.186.164	192.168.2.6
Jul 3, 2024 14:34:54.060497046 CEST	49722	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:34:54.061783075 CEST	49722	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:34:54.061832905 CEST	443	49722	142.250.186.164	192.168.2.6
Jul 3, 2024 14:34:54.114228010 CEST	49722	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:34:54.114243031 CEST	443	49722	142.250.186.164	192.168.2.6
Jul 3, 2024 14:34:54.161029100 CEST	49722	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:34:54.429883957 CEST	443	49723	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.429951906 CEST	49723	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:54.432216883 CEST	49723	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:54.432231903 CEST	443	49723	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.432554960 CEST	443	49723	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.473542929 CEST	49723	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:54.480170012 CEST	49723	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:54.520509005 CEST	443	49723	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.703166962 CEST	443	49723	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.703233004 CEST	443	49723	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.703305960 CEST	49723	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:54.703418016 CEST	49723	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:54.703418016 CEST	49723	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:54.703433990 CEST	443	49723	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.703444958 CEST	443	49723	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.743844986 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:54.743899107 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.744025946 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:54.744385958 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:54.744401932 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:54.951169014 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:54.951203108 CEST	443	49725	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:54.951354027 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:54.952888966 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:54.952899933 CEST	443	49725	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:54.964551926 CEST	443	49705	173.222.162.64	192.168.2.6
Jul 3, 2024 14:34:54.964642048 CEST	49705	443	192.168.2.6	173.222.162.64
Jul 3, 2024 14:34:55.380026102 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:55.380088091 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:55.405092001 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:55.405119896 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:55.405482054 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:55.408401966 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:55.452502966 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:55.655921936 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:55.656006098 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:55.656246901 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:55.657679081 CEST	49724	443	192.168.2.6	184.28.90.27
Jul 3, 2024 14:34:55.657696009 CEST	443	49724	184.28.90.27	192.168.2.6
Jul 3, 2024 14:34:55.777184010 CEST	443	49725	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:55.777273893 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:55.780987024 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:55.780992985 CEST	443	49725	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:55.781754017 CEST	443	49725	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:55.784635067 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:55.784908056 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:55.784912109 CEST	443	49725	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:55.785115004 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:55.828545094 CEST	443	49725	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:55.965903997 CEST	443	49725	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:55.966258049 CEST	443	49725	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:55.966325045 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:55.966377020 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:55.966392994 CEST	443	49725	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:55.966415882 CEST	49725	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:59.531886101 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:59.531932116 CEST	443	49726	40.113.103.199	192.168.2.6
Jul 3, 2024 14:34:59.532017946 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:59.532596111 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:34:59.532608986 CEST	443	49726	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:00.347877026 CEST	443	49726	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:00.347946882 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:00.350020885 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:00.350028992 CEST	443	49726	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:00.350337029 CEST	443	49726	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:00.352251053 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:00.352302074 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:00.352307081 CEST	443	49726	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:00.352442026 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:00.396502018 CEST	443	49726	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:00.527951002 CEST	443	49726	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:00.528106928 CEST	443	49726	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:00.528366089 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:00.528366089 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:00.528403044 CEST	443	49726	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:00.528450966 CEST	49726	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:03.964068890 CEST	443	49722	142.250.186.164	192.168.2.6
Jul 3, 2024 14:35:03.964126110 CEST	443	49722	142.250.186.164	192.168.2.6
Jul 3, 2024 14:35:03.964165926 CEST	49722	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:35:05.476531982 CEST	49722	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:35:05.476573944 CEST	443	49722	142.250.186.164	192.168.2.6
Jul 3, 2024 14:35:11.620343924 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:11.620393038 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:11.624463081 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:11.625670910 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:11.625689983 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:12.415724993 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:12.415896893 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:12.421550989 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:12.421570063 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:12.421912909 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:12.426697969 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:12.426923990 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:12.426923990 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:12.426934004 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:12.472511053 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:12.601349115 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:12.601821899 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:12.601885080 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:12.602389097 CEST	49731	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:12.602408886 CEST	443	49731	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:16.691335917 CEST	49732	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:16.691375017 CEST	443	49732	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:16.691503048 CEST	49732	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:16.692082882 CEST	49732	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:16.692096949 CEST	443	49732	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:17.559844017 CEST	443	49732	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:17.559911966 CEST	49732	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:17.562231064 CEST	49732	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:17.562244892 CEST	443	49732	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:17.562499046 CEST	443	49732	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:17.563822031 CEST	49732	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:17.563903093 CEST	49732	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:17.563910961 CEST	443	49732	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:17.564030886 CEST	49732	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:17.608501911 CEST	443	49732	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:17.736449003 CEST	443	49732	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:17.736546040 CEST	443	49732	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:17.736653090 CEST	49732	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:17.736819029 CEST	49732	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:17.736840963 CEST	443	49732	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:30.051420927 CEST	49733	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:30.051474094 CEST	443	49733	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:30.051537991 CEST	49733	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:30.053369045 CEST	49733	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:30.053383112 CEST	443	49733	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:30.609049082 CEST	63098	53	192.168.2.6	162.159.36.2
Jul 3, 2024 14:35:30.615333080 CEST	53	63098	162.159.36.2	192.168.2.6
Jul 3, 2024 14:35:30.615780115 CEST	63098	53	192.168.2.6	162.159.36.2
Jul 3, 2024 14:35:30.615780115 CEST	63098	53	192.168.2.6	162.159.36.2
Jul 3, 2024 14:35:30.620719910 CEST	53	63098	162.159.36.2	192.168.2.6
Jul 3, 2024 14:35:30.859437943 CEST	443	49733	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:30.859508038 CEST	49733	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:30.864089966 CEST	49733	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:30.864100933 CEST	443	49733	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:30.864305019 CEST	443	49733	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:30.866077900 CEST	49733	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:30.866187096 CEST	49733	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:30.866192102 CEST	443	49733	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:30.866348982 CEST	49733	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:30.908502102 CEST	443	49733	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:31.047923088 CEST	443	49733	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:31.048121929 CEST	443	49733	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:31.048196077 CEST	49733	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:31.048455954 CEST	49733	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:31.048475027 CEST	443	49733	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:31.064167976 CEST	53	63098	162.159.36.2	192.168.2.6
Jul 3, 2024 14:35:31.064899921 CEST	63098	53	192.168.2.6	162.159.36.2
Jul 3, 2024 14:35:31.070903063 CEST	53	63098	162.159.36.2	192.168.2.6
Jul 3, 2024 14:35:31.070961952 CEST	63098	53	192.168.2.6	162.159.36.2
Jul 3, 2024 14:35:34.483674049 CEST	80	49704	217.20.57.34	192.168.2.6
Jul 3, 2024 14:35:34.483814955 CEST	49704	80	192.168.2.6	217.20.57.34
Jul 3, 2024 14:35:34.483895063 CEST	49704	80	192.168.2.6	217.20.57.34
Jul 3, 2024 14:35:34.490355968 CEST	80	49704	217.20.57.34	192.168.2.6
Jul 3, 2024 14:35:39.899890900 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:39.899935007 CEST	443	63101	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:39.900170088 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:39.900645971 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:39.900656939 CEST	443	63101	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:40.690068960 CEST	443	63101	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:40.690152884 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:40.692715883 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:40.692739010 CEST	443	63101	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:40.693006039 CEST	443	63101	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:40.694946051 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:40.695004940 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:40.695014000 CEST	443	63101	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:40.695204020 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:40.736512899 CEST	443	63101	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:40.866451025 CEST	443	63101	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:40.866667986 CEST	443	63101	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:40.866725922 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:40.866964102 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:40.866986990 CEST	443	63101	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:40.867027998 CEST	63101	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:50.873146057 CEST	55224	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:35:50.878124952 CEST	53	55224	1.1.1.1	192.168.2.6
Jul 3, 2024 14:35:50.878222942 CEST	55224	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:35:50.878222942 CEST	55224	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:35:50.883241892 CEST	53	55224	1.1.1.1	192.168.2.6
Jul 3, 2024 14:35:51.329349041 CEST	53	55224	1.1.1.1	192.168.2.6
Jul 3, 2024 14:35:51.330240011 CEST	55224	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:35:51.336349010 CEST	53	55224	1.1.1.1	192.168.2.6
Jul 3, 2024 14:35:51.336550951 CEST	55224	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:35:53.194277048 CEST	55226	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:53.194348097 CEST	443	55226	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:53.194422960 CEST	55226	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:53.195537090 CEST	55226	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:53.195550919 CEST	443	55226	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:53.465841055 CEST	55227	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:35:53.465882063 CEST	443	55227	142.250.186.164	192.168.2.6
Jul 3, 2024 14:35:53.465950966 CEST	55227	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:35:53.466392994 CEST	55227	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:35:53.466407061 CEST	443	55227	142.250.186.164	192.168.2.6
Jul 3, 2024 14:35:53.983916998 CEST	443	55226	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:53.984046936 CEST	55226	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:53.985869884 CEST	55226	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:53.985889912 CEST	443	55226	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:53.986138105 CEST	443	55226	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:53.987874985 CEST	55226	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:53.987935066 CEST	55226	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:53.987946987 CEST	443	55226	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:53.988071918 CEST	55226	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:54.032501936 CEST	443	55226	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:54.127389908 CEST	443	55227	142.250.186.164	192.168.2.6
Jul 3, 2024 14:35:54.127690077 CEST	55227	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:35:54.127722979 CEST	443	55227	142.250.186.164	192.168.2.6
Jul 3, 2024 14:35:54.128063917 CEST	443	55227	142.250.186.164	192.168.2.6
Jul 3, 2024 14:35:54.128396034 CEST	55227	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:35:54.128460884 CEST	443	55227	142.250.186.164	192.168.2.6
Jul 3, 2024 14:35:54.158113003 CEST	443	55226	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:54.158209085 CEST	443	55226	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:54.158274889 CEST	55226	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:54.158418894 CEST	55226	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:35:54.158441067 CEST	443	55226	40.113.103.199	192.168.2.6
Jul 3, 2024 14:35:54.177434921 CEST	55227	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:36:04.021330118 CEST	443	55227	142.250.186.164	192.168.2.6
Jul 3, 2024 14:36:04.021413088 CEST	443	55227	142.250.186.164	192.168.2.6
Jul 3, 2024 14:36:04.021466970 CEST	55227	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:36:05.826262951 CEST	55227	443	192.168.2.6	142.250.186.164
Jul 3, 2024 14:36:05.826299906 CEST	443	55227	142.250.186.164	192.168.2.6
Jul 3, 2024 14:36:07.591106892 CEST	55229	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:36:07.591145039 CEST	443	55229	40.113.103.199	192.168.2.6
Jul 3, 2024 14:36:07.591234922 CEST	55229	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:36:07.592683077 CEST	55229	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:36:07.592705965 CEST	443	55229	40.113.103.199	192.168.2.6
Jul 3, 2024 14:36:08.470338106 CEST	443	55229	40.113.103.199	192.168.2.6
Jul 3, 2024 14:36:08.470464945 CEST	55229	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:36:08.472453117 CEST	55229	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:36:08.472466946 CEST	443	55229	40.113.103.199	192.168.2.6
Jul 3, 2024 14:36:08.472733974 CEST	443	55229	40.113.103.199	192.168.2.6
Jul 3, 2024 14:36:08.474198103 CEST	55229	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:36:08.474198103 CEST	55229	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:36:08.474220037 CEST	443	55229	40.113.103.199	192.168.2.6
Jul 3, 2024 14:36:08.474400043 CEST	55229	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:36:08.520493984 CEST	443	55229	40.113.103.199	192.168.2.6
Jul 3, 2024 14:36:08.645261049 CEST	443	55229	40.113.103.199	192.168.2.6
Jul 3, 2024 14:36:08.645354986 CEST	443	55229	40.113.103.199	192.168.2.6
Jul 3, 2024 14:36:08.645412922 CEST	55229	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:36:08.645673037 CEST	55229	443	192.168.2.6	40.113.103.199
Jul 3, 2024 14:36:08.645694971 CEST	443	55229	40.113.103.199	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 14:34:48.895920038 CEST	53	49983	1.1.1.1	192.168.2.6
Jul 3, 2024 14:34:48.910232067 CEST	53	64452	1.1.1.1	192.168.2.6
Jul 3, 2024 14:34:49.997984886 CEST	53	52572	1.1.1.1	192.168.2.6
Jul 3, 2024 14:34:50.529367924 CEST	57992	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:34:50.529542923 CEST	51273	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:34:50.572201014 CEST	53	57992	1.1.1.1	192.168.2.6
Jul 3, 2024 14:34:50.572962999 CEST	53	51273	1.1.1.1	192.168.2.6
Jul 3, 2024 14:34:50.575534105 CEST	60170	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:34:50.575678110 CEST	58846	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:34:50.588932037 CEST	53	60170	1.1.1.1	192.168.2.6
Jul 3, 2024 14:34:50.593432903 CEST	53	58846	1.1.1.1	192.168.2.6
Jul 3, 2024 14:34:51.473149061 CEST	65458	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:34:51.473315001 CEST	64018	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:34:51.481008053 CEST	53	65458	1.1.1.1	192.168.2.6
Jul 3, 2024 14:34:51.481950998 CEST	53	64018	1.1.1.1	192.168.2.6
Jul 3, 2024 14:34:53.411717892 CEST	51623	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:34:53.412302971 CEST	59951	53	192.168.2.6	1.1.1.1
Jul 3, 2024 14:34:53.419444084 CEST	53	51623	1.1.1.1	192.168.2.6
Jul 3, 2024 14:34:53.421374083 CEST	53	59951	1.1.1.1	192.168.2.6
Jul 3, 2024 14:35:07.321564913 CEST	53	51682	1.1.1.1	192.168.2.6
Jul 3, 2024 14:35:26.529257059 CEST	53	55674	1.1.1.1	192.168.2.6
Jul 3, 2024 14:35:30.607511997 CEST	53	51010	162.159.36.2	192.168.2.6
Jul 3, 2024 14:35:31.089832067 CEST	53	49358	1.1.1.1	192.168.2.6
Jul 3, 2024 14:35:48.811536074 CEST	53	63552	1.1.1.1	192.168.2.6
Jul 3, 2024 14:35:49.117007017 CEST	53	63346	1.1.1.1	192.168.2.6
Jul 3, 2024 14:35:50.872699022 CEST	53	57016	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 14:34:50.529367924 CEST	192.168.2.6	1.1.1.1	0x3d0b	Standard query (0)	www.cajamar-soporte.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 14:34:50.529542923 CEST	192.168.2.6	1.1.1.1	0x780e	Standard query (0)	www.cajamar-soporte.com	65	IN (0x0001)	false
Jul 3, 2024 14:34:50.575534105 CEST	192.168.2.6	1.1.1.1	0x8b1	Standard query (0)	www.cajamar-soporte.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 14:34:50.575678110 CEST	192.168.2.6	1.1.1.1	0x7f43	Standard query (0)	www.cajamar-soporte.com	65	IN (0x0001)	false
Jul 3, 2024 14:34:51.473149061 CEST	192.168.2.6	1.1.1.1	0xd74c	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 14:34:51.473315001 CEST	192.168.2.6	1.1.1.1	0x5c1d	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jul 3, 2024 14:34:53.411717892 CEST	192.168.2.6	1.1.1.1	0x2a0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 14:34:53.412302971 CEST	192.168.2.6	1.1.1.1	0x8b7a	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 14:34:50.572201014 CEST	1.1.1.1	192.168.2.6	0x3d0b	No error (0)	www.cajamar-soporte.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 3, 2024 14:34:50.572201014 CEST	1.1.1.1	192.168.2.6	0x3d0b	No error (0)	www.cajamar-soporte.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 3, 2024 14:34:50.572962999 CEST	1.1.1.1	192.168.2.6	0x780e	No error (0)	www.cajamar-soporte.com			65	IN (0x0001)	false
Jul 3, 2024 14:34:50.588932037 CEST	1.1.1.1	192.168.2.6	0x8b1	No error (0)	www.cajamar-soporte.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 3, 2024 14:34:50.588932037 CEST	1.1.1.1	192.168.2.6	0x8b1	No error (0)	www.cajamar-soporte.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 3, 2024 14:34:50.593432903 CEST	1.1.1.1	192.168.2.6	0x7f43	No error (0)	www.cajamar-soporte.com			65	IN (0x0001)	false
Jul 3, 2024 14:34:51.481008053 CEST	1.1.1.1	192.168.2.6	0xd74c	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Jul 3, 2024 14:34:53.419444084 CEST	1.1.1.1	192.168.2.6	0x2a0	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Jul 3, 2024 14:34:53.421374083 CEST	1.1.1.1	192.168.2.6	0x8b7a	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 3, 2024 14:35:04.293545008 CEST	1.1.1.1	192.168.2.6	0x7637	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 14:35:04.293545008 CEST	1.1.1.1	192.168.2.6	0x7637	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.cajamar-soporte.com

a.nel.cloudflare.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:34:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 56 30 34 31 57 4a 67 53 6e 30 6d 4e 43 4c 46 58 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 39 39 35 36 33 35 62 37 61 39 31 64 63 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: V041WJgSn0mNCLFX.1Context: 3c995635b7a91dca
2024-07-03 12:34:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:34:39 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 56 30 34 31 57 4a 67 53 6e 30 6d 4e 43 4c 46 58 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 39 39 35 36 33 35 62 37 61 39 31 64 63 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: V041WJgSn0mNCLFX.2Context: 3c995635b7a91dca<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:34:39 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 56 30 34 31 57 4a 67 53 6e 30 6d 4e 43 4c 46 58 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 39 39 35 36 33 35 62 37 61 39 31 64 63 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: V041WJgSn0mNCLFX.3Context: 3c995635b7a91dca
2024-07-03 12:34:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:34:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 51 63 45 54 76 42 50 64 30 75 6d 36 33 39 2f 4c 7a 2f 74 70 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: bQcETvBPd0um639/Lz/tpw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49710	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:34:43 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 72 34 2b 57 34 38 4c 47 30 53 71 56 34 70 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 33 38 33 61 61 61 62 32 35 34 31 39 66 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: br4+W48LG0SqV4pr.1Context: a0383aaab25419f8
2024-07-03 12:34:43 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:34:43 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 62 72 34 2b 57 34 38 4c 47 30 53 71 56 34 70 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 33 38 33 61 61 61 62 32 35 34 31 39 66 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: br4+W48LG0SqV4pr.2Context: a0383aaab25419f8<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:34:43 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 62 72 34 2b 57 34 38 4c 47 30 53 71 56 34 70 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 33 38 33 61 61 61 62 32 35 34 31 39 66 38 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: br4+W48LG0SqV4pr.3Context: a0383aaab25419f8
2024-07-03 12:34:43 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:34:43 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 32 49 57 6a 42 52 64 69 39 6b 4b 54 72 51 48 64 4c 4b 74 6f 58 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 2IWjBRdi9kKTrQHdLKtoXA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49716	188.114.96.3	443	3816	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:34:51 UTC	666	OUT	GET / HTTP/1.1 Host: www.cajamar-soporte.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 12:34:51 UTC	605	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 12:34:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2ReDujBCiZMW5NfdpoJEvtBz%2B%2Ba8kcV1mpfGCo6Job6m7m2emEn5xu%2Bhk8Xdq%2FgA7RNBZNBOO8UAiCv6zqD6AZ%2Br590YB%2FL%2BYEmikl4jMr1JUtGeTbKLjgLQiEMTmKb8x7fyfG%2FMILgIDQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d6e97dbd574235-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 12:34:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49718	35.190.80.1	443	3816	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:34:51 UTC	568	OUT	OPTIONS /report/v4?s=2ReDujBCiZMW5NfdpoJEvtBz%2B%2Ba8kcV1mpfGCo6Job6m7m2emEn5xu%2Bhk8Xdq%2FgA7RNBZNBOO8UAiCv6zqD6AZ%2Br590YB%2FL%2BYEmikl4jMr1JUtGeTbKLjgLQiEMTmKb8x7fyfG%2FMILgIDQ%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://www.cajamar-soporte.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 12:34:52 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Wed, 03 Jul 2024 12:34:51 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49720	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:34:52 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 44 73 67 73 36 33 6e 47 6d 30 75 54 4c 72 6f 59 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 33 35 65 38 36 32 35 65 35 62 64 62 33 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Dsgs63nGm0uTLroY.1Context: 4d35e8625e5bdb37
2024-07-03 12:34:52 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:34:52 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 44 73 67 73 36 33 6e 47 6d 30 75 54 4c 72 6f 59 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 33 35 65 38 36 32 35 65 35 62 64 62 33 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: Dsgs63nGm0uTLroY.2Context: 4d35e8625e5bdb37<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:34:52 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 44 73 67 73 36 33 6e 47 6d 30 75 54 4c 72 6f 59 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 33 35 65 38 36 32 35 65 35 62 64 62 33 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Dsgs63nGm0uTLroY.3Context: 4d35e8625e5bdb37<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 12:34:52 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:34:52 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 2b 45 61 45 32 77 4b 55 30 4b 46 6e 4d 69 33 58 46 39 45 70 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: G+EaE2wKU0KFnMi3XF9EpQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49721	35.190.80.1	443	3816	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:34:52 UTC	502	OUT	POST /report/v4?s=2ReDujBCiZMW5NfdpoJEvtBz%2B%2Ba8kcV1mpfGCo6Job6m7m2emEn5xu%2Bhk8Xdq%2FgA7RNBZNBOO8UAiCv6zqD6AZ%2Br590YB%2FL%2BYEmikl4jMr1JUtGeTbKLjgLQiEMTmKb8x7fyfG%2FMILgIDQ%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 392 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 12:34:52 UTC	392	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 38 39 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 61 6a 61 6d 61 72 2d 73 6f 70 6f 72 Data Ascii: [{"age":1,"body":{"elapsed_time":893,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":404,"type":"http.error"},"type":"network-error","url":"https://www.cajamar-sopor
2024-07-03 12:34:52 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Wed, 03 Jul 2024 12:34:52 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49723	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:34:54 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 12:34:54 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=99250 Date: Wed, 03 Jul 2024 12:34:54 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49724	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:34:55 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 12:34:55 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=99259 Date: Wed, 03 Jul 2024 12:34:55 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-03 12:34:55 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49725	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:34:55 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 57 5a 4e 45 78 56 79 79 45 43 33 6b 49 32 4c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 61 32 36 64 35 64 65 61 64 33 39 64 36 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: tWZNExVyyEC3kI2L.1Context: 60a26d5dead39d6a
2024-07-03 12:34:55 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:34:55 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 74 57 5a 4e 45 78 56 79 79 45 43 33 6b 49 32 4c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 61 32 36 64 35 64 65 61 64 33 39 64 36 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: tWZNExVyyEC3kI2L.2Context: 60a26d5dead39d6a<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:34:55 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 74 57 5a 4e 45 78 56 79 79 45 43 33 6b 49 32 4c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 61 32 36 64 35 64 65 61 64 33 39 64 36 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: tWZNExVyyEC3kI2L.3Context: 60a26d5dead39d6a
2024-07-03 12:34:55 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:34:55 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 53 4e 32 58 53 42 42 38 55 75 38 75 51 39 43 65 70 79 4c 2f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8SN2XSBB8Uu8uQ9CepyL/A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49726	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:35:00 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 44 57 72 32 63 59 6e 4f 66 6b 36 38 31 2f 4a 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 30 36 65 61 38 31 36 62 32 66 66 66 32 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: DWr2cYnOfk681/J5.1Context: f606ea816b2fff2f
2024-07-03 12:35:00 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:35:00 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 44 57 72 32 63 59 6e 4f 66 6b 36 38 31 2f 4a 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 30 36 65 61 38 31 36 62 32 66 66 66 32 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: DWr2cYnOfk681/J5.2Context: f606ea816b2fff2f<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:35:00 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 44 57 72 32 63 59 6e 4f 66 6b 36 38 31 2f 4a 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 30 36 65 61 38 31 36 62 32 66 66 66 32 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: DWr2cYnOfk681/J5.3Context: f606ea816b2fff2f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 12:35:00 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:35:00 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 46 64 34 6f 76 44 68 37 78 30 6d 51 30 69 32 71 43 41 59 76 44 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Fd4ovDh7x0mQ0i2qCAYvDA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49731	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:35:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4d 33 73 4a 70 2b 72 6f 52 45 4f 4f 74 48 66 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 61 39 33 33 33 61 37 35 64 63 32 36 39 35 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: M3sJp+roREOOtHf/.1Context: 2a9333a75dc2695e
2024-07-03 12:35:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:35:12 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 4d 33 73 4a 70 2b 72 6f 52 45 4f 4f 74 48 66 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 61 39 33 33 33 61 37 35 64 63 32 36 39 35 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: M3sJp+roREOOtHf/.2Context: 2a9333a75dc2695e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:35:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4d 33 73 4a 70 2b 72 6f 52 45 4f 4f 74 48 66 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 61 39 33 33 33 61 37 35 64 63 32 36 39 35 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: M3sJp+roREOOtHf/.3Context: 2a9333a75dc2695e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 12:35:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:35:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 43 67 6f 65 49 38 4d 70 30 47 63 55 5a 65 74 2b 56 7a 69 56 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: kCgoeI8Mp0GcUZet+VziVw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49732	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:35:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 58 4d 6c 36 52 46 6f 4f 32 45 65 30 4b 4a 35 68 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 62 66 37 64 63 36 62 37 32 63 32 30 33 33 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: XMl6RFoO2Ee0KJ5h.1Context: dbf7dc6b72c2033a
2024-07-03 12:35:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:35:17 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 58 4d 6c 36 52 46 6f 4f 32 45 65 30 4b 4a 35 68 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 62 66 37 64 63 36 62 37 32 63 32 30 33 33 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: XMl6RFoO2Ee0KJ5h.2Context: dbf7dc6b72c2033a<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:35:17 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 58 4d 6c 36 52 46 6f 4f 32 45 65 30 4b 4a 35 68 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 62 66 37 64 63 36 62 37 32 63 32 30 33 33 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: XMl6RFoO2Ee0KJ5h.3Context: dbf7dc6b72c2033a
2024-07-03 12:35:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:35:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 72 64 71 46 46 63 64 59 73 55 65 46 33 6b 6d 74 59 6c 61 71 75 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: rdqFFcdYsUeF3kmtYlaquw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49733	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:35:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 49 45 78 4b 4a 4c 71 63 43 45 79 59 4e 51 35 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 61 61 34 63 34 33 66 34 63 36 34 30 65 35 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: IExKJLqcCEyYNQ5l.1Context: baa4c43f4c640e53
2024-07-03 12:35:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:35:30 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 49 45 78 4b 4a 4c 71 63 43 45 79 59 4e 51 35 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 61 61 34 63 34 33 66 34 63 36 34 30 65 35 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: IExKJLqcCEyYNQ5l.2Context: baa4c43f4c640e53<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:35:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 49 45 78 4b 4a 4c 71 63 43 45 79 59 4e 51 35 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 61 61 34 63 34 33 66 34 63 36 34 30 65 35 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: IExKJLqcCEyYNQ5l.3Context: baa4c43f4c640e53<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 12:35:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:35:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 37 35 6a 42 61 50 73 76 55 79 78 74 67 52 73 33 79 4f 6d 62 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: J75jBaPsvUyxtgRs3yOmbA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	63101	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:35:40 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 37 53 30 42 4e 33 61 77 75 6b 53 54 43 52 43 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 37 32 31 31 33 32 61 62 39 35 32 65 65 34 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 7S0BN3awukSTCRCT.1Context: d721132ab952ee44
2024-07-03 12:35:40 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:35:40 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 37 53 30 42 4e 33 61 77 75 6b 53 54 43 52 43 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 37 32 31 31 33 32 61 62 39 35 32 65 65 34 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 7S0BN3awukSTCRCT.2Context: d721132ab952ee44<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:35:40 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 37 53 30 42 4e 33 61 77 75 6b 53 54 43 52 43 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 37 32 31 31 33 32 61 62 39 35 32 65 65 34 34 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 7S0BN3awukSTCRCT.3Context: d721132ab952ee44
2024-07-03 12:35:40 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:35:40 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 50 5a 51 64 42 32 52 4d 45 79 2f 46 53 36 39 72 37 37 69 68 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fPZQdB2RMEy/FS69r77ihA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	55226	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:35:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6b 34 49 2b 48 2f 5a 2f 44 45 65 44 4b 4b 58 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 35 63 37 39 37 32 37 39 62 34 63 33 62 31 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: k4I+H/Z/DEeDKKXE.1Context: 45c797279b4c3b1f
2024-07-03 12:35:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:35:53 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 6b 34 49 2b 48 2f 5a 2f 44 45 65 44 4b 4b 58 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 35 63 37 39 37 32 37 39 62 34 63 33 62 31 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: k4I+H/Z/DEeDKKXE.2Context: 45c797279b4c3b1f<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:35:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6b 34 49 2b 48 2f 5a 2f 44 45 65 44 4b 4b 58 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 35 63 37 39 37 32 37 39 62 34 63 33 62 31 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: k4I+H/Z/DEeDKKXE.3Context: 45c797279b4c3b1f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 12:35:54 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:35:54 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 58 7a 4c 41 42 37 6f 66 30 4b 6c 76 4d 48 70 52 71 62 6e 6a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: hXzLAB7of0KlvMHpRqbnjw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	55229	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 12:36:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 6d 38 4c 65 5a 7a 6b 4e 45 47 2f 75 5a 46 6a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 32 61 35 66 30 37 65 62 39 33 64 61 33 31 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Pm8LeZzkNEG/uZFj.1Context: f2a5f07eb93da31d
2024-07-03 12:36:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 12:36:08 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 50 6d 38 4c 65 5a 7a 6b 4e 45 47 2f 75 5a 46 6a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 32 61 35 66 30 37 65 62 39 33 64 61 33 31 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 44 6d 46 75 41 66 4a 6a 4a 41 78 51 78 68 39 47 5a 42 31 7a 34 6a 35 39 59 62 59 4b 30 6f 68 45 33 36 74 2f 68 52 54 79 39 62 71 7a 56 65 59 41 55 37 63 56 45 45 38 6e 61 38 48 6b 38 42 66 4e 4d 53 76 30 35 58 4a 76 4b 4d 45 41 49 36 31 30 4e 55 46 71 35 4a 57 72 37 79 33 34 51 33 33 61 67 6f 42 41 6d 75 6d 66 64 69 34 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: Pm8LeZzkNEG/uZFj.2Context: f2a5f07eb93da31d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDDmFuAfJjJAxQxh9GZB1z4j59YbYK0ohE36t/hRTy9bqzVeYAU7cVEE8na8Hk8BfNMSv05XJvKMEAI610NUFq5JWr7y34Q33agoBAmumfdi4
2024-07-03 12:36:08 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 50 6d 38 4c 65 5a 7a 6b 4e 45 47 2f 75 5a 46 6a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 32 61 35 66 30 37 65 62 39 33 64 61 33 31 64 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: Pm8LeZzkNEG/uZFj.3Context: f2a5f07eb93da31d
2024-07-03 12:36:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 12:36:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 49 67 68 49 44 6c 43 77 6b 32 70 58 35 69 56 6a 48 75 49 51 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /IghIDlCwk2pX5iVjHuIQg.0Payload parsing failed.

Target ID:	0
Start time:	08:34:42
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:34:47
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1968,i,4168028207707315712,12834125092476391758,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:34:49
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.cajamar-soporte.com"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Source: global traffic	TCP traffic: 192.168.2.6:55224 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:63098 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.cajamar-soporte.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: www.cajamar-soporte.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.cajamar-soporte.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1268_433936625\sets.json

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 1268, Parent PID: 6084

General

Chronological Activities

Analysis Process: chrome.exePID: 3816, Parent PID: 1268

General

Chronological Activities

Analysis Process: chrome.exePID: 4420, Parent PID: 6084

General

Chronological Activities

Disassembly

Windows Analysis Report
http://www.cajamar-soporte.com