Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
Detection
LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Attempt to bypass Chrome Application-Bound Encryption
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Drops PE files to the document folder of the user
Drops large PE files
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Leaks process information
Loading BitLocker PowerShell Module
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has a writeable .text section
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sleep loop found (likely to delay execution)
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer
Classification
- System is w10x64
- file.exe (PID: 7488 cmdline:
"C:\Users\ user\Deskt op\file.ex e" MD5: AEFBD9E285960B704524B4C33B0C9567) - skotes.exe (PID: 7648 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\abc3bc 1985\skote s.exe" MD5: AEFBD9E285960B704524B4C33B0C9567)
- skotes.exe (PID: 7788 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\abc3bc1 985\skotes .exe MD5: AEFBD9E285960B704524B4C33B0C9567)
- skotes.exe (PID: 1740 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\abc3bc1 985\skotes .exe MD5: AEFBD9E285960B704524B4C33B0C9567) - a2870b1ac5.exe (PID: 7368 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101966 3001\a2870 b1ac5.exe" MD5: 87330F1877C33A5A6203C49075223B16) - 85746525a0.exe (PID: 7572 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101966 4001\85746 525a0.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3) - conhost.exe (PID: 7580 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - 85746525a0.exe (PID: 7908 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101966 4001\85746 525a0.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3) - 81d22383f9.exe (PID: 7712 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101966 7001\81d22 383f9.exe" MD5: 04F57C6FB2B2CD8DCC4B38E4A93D4366) - conhost.exe (PID: 7720 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7648 cmdline:
"powershel l.exe" Add -MpPrefere nce -Exclu sionPath " C:\agfznul wo" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - conhost.exe (PID: 7796 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 5312 cmdline:
"powershel l.exe" Add -MpPrefere nce -Exclu sionPath " C:\Program Data" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - conhost.exe (PID: 3020 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - bb31c9d4a53941b6b913f33980d23feb.exe (PID: 2792 cmdline:
"C:\agfznu lwo\bb31c9 d4a53941b6 b913f33980 d23feb.exe " MD5: CC36E2A5A3C64941A79C31CA320E9797) - chrome.exe (PID: 8004 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --re mote-debug ging-port= 9223 --pro file-direc tory="Defa ult" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7888 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2312 --fi eld-trial- handle=207 2,i,237333 6056486435 438,112373 9713769399 3043,26214 4 /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - fb22de53cd93474896e72899203b572f.exe (PID: 7660 cmdline:
"C:\agfznu lwo\fb22de 53cd934748 96e7289920 3b572f.exe " MD5: 971B0519B1C0461DB6700610E5E9CA8E) - 932bb971c3.exe (PID: 5496 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101966 8001\932bb 971c3.exe" MD5: 0FF2001AEABB55D9AC0BFEB28C577633) - firefox.exe (PID: 7580 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" --k iosk https ://youtube .com/accou nt?=https: //accounts .google.co m/v3/signi n/challeng e/pwd --no -default-b rowser-che ck --disab le-popup-b locking -- attempting -deelevati on MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - firefox.exe (PID: 2816 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" --k iosk https ://youtube .com/accou nt?=https: //accounts .google.co m/v3/signi n/challeng e/pwd --no -default-b rowser-che ck --disab le-popup-b locking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - firefox.exe (PID: 2164 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" -co ntentproc --channel= 2292 -pare ntBuildID 2023092723 2528 -pref sHandle 22 12 -prefMa pHandle 21 96 -prefsL en 25359 - prefMapSiz e 237879 - win32kLock edDown -ap pDir "C:\P rogram Fil es\Mozilla Firefox\b rowser" - {7ce4f639- b801-4da5- 9524-7365b f392772} 2 816 "\\.\p ipe\gecko- crash-serv er-pipe.28 16" 223fe4 69310 sock et MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - chrome.exe (PID: 7580 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --re mote-debug ging-port= 9222 --pro file-direc tory="Defa ult" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - c9692f9101.exe (PID: 7124 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101966 9001\c9692 f9101.exe" MD5: 87448823DAB50A9EDD9F481B99ACA4EE) - ed7d415177.exe (PID: 944 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101967 0001\ed7d4 15177.exe" MD5: 1C76387D2784B116B9F532B8B0A48C8B) - d0e32932f8.exe (PID: 6672 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101967 1001\d0e32 932f8.exe" MD5: 5F8D93018394ECD9F599AA2C10147A5F) - chrome.exe (PID: 7320 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --re mote-debug ging-port= 9229 --pro file-direc tory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 5784 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2284 --fi eld-trial- handle=220 4,i,169214 9291758098 4058,10404 3944607301 79528,2621 44 /prefet ch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - bc893816fa.exe (PID: 3400 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101967 2001\bc893 816fa.exe" MD5: C62F6307B430705A222D91251C64A3FD) - taskkill.exe (PID: 5100 cmdline:
taskkill / F /IM fire fox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 4456 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7204 cmdline:
taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 7200 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 5648 cmdline:
taskkill / F /IM msed ge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 3600 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 5100 cmdline:
taskkill / F /IM oper a.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 7744 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7864 cmdline:
taskkill / F /IM brav e.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 8068 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - firefox.exe (PID: 7268 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" --k iosk "http s://youtub e.com/acco unt?=https ://account s.google.c om/v3/sign in/challen ge/pwd" -- no-default -browser-c heck --dis able-popup -blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - taskkill.exe (PID: 3344 cmdline:
taskkill / F /IM fire fox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 7952 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - 6f3b41816f.exe (PID: 6328 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101967 3001\6f3b4 1816f.exe" MD5: C682C12739CBB53B85334E649CF0B772) - fdd59fd4bc.exe (PID: 1120 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101967 4001\fdd59 fd4bc.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA) - cmd.exe (PID: 5996 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \Temp\main \main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1020 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - mode.com (PID: 5776 cmdline:
mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875) - 74b92d58dc.exe (PID: 692 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101967 5001\74b92 d58dc.exe" MD5: 15709EBA2AFAF7CC0A86CE0ABF8E53F1)
- svchost.exe (PID: 5376 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- ed7d415177.exe (PID: 280 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101967 0001\ed7d4 15177.exe" MD5: 1C76387D2784B116B9F532B8B0A48C8B)
- d0e32932f8.exe (PID: 7728 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101967 1001\d0e32 932f8.exe" MD5: 5F8D93018394ECD9F599AA2C10147A5F)
- bc893816fa.exe (PID: 7972 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101967 2001\bc893 816fa.exe" MD5: C62F6307B430705A222D91251C64A3FD)
- 6f3b41816f.exe (PID: 3716 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\101967 3001\6f3b4 1816f.exe" MD5: C682C12739CBB53B85334E649CF0B772)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Lumma Stealer, LummaC2 Stealer | Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Amadey | Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Stealc | Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Vidar | Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. | No Attribution |
{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
{"C2 url": ["sustainskelet.lat", "grannyejh.lat", "crosshuaht.lat", "rapeflowwj.lat", "necklacebudi.lat", "energyaffai.lat", "pancakedipyps.click", "aspecteirs.lat", "discokeyus.lat"], "Build id": "FATE99--test"}
{"C2 url": "http://www.microsoft.com0", "Botnet": "1402"}
{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_LummaCStealer_3 | Yara detected LummaC Stealer | Joe Security | ||
JoeSecurity_LummaCStealer_2 | Yara detected LummaC Stealer | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Amadey_3 | Yara detected Amadey\'s Clipper DLL | Joe Security | ||
JoeSecurity_Amadey_3 | Yara detected Amadey\'s Clipper DLL | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
Click to see the 36 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_Amadey_2 | Yara detected Amadey\'s stealer DLL | Joe Security | ||
JoeSecurity_Amadey_2 | Yara detected Amadey\'s stealer DLL | Joe Security | ||
JoeSecurity_Amadey_2 | Yara detected Amadey\'s stealer DLL | Joe Security |
System Summary |
---|
Source: | Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Source: | Author: vburov: |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:26.797914+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49794 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:28.848986+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49795 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:31.771117+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49798 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:34.300779+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49799 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:46.381345+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49805 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:52.252326+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49811 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:17:03.292985+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49823 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:17:08.377859+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49830 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:10.580936+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49834 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:17:11.127813+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49836 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:22.719552+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49861 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:24.221958+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49864 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:26.221008+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49867 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:26.381568+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49868 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:35.345292+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49880 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:38.312560+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49879 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:40.863780+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49894 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:48.628640+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49902 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:54.976425+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49911 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:57.375083+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49915 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:17:59.914617+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49922 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:00.679982+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49927 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:02.026185+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49928 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:05.654784+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49942 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:06.241033+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49944 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:08.233108+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49949 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:10.903858+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49953 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:11.107174+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49954 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:11.982641+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49956 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:12.741229+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49957 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:13.599031+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49959 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:16.371503+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49962 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:17.278669+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49964 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:20.332894+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49969 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:26.142310+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49984 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:27.886023+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49987 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:29.418263+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49990 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:30.983410+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49995 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:32.431798+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49999 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:18:34.491864+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50006 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:18:35.113633+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50007 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:39.217141+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50020 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:40.383069+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50034 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:18:42.759047+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50051 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:18:45.427523+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50055 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:18:48.031137+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50059 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:19:02.629579+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50066 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:19:05.798211+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50068 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:19:09.966852+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50079 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:19:12.881418+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50082 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:19:19.434577+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50091 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:19:22.134489+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50094 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:19:24.699901+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 50096 | 172.67.209.202 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:27.556841+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49794 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:29.653320+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49795 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:17:09.450089+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49830 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:11.230085+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49834 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:17:11.891945+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49836 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:25.107335+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49864 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:31.312279+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49868 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:58.042521+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49915 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:00.662253+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49922 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:01.451781+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49927 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:02.789642+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49928 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:11.679610+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49953 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:17.150195+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49962 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:30.194858+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49990 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:33.182776+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49999 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:18:35.520206+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 50006 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:18:40.008437+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 50020 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:19:06.583713+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 50068 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:19:10.727269+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 50079 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:19:13.629243+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 50082 | 172.67.209.202 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:27.556841+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.4 | 49794 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:17:09.450089+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.4 | 49830 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:25.107335+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.4 | 49864 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:58.042521+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.4 | 49915 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:00.662253+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.4 | 49922 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:33.182776+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.4 | 49999 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:19:10.727269+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.4 | 50079 | 172.67.209.202 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:29.653320+0100 | 2049812 | 1 | A Network Trojan was detected | 192.168.2.4 | 49795 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:17:11.891945+0100 | 2049812 | 1 | A Network Trojan was detected | 192.168.2.4 | 49836 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:31.312279+0100 | 2049812 | 1 | A Network Trojan was detected | 192.168.2.4 | 49868 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:01.451781+0100 | 2049812 | 1 | A Network Trojan was detected | 192.168.2.4 | 49927 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:02.789642+0100 | 2049812 | 1 | A Network Trojan was detected | 192.168.2.4 | 49928 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:35.520206+0100 | 2049812 | 1 | A Network Trojan was detected | 192.168.2.4 | 50006 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:19:13.629243+0100 | 2049812 | 1 | A Network Trojan was detected | 192.168.2.4 | 50082 | 172.67.209.202 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:08.377859+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49830 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:11.127813+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49836 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:22.719552+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49861 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:24.221958+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49864 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:26.221008+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49867 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:26.381568+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49868 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:35.345292+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49880 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:38.312560+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49879 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:40.863780+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49894 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:48.628640+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49902 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:54.976425+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49911 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:59.914617+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49922 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:02.026185+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49928 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:05.654784+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49942 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:06.241033+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49944 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:10.903858+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49953 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:11.107174+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49954 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:12.741229+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49957 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:13.599031+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49959 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:16.371503+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49962 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:27.886023+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49987 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:30.983410+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49995 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:35.113633+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 50007 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:39.217141+0100 | 2058361 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 50020 | 104.21.21.99 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:26.797914+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49794 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:28.848986+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49795 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:31.771117+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49798 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:34.300779+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49799 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:46.381345+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49805 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:16:52.252326+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49811 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:17:03.292985+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49823 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:17:10.580936+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 49834 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:19:09.966852+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 50079 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:19:12.881418+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 50082 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:19:19.434577+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 50091 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:19:22.134489+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 50094 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:19:24.699901+0100 | 2058398 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 50096 | 172.67.209.202 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:18:13.137571+0100 | 2019714 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49958 | 185.215.113.16 | 80 | TCP |
2024-12-21T22:18:18.462501+0100 | 2019714 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49965 | 185.215.113.16 | 80 | TCP |
2024-12-21T22:18:41.850101+0100 | 2019714 | 2 | Potentially Bad Traffic | 192.168.2.4 | 50044 | 185.215.113.16 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:18.116305+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49786 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:16:25.061905+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49792 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:16:30.351540+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49796 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:16:42.729419+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49800 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:16:51.393048+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49809 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:17:00.216514+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49820 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:17:10.999882+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49835 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:17:19.354390+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49851 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:17:30.181424+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49872 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:17:43.406299+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49896 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:17:52.392375+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49906 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:17:59.248914+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49918 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:18:06.049863+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49943 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:18:19.436842+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49966 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:18:28.160583+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 49988 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:18:40.480180+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 50033 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:18:46.144838+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 50056 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:18:52.044070+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 50060 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:18:58.521230+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 50064 | 185.215.113.43 | 80 | TCP |
2024-12-21T22:19:07.712276+0100 | 2044696 | 1 | A Network Trojan was detected | 192.168.2.4 | 50070 | 185.215.113.43 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:46.292957+0100 | 2054350 | 1 | A Network Trojan was detected | 192.168.2.4 | 49899 | 185.121.15.192 | 80 | TCP |
2024-12-21T22:17:49.751331+0100 | 2054350 | 1 | A Network Trojan was detected | 192.168.2.4 | 49903 | 185.121.15.192 | 80 | TCP |
2024-12-21T22:18:40.409840+0100 | 2054350 | 1 | A Network Trojan was detected | 192.168.2.4 | 50031 | 185.121.15.192 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:06.792920+0100 | 2058360 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 55298 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:06.302972+0100 | 2058364 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 56476 | 1.1.1.1 | 53 | UDP |
2024-12-21T22:17:22.683856+0100 | 2058364 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 59373 | 1.1.1.1 | 53 | UDP |
2024-12-21T22:17:58.199550+0100 | 2058364 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 60267 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:25.216297+0100 | 2058397 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 51271 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:05.883028+0100 | 2058378 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 50852 | 1.1.1.1 | 53 | UDP |
2024-12-21T22:17:22.517396+0100 | 2058378 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 65076 | 1.1.1.1 | 53 | UDP |
2024-12-21T22:17:58.035506+0100 | 2058378 | 1 | Domain Observed Used for C2 Detected | 192.168.2.4 | 64030 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:24.868426+0100 | 2044245 | 1 | Malware Command and Control Activity Detected | 185.215.113.206 | 80 | 192.168.2.4 | 49863 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:24.720819+0100 | 2044244 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49863 | 185.215.113.206 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:25.196492+0100 | 2044246 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49863 | 185.215.113.206 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:27.085923+0100 | 2044248 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49863 | 185.215.113.206 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:06.306150+0100 | 2044247 | 1 | Malware Command and Control Activity Detected | 94.130.188.57 | 443 | 192.168.2.4 | 49827 | TCP |
2024-12-21T22:17:25.325798+0100 | 2044247 | 1 | Malware Command and Control Activity Detected | 185.215.113.206 | 80 | 192.168.2.4 | 49863 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:09.905486+0100 | 2051831 | 1 | Malware Command and Control Activity Detected | 94.130.188.57 | 443 | 192.168.2.4 | 49831 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:02.641066+0100 | 2049087 | 1 | A Network Trojan was detected | 192.168.2.4 | 49821 | 94.130.188.57 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:44.752503+0100 | 2048094 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49799 | 172.67.209.202 | 443 | TCP |
2024-12-21T22:17:23.701722+0100 | 2048094 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49861 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:17:55.764367+0100 | 2048094 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49911 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:09.316077+0100 | 2048094 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49949 | 104.21.67.146 | 443 | TCP |
2024-12-21T22:18:25.942383+0100 | 2048094 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49959 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:48.802657+0100 | 2048094 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 50059 | 104.21.91.209 | 443 | TCP |
2024-12-21T22:19:23.077294+0100 | 2048094 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 50094 | 172.67.209.202 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:24.227416+0100 | 2044243 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49863 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:18:20.497392+0100 | 2044243 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49967 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:18:30.160080+0100 | 2044243 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49989 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:18:33.030792+0100 | 2044243 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49998 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:18:36.873881+0100 | 2044243 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 50008 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:18:58.404289+0100 | 2044243 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 50062 | 185.215.113.206 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:05.306446+0100 | 2856147 | 1 | A Network Trojan was detected | 192.168.2.4 | 49758 | 185.215.113.43 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:18:05.271328+0100 | 2856148 | 1 | A Network Trojan was detected | 192.168.2.4 | 49923 | 212.193.31.8 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:16.778945+0100 | 2856122 | 1 | A Network Trojan was detected | 185.215.113.43 | 80 | 192.168.2.4 | 49764 | TCP |
2024-12-21T22:18:39.117003+0100 | 2856122 | 1 | A Network Trojan was detected | 185.215.113.43 | 80 | 192.168.2.4 | 50005 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:16:09.986625+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49770 | 31.41.244.11 | 80 | TCP |
2024-12-21T22:16:19.568200+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49791 | 31.41.244.11 | 80 | TCP |
2024-12-21T22:16:26.516539+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49793 | 31.41.244.11 | 80 | TCP |
2024-12-21T22:16:31.803353+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49797 | 31.41.244.11 | 80 | TCP |
2024-12-21T22:16:44.182010+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49804 | 31.41.244.11 | 80 | TCP |
2024-12-21T22:16:52.985500+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49813 | 185.215.113.16 | 80 | TCP |
2024-12-21T22:17:01.804739+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49822 | 185.215.113.16 | 80 | TCP |
2024-12-21T22:17:12.542317+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49839 | 185.215.113.16 | 80 | TCP |
2024-12-21T22:17:20.904835+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49857 | 185.215.113.16 | 80 | TCP |
2024-12-21T22:17:31.755975+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49874 | 31.41.244.11 | 80 | TCP |
2024-12-21T22:17:45.140592+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49898 | 31.41.244.11 | 80 | TCP |
2024-12-21T22:17:53.896569+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49907 | 31.41.244.11 | 80 | TCP |
2024-12-21T22:18:00.718394+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49926 | 31.41.244.11 | 80 | TCP |
2024-12-21T22:18:07.524363+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49948 | 31.41.244.11 | 80 | TCP |
2024-12-21T22:18:21.017248+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49970 | 31.41.244.11 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:27.896588+0100 | 2803304 | 3 | Unknown Traffic | 192.168.2.4 | 49863 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:17:47.565868+0100 | 2803304 | 3 | Unknown Traffic | 192.168.2.4 | 49893 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:17:49.585282+0100 | 2803304 | 3 | Unknown Traffic | 192.168.2.4 | 49893 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:17:51.416340+0100 | 2803304 | 3 | Unknown Traffic | 192.168.2.4 | 49893 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:17:53.102897+0100 | 2803304 | 3 | Unknown Traffic | 192.168.2.4 | 49893 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:17:56.888364+0100 | 2803304 | 3 | Unknown Traffic | 192.168.2.4 | 49893 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:17:58.217073+0100 | 2803304 | 3 | Unknown Traffic | 192.168.2.4 | 49893 | 185.215.113.206 | 80 | TCP |
2024-12-21T22:18:06.763276+0100 | 2803304 | 3 | Unknown Traffic | 192.168.2.4 | 49946 | 185.215.113.16 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:18:05.668911+0100 | 2843864 | 1 | A Network Trojan was detected | 192.168.2.4 | 49942 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:18:35.123295+0100 | 2843864 | 1 | A Network Trojan was detected | 192.168.2.4 | 50007 | 104.21.21.99 | 443 | TCP |
2024-12-21T22:19:03.903392+0100 | 2843864 | 1 | A Network Trojan was detected | 192.168.2.4 | 50066 | 104.21.91.209 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-21T22:17:00.161237+0100 | 2859378 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49818 | 94.130.188.57 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: |
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: |
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: |
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: |
Source: | Binary or memory string: | memstr_b63f1026-0 |
Source: | Static PE information: |
Source: | File opened: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Directory queried: | ||
Source: | Directory queried: | ||
Source: | Directory queried: |
Source: | Code function: | 9_2_002E36A9 | |
Source: | Code function: | 9_2_002E375A |
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: |
Source: | Memory has grown: |
Networking |
---|
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | IPs: |
Source: | HTTP traffic detected: |