Edit tour
Windows
Analysis Report
mitel.docx
Overview
General Information
| Sample name: | mitel.docx |
| Analysis ID: | 1591422 |
| MD5: | 23beeecf983235201c815dd316cc03bc |
| SHA1: | 65f9f73aa09823f590a0e1d17db8133b8f45e01e |
| SHA256: | daa1e43c59c142ddea9b13c28d853b72c53f6d3ef198c3212e52a3812df3e88a |
| Infos: | |
 | |
Detection
| Score: | 56 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
AI detected landing page (webpage, office document or email)
AI detected suspicious Javascript
Found suspicious QR code URL
Performs DNS queries to domains with low reputation
Creates files inside the system directory
Deletes files inside the Windows folder
Detected non-DNS traffic on DNS port
Drops PE files
Drops PE files to the windows directory (C:\Windows)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
PE file contains more sections than normal
PE file contains sections with non-standard names
Uses insecure TLS / SSL version for HTTPS connection
Classification
- System is w10x64
WINWORD.EXE (PID: 1052 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\WINWO RD.EXE" /A utomation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)
chrome.exe (PID: 1924 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// app.superc ast.com/ah oy/message s/IyOwn1xl 2n6XdxToR2 XV5dCRxhEv flsH/click ?signature =96e743b76 7141485023 15415a0473 9f234047e4 3&url=http s://rubyte ch.xyz/0se cure/index .html#ludm ila.glinbe rg+mitel.c om MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 5132 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2172 --fi eld-trial- handle=200 4,i,973116 3135795558 546,148587 5665243604 1549,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
Phishing |   |
|---|
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | URL: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Binary string: | ||
Networking | |
|---|
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File deleted: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Word Document stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Initial sample: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 2 Browser Extensions | 1 Process Injection | 21 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Process Injection | LSASS Memory | 1 File and Directory Discovery | Remote Desktop Protocol | Data from Removable Media | 2 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 File Deletion | Security Account Manager | 1 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | Binary Padding | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 1 Ingress Tool Transfer | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| www.google.com | 172.217.18.100 | true | false | high | |
| app.supercast.com | 54.71.143.107 | true | true | unknown | |
| icogacc.com | 162.241.253.231 | true | false | high | |
| rubytech.xyz | 139.99.9.144 | true | true | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 54.71.143.107 | app.supercast.com | United States | 16509 | AMAZON-02US | true | |
| 162.241.253.231 | icogacc.com | United States | 46606 | UNIFIEDLAYER-AS-1US | false | |
| 139.99.9.144 | rubytech.xyz | Canada | 16276 | OVHFR | true | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 172.217.18.100 | www.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.4 |
| 192.168.2.6 |
| 192.168.2.5 |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1591422 |
| Start date and time: | 2025-01-15 00:28:57 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 15s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 14 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | mitel.docx |
| Detection: | MAL |
| Classification: | mal56.phis.troj.winDOCX@23/26@10/8 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
- Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 2.23.242.162, 216.58.212.174, 108.177.15.84, 142.250.185.163, 2.17.190.73, 142.250.185.238, 84.201.210.39, 52.111.243.40, 52.111.243.41, 52.111.243.42, 52.111.243.43, 20.44.10.123, 2.20.245.225, 2.20.245.216, 52.109.28.47, 142.250.181.238, 142.250.184.206, 142.250.186.46, 199.232.214.172, 142.250.186.110, 142.250.186.174, 216.58.212.131, 216.58.206.78, 142.250.185.206, 34.104.35.123, 199.232.210.172, 216.58.206.46, 142.250.185.110, 142.250.186.78, 172.217.18.14, 13.107.246.45, 40.126.32.74, 4.245.163.56
- Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, onedscolprdcus05.centralus.cloudapp.azure.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, e16604.g.akamaiedge.net, update.googleapis.com, officeclient.microsoft.com, templatesmetadata.office.net, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, clients1.google.com, ecs.office.com, self-events-data.trafficmanager.net, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, fe3
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
⊘No simulations
| Source | URL |
|---|---|
| Screenshot | https://app.supercast.com/ahoy/messages/IyOwn1xl2n6XdxToR2XV5dCRxhEvflsH/click?signature=96e743b76714148502315415a04739f234047e43&url=https://rubytech.xyz/0secure/index.html#ludmila.glinberg+mitel.com |
| Screenshot | https://app.supercast.com/ahoy/messages/IyOwn1xl2n6XdxToR2XV5dCRxhEvflsH/click?signature=96e743b76714148502315415a04739f234047e43&url=https://rubytech.xyz/0secure/index.html#ludmila.glinberg+mitel.com |
| Screenshot | https://app.supercast.com/ahoy/messages/IyOwn1xl2n6XdxToR2XV5dCRxhEvflsH/click?signature=96e743b76714148502315415a04739f234047e43&url=https://rubytech.xyz/0secure/index.html#ludmila.glinberg+mitel.com |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 139.99.9.144 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| 162.241.253.231 | Get hash | malicious | FormBook | Browse |
| |
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| app.supercast.com | Get hash | malicious | HTMLPhisher | Browse |
| |
| icogacc.com | Get hash | malicious | Captcha Phish | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| UNIFIEDLAYER-AS-1US | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | EvilProxy, HTMLPhisher | Browse |
| ||
| OVHFR | Get hash | malicious | Wannacry | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| AMAZON-02US | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Phisher | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 1138de370e523e824bbca92d049a3777 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | Wannacry | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_689616758\Google.Widevine.CDM.dll | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | CAPTCHA Scam ClickFix | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 162 |
| Entropy (8bit): | 4.703065709201963 |
| Encrypted: | false |
| SSDEEP: | 3:C1ClXLlAnOqh37yEfY1A86LH04plhnCllO0PL6l54:blsCv4pmllO0PL6/4 |
| MD5: | C6D210058E887CBC6380A45746D3E8E5 |
| SHA1: | C362155AF5639FBC0786B5BFD3579E8C2548C626 |
| SHA-256: | A5A8301679687412B3AB6DC9D71543CC9D85219F45301D6C731DC735649460C4 |
| SHA-512: | DE8AB664D61123CC2FA00D6982A6EDC45CCE9D3A173063FF9A734D81CFF25148A65985C8ADEA0B19BE23618B61605196EB70BDE66405B4A461947247E6893857 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_1938143637\_metadata\verified_contents.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1796 |
| Entropy (8bit): | 6.024410992426995 |
| Encrypted: | false |
| SSDEEP: | 48:p/hQ/oCI1PBpFNJ7aksQCZYrudz2kfWh61su:RsoXJj7abQAYal26l |
| MD5: | A4108729F97CAD545F4F3FB3C1AB93BF |
| SHA1: | 20FE72A323C0814E2AA28588CA72328F27A131FA |
| SHA-256: | 8E5C6E5E3E6827B2A7DDE1AF10F6D1F462510871B2F117FE45B8B538F35EBFE3 |
| SHA-512: | 33B8F0579E9C7121680D55C6E3B3F565B3EEA7848E0170AD85EF0F0028056D910EACFDF5D3F2B0D726080721AE1F41D92927E801C429C34BB951945010B76592 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_1938143637\cr_en-us_500000_index.bin
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 7970376 |
| Entropy (8bit): | 6.569212095978612 |
| Encrypted: | false |
| SSDEEP: | 98304:JxDhk2d9eilxQv768o9vLFjtbYs4jgRQUQy1geny8Js0PhVpExogkA:JIuCT7avFVv+gRKy1geyjahTEXX |
| MD5: | BA5E75A43D7C8CF61D0DE91B49936D59 |
| SHA1: | F609A0B9ECA0F293E37411F21C406BEAB7C0CA7C |
| SHA-256: | 4FB497EB9A9A5E235030D31F1A498CA26F860F2D8BAB2F5FE7867F8606B04C1A |
| SHA-512: | 74DE735B465B321BDBD55C9B3C41B457B17309C23C8A496006A748F7776D8FA0DA49F5FC6995C5874BCA6BB17E9C21BD4BD7CA644B13891B0E118C2681EB0647 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_1938143637\manifest.fingerprint
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 66 |
| Entropy (8bit): | 3.9218592346691836 |
| Encrypted: | false |
| SSDEEP: | 3:STAU0B1TG3YANUlELT1NgXd+w:SsW32dd |
| MD5: | 103F73401FA43D1A3C9F571AEC5F0D3A |
| SHA1: | 6D7572821D10E8C7B77E9DE54EF9AA428B7A0F17 |
| SHA-256: | 996F35917E17E20D9344529A57309E1BF0164C34DBFFAD589DEF018B83295495 |
| SHA-512: | FFCA4B640A1D1AEF204E8D744DEF3ACAC70DF68AAA480AC0883B33DE3AFA8EBF3B468B6682BE5DAF0E02444A82776C8DB78621238701CF10943B576CB23D8231 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_1938143637\manifest.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 108 |
| Entropy (8bit): | 4.891623155707742 |
| Encrypted: | false |
| SSDEEP: | 3:rR6TAulhFphifF0AAGAR3CKG/w/VpKS12SJUanhvY:F6VlMT2C7Y/VUS12AlG |
| MD5: | 3A00CE5FF5536DD017402764B26B055D |
| SHA1: | 6057D8EF6D319EA66A8B1424AA7F8C6180FEDBF1 |
| SHA-256: | EA7E6EB9B014F8982A04F10CB2E913A71A13E0DE200470FA9B3C781A53C8D7F4 |
| SHA-512: | AA12548A5992B725720C59CCBDAED4BE8414CC1472C3D00A5532C309564F1D10876A745D041EC8EC8AD6404A66B3029564DB2D20E3C975E59B2AE9A2ADEC7BC4 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_487111238\LICENSE
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1558 |
| Entropy (8bit): | 5.11458514637545 |
| Encrypted: | false |
| SSDEEP: | 48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH |
| MD5: | EE002CB9E51BB8DFA89640A406A1090A |
| SHA1: | 49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2 |
| SHA-256: | 3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B |
| SHA-512: | D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_487111238\_metadata\verified_contents.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1864 |
| Entropy (8bit): | 6.018989605004616 |
| Encrypted: | false |
| SSDEEP: | 48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D |
| MD5: | C4709C1D483C9233A3A66A7E157624EA |
| SHA1: | 99A000EB5FE5CC1E94E3155EE075CD6E43DC7582 |
| SHA-256: | 225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9 |
| SHA-512: | B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_487111238\manifest.fingerprint
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 66 |
| Entropy (8bit): | 3.820000180714897 |
| Encrypted: | false |
| SSDEEP: | 3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp |
| MD5: | BBEC7670A2519FEB0627F17D0C0B5276 |
| SHA1: | 9C30B996F1B069F86EF7C0136DFAF7E614674DEA |
| SHA-256: | 670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC |
| SHA-512: | 1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_487111238\manifest.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 85 |
| Entropy (8bit): | 4.462192586591686 |
| Encrypted: | false |
| SSDEEP: | 3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg |
| MD5: | 084E339C0C9FE898102815EAC9A7CDEA |
| SHA1: | 6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644 |
| SHA-256: | 52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15 |
| SHA-512: | 0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_487111238\sets.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 9817 |
| Entropy (8bit): | 4.629347296880043 |
| Encrypted: | false |
| SSDEEP: | 96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl |
| MD5: | 8C702C686B703020BC0290BAFC90D7A0 |
| SHA1: | EB08FF7885B4C1DE3EF3D61E40697C0C71903E27 |
| SHA-256: | 97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62 |
| SHA-512: | 6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_594061853\LICENSE
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1558 |
| Entropy (8bit): | 5.11458514637545 |
| Encrypted: | false |
| SSDEEP: | 48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH |
| MD5: | EE002CB9E51BB8DFA89640A406A1090A |
| SHA1: | 49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2 |
| SHA-256: | 3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B |
| SHA-512: | D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_594061853\_metadata\verified_contents.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1865 |
| Entropy (8bit): | 6.0109403942089115 |
| Encrypted: | false |
| SSDEEP: | 48:p/hU+PQDAdtzakOyigpPPQO6D+REkMYcxxIokcF:RFPEQtzap/cwO6N8cnF |
| MD5: | ACEE7C14C716B46EFD59EC6545E8F426 |
| SHA1: | 431E29F8DD798D0B923B4A55782B50A6CECDA392 |
| SHA-256: | A482A3897B1A410A02632B1A3058FD1EDAFC035691580862DA5066DCDEB85767 |
| SHA-512: | 384CDB4C2515D68671DD37204E92D43467FEEF54634FA2F072DF76E23594C94B770D2B68C25B9C84DAB2049DBBD5737BB6BC78F2E1C1019564E26A0DD286D9A1 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_594061853\keys.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6361 |
| Entropy (8bit): | 5.9791886723901255 |
| Encrypted: | false |
| SSDEEP: | 96:UXq6pG2GE+m0plhYvPuW+wkpTm+ozdswsDm4+uTagSfC3AQj+y:uNtGbm4lOvMwkoR9PuGs3gy |
| MD5: | B4434830C4BD318DBA6BD8CC29C9F023 |
| SHA1: | A0F238822610C70CDF22FE08C8C4BC185CBEC61E |
| SHA-256: | 272E290D97184D1AC0F4E4799893CB503FBA8ED6C8C503767E70458CBDA32070 |
| SHA-512: | F2549945965757488ECD07E46249E426525C8FE771F9939F009819183AB909D1E79CBB3AECA4F937E799556B83E891BBB0858B60F31EC7E8D2D8FBB4CB00B335 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_594061853\manifest.fingerprint
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 66 |
| Entropy (8bit): | 3.9691231055595435 |
| Encrypted: | false |
| SSDEEP: | 3:SC3TnfRWahk1C5SoCL3:SGTnfR7wXog |
| MD5: | 00BB0BF4C9FE9AA9CDDAE91770EDCD28 |
| SHA1: | F350A88149D03E4D0BA1B60A9EEAB9F3EABA259E |
| SHA-256: | 434025617B33B3E7CBBE3FB173CF35668B61EB5D3386E07B929F820980B2C183 |
| SHA-512: | 4D67D60F745A66AE1607BF4D2BA5D9957E41D30E351FD501B4F95CFDFF0C9934873DE77B22AEEBEF9F8EB8EC7CD373D5E6CEA6C41542D7A94FD6AB8380A7EA47 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_594061853\manifest.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 80 |
| Entropy (8bit): | 4.418776852063957 |
| Encrypted: | false |
| SSDEEP: | 3:rR6TAulhFphifFIPgS1kXng:F6VlMyPgS1kXg |
| MD5: | 9E72659142381870C3C7DFE447D0E58E |
| SHA1: | BA27ED169D5AF065DABDE081179476BEB7E11DE2 |
| SHA-256: | 72BAB493C5583527591DD6599B3C902BADE214399309B0D610907E33275B8DC2 |
| SHA-512: | B887EB30C09FA3C87945B83D8DBDDCEEE286011A1582C10B5B3CC7A4731B7FA7CB3689CB61BFEAD385C95902CAB397D0AA26BC26086D17CE414A4F40F0E16A01 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_689616758\Google.Widevine.CDM.dll 
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2877728 |
| Entropy (8bit): | 6.868480682648069 |
| Encrypted: | false |
| SSDEEP: | 49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5 |
| MD5: | 477C17B6448695110B4D227664AA3C48 |
| SHA1: | 949FF1136E0971A0176F6ADEA8ADCC0DD6030F22 |
| SHA-256: | CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E |
| SHA-512: | 1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_689616758\_metadata\verified_contents.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1778 |
| Entropy (8bit): | 6.02086725086136 |
| Encrypted: | false |
| SSDEEP: | 48:p/hCdQAdJjRkakCi0LXjX9mqjW6JmfQkNWQzXXf2gTs:RtQ1aaxXrjW6JuQEWQKas |
| MD5: | 3E839BA4DA1FFCE29A543C5756A19BDF |
| SHA1: | D8D84AC06C3BA27CCEF221C6F188042B741D2B91 |
| SHA-256: | 43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729 |
| SHA-512: | 19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_689616758\manifest.fingerprint
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 66 |
| Entropy (8bit): | 3.974403644129192 |
| Encrypted: | false |
| SSDEEP: | 3:SLVV8T+WSq2ykFDJp9qBn:SLVqZS5p0B |
| MD5: | D30A5BBC00F7334EEDE0795D147B2E80 |
| SHA1: | 78F3A6995856854CAD0C524884F74E182F9C3C57 |
| SHA-256: | A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642 |
| SHA-512: | DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_689616758\manifest.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 145 |
| Entropy (8bit): | 4.595307058143632 |
| Encrypted: | false |
| SSDEEP: | 3:rR6TAulhFphifFooG+HhFFKS18CWjhXLXGPQ3TRpvF/FHddTcplFHddTcVYA:F6VlM5PpKS18hRIA |
| MD5: | BBC03E9C7C5944E62EFC9C660B7BD2B6 |
| SHA1: | 83F161E3F49B64553709994B048D9F597CDE3DC6 |
| SHA-256: | 6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28 |
| SHA-512: | FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_872989902\Filtering Rules
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 75076 |
| Entropy (8bit): | 5.536878116224829 |
| Encrypted: | false |
| SSDEEP: | 1536:BFJkJ9UJ9Gor+SRTpV7rSEc2xgmmD6I7knvvTsnlPUBkVxC7M0x5vPrwz:7uiJcoi0TptOEcSg1D6IovvTsnlPFVxf |
| MD5: | EABBA602AD039867B52E30E3E59EDC38 |
| SHA1: | FAC94381CB8BD64D6EE5247060A3A3103FCD6D56 |
| SHA-256: | 68EF948A4727C058ED027C201EED5F749A508AE2732518188043AF70E6E41E75 |
| SHA-512: | 6C3FB4155FB43A544A4847794511A903A2E2B0DEE2FAC6C6378C735D8194FF0D7B095DC28EFF96F01E42B97E3BAC6C68B88FE25D6520DFAB131ACFDCF88ADFAC |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_872989902\LICENSE.txt
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 24623 |
| Entropy (8bit): | 4.588307081140814 |
| Encrypted: | false |
| SSDEEP: | 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD |
| MD5: | D33AAA5246E1CE0A94FA15BA0C407AE2 |
| SHA1: | 11D197ACB61361657D638154A9416DC3249EC9FB |
| SHA-256: | 1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311 |
| SHA-512: | 98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_872989902\_metadata\verified_contents.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1529 |
| Entropy (8bit): | 5.970215376335647 |
| Encrypted: | false |
| SSDEEP: | 24:pZRj/flTHY+tCJVkYbKaR8uemFjeT3tzkaoX6pdKijihWUoXOgYhTYhXsvtYu0/T:p/h4oCHbKaiuqTtkak6SHkKh8Cix/NN |
| MD5: | 4056E612209F7E171E97A4BAAD33E9D9 |
| SHA1: | 65552882A5046F8C4590114164527BB4E06A88C8 |
| SHA-256: | 3790644377239FA0ED31695DD6CA298E691D8A722079A120E3B95888CD02A59A |
| SHA-512: | 9F319BF1F3FA801380BDA50C978068B9836C92FA3116DC0C161342819122C7C9B37F9D93286E6A47339728FD921287DD4CBBF49F42D25DBDFFD5492C8F704D92 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_872989902\manifest.fingerprint
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 66 |
| Entropy (8bit): | 3.9784136821063196 |
| Encrypted: | false |
| SSDEEP: | 3:SMOGHtdUbb5UNGHMfn4yxqt:SM/HtdUPSGHsnFxqt |
| MD5: | 20C72149A48962D86FFEAACF14CF63FC |
| SHA1: | EF8244AE418794FFCB01D09C9B577C942C9A8218 |
| SHA-256: | 9ABD021173116878060E97B8C1B034AA9535215F54CEEE82B4DF09F5B5A44E48 |
| SHA-512: | F0B185B688913DF3F38308EB30207902CCB93C116EADB2668B3414ADD6944587C365CBA98F68C7BD1E15CA328934F61972785D61804BD3EF3287C7893BDBAD16 |
| Malicious: | false |
| Preview: |
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1924_872989902\manifest.json
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 114 |
| Entropy (8bit): | 4.56489413033116 |
| Encrypted: | false |
| SSDEEP: | 3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS1B:F6VlMZWuMt5SKPS1B |
| MD5: | C5CADAB1F82F9B71621C1E776CAB86CF |
| SHA1: | C98F0A50560D2D6C60105426A0435F95023A7237 |
| SHA-256: | A311AA850BE76B377F9CF8C39AD706E597B0E52EBF27F5A05DAB425271F6652F |
| SHA-512: | 04DFBEA8D35FF5FB2B9926AE095A5243FCAFB8BD2AC269BF09CAE2DAFF03D67E777F157649A25ECD388566C54219AA85EB4F6DB213C8B1FA001526C5397CCE80 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2130 |
| Entropy (8bit): | 4.721708037848999 |
| Encrypted: | false |
| SSDEEP: | 48:WM8O9FuJhiPKty1pmXFwp+lzldOyItWOkxKCl62ch:WZOQFd1w6d+YOkZa |
| MD5: | 95CBC362A6E88BF7E96E39A288C4B441 |
| SHA1: | 8D973874AAAFA66A533CA09BE4C43A14886A5A10 |
| SHA-256: | C7CDA62010E65451EF16E1AB49CF7E5DCAB670BCD70C123D153084F6F292A3D9 |
| SHA-512: | 40459C5BAD2E528EB02AB51736B3D2C57F778923835E669774F4E293AEE5A0EDEED2DF24AC54B468C5D0172BA09423EEC540E45951E6738358279EF45E2A01FD |
| Malicious: | false |
| URL: | https://rubytech.xyz/0secure/index.html |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.652182832359709 |
| TrID: |
|
| File name: | mitel.docx |
| File size: | 27'805 bytes |
| MD5: | 23beeecf983235201c815dd316cc03bc |
| SHA1: | 65f9f73aa09823f590a0e1d17db8133b8f45e01e |
| SHA256: | daa1e43c59c142ddea9b13c28d853b72c53f6d3ef198c3212e52a3812df3e88a |
| SHA512: | 13b2f06a9be772ae91073a254a77043f2a5e3414539c027c4d84ba216cb983ee4409475d48edadc0d21e24c336104cffb4004690367fb59d2e90b1a841b8c344 |
| SSDEEP: | 768:32ljAZZKN2OVJhfqKbycuF6ukKizo38DcPB:6PN2AhCr8guo38IZ |
| TLSH: | 59C2C02FCAA3AA34E63E407B475416F9FD154142FB30A949BD80B848295F9463BB0F4A |
| File Content Preview: | PK..........!.....e...R.......[Content_Types].xml ...(......................................................................................................................................................................................................... |
 | |
| Icon Hash: | 35e5c48caa8a8599 |
| Document Type: | OpenXML |
| Number of OLE Files: | 1 |
| Has Summary Info: | |
| Application Name: | |
| Encrypted Document: | False |
| Contains Word Document Stream: | True |
| Contains Workbook/Book Stream: | False |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | False |
| Flash Objects Count: | 0 |
| Contains VBA Macros: | False |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 15, 2025 00:29:52.481659889 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:52.481760979 CET | 443 | 49714 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:29:52.481851101 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:52.482464075 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:52.482496023 CET | 443 | 49714 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:29:53.287029028 CET | 443 | 49714 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:29:53.287115097 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:53.291462898 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:53.291486025 CET | 443 | 49714 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:29:53.291749001 CET | 443 | 49714 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:29:53.293689966 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:53.293765068 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:53.293771029 CET | 443 | 49714 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:29:53.293971062 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:53.335339069 CET | 443 | 49714 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:29:53.485641003 CET | 443 | 49714 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:29:53.486591101 CET | 443 | 49714 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:29:53.486648083 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:53.486891985 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:53.486892939 CET | 49714 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:29:53.486916065 CET | 443 | 49714 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:29:54.490503073 CET | 49673 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:29:54.490503073 CET | 49674 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:29:54.818622112 CET | 49672 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:29:56.478396893 CET | 443 | 49705 | 173.222.162.64 | 192.168.2.6 |
| Jan 15, 2025 00:29:56.482364893 CET | 49705 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:30:00.336668968 CET | 49740 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:00.336723089 CET | 443 | 49740 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:00.336858988 CET | 49740 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:00.337903976 CET | 49740 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:00.337917089 CET | 443 | 49740 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.150829077 CET | 443 | 49740 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.150918961 CET | 49740 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:01.153559923 CET | 49740 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:01.153584003 CET | 443 | 49740 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.154354095 CET | 443 | 49740 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.176822901 CET | 49740 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:01.176863909 CET | 49740 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:01.176878929 CET | 443 | 49740 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.176989079 CET | 49740 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:01.219377995 CET | 443 | 49740 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.357011080 CET | 443 | 49740 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.357095003 CET | 443 | 49740 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.357160091 CET | 49740 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:01.359239101 CET | 49740 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:01.359268904 CET | 443 | 49740 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.538400888 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:01.538458109 CET | 443 | 49747 | 54.71.143.107 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.538525105 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:01.543948889 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:01.543984890 CET | 443 | 49747 | 54.71.143.107 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.448786020 CET | 443 | 49747 | 54.71.143.107 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.449078083 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:02.449117899 CET | 443 | 49747 | 54.71.143.107 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.450484037 CET | 443 | 49747 | 54.71.143.107 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.450550079 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:02.451831102 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:02.451904058 CET | 443 | 49747 | 54.71.143.107 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.452339888 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:02.452351093 CET | 443 | 49747 | 54.71.143.107 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.504996061 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:02.669292927 CET | 443 | 49747 | 54.71.143.107 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.669374943 CET | 443 | 49747 | 54.71.143.107 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.669492960 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:02.671613932 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:02.671659946 CET | 443 | 49747 | 54.71.143.107 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.671688080 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:02.671796083 CET | 49747 | 443 | 192.168.2.6 | 54.71.143.107 |
| Jan 15, 2025 00:30:02.689747095 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:02.689785004 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.689950943 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:02.690080881 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:02.690088034 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:03.726095915 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:03.726718903 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:03.726747036 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:03.727751970 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:03.727824926 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:03.729479074 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:03.729542971 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:03.729705095 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:03.771341085 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:03.774049044 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:03.774065018 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:03.820244074 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:04.296479940 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:04.296641111 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:04.296691895 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:04.296708107 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:04.296751976 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:04.297586918 CET | 49762 | 443 | 192.168.2.6 | 139.99.9.144 |
| Jan 15, 2025 00:30:04.297612906 CET | 443 | 49762 | 139.99.9.144 | 192.168.2.6 |
| Jan 15, 2025 00:30:04.741044998 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:04.741090059 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:04.741174936 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:04.741885900 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:04.741914988 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:04.744029045 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:04.744081974 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:04.744151115 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:04.744309902 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:04.744322062 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.310931921 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.312131882 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.312156916 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.313641071 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.313700914 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.315208912 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.315438032 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.315443039 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.315494061 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.348797083 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.354075909 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.354116917 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.355176926 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.355252981 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.355782986 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.355859995 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.364917040 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.364943981 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.406431913 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.406497955 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.406546116 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.450223923 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.667625904 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.693675041 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.709681988 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:05.709692001 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.735349894 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:05.755513906 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:06.087541103 CET | 49790 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:30:06.087587118 CET | 443 | 49790 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.087666988 CET | 49790 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:30:06.088121891 CET | 49790 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:30:06.088138103 CET | 443 | 49790 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.474152088 CET | 49705 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:30:06.474152088 CET | 49705 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:30:06.475258112 CET | 49792 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:30:06.475291014 CET | 443 | 49792 | 173.222.162.64 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.475364923 CET | 49792 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:30:06.480844975 CET | 443 | 49705 | 173.222.162.64 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.480856895 CET | 443 | 49705 | 173.222.162.64 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.481525898 CET | 49792 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:30:06.481542110 CET | 443 | 49792 | 173.222.162.64 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.751897097 CET | 443 | 49790 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.752264977 CET | 49790 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:30:06.752295971 CET | 443 | 49790 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.753952026 CET | 443 | 49790 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.754021883 CET | 49790 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:30:06.755342007 CET | 49790 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:30:06.755429029 CET | 443 | 49790 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.804951906 CET | 49790 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:30:06.804991007 CET | 443 | 49790 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.852134943 CET | 49790 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:30:07.088150978 CET | 443 | 49792 | 173.222.162.64 | 192.168.2.6 |
| Jan 15, 2025 00:30:07.088295937 CET | 49792 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:30:08.663538933 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:08.709983110 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:08.710009098 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:08.751054049 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:08.764961004 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:08.764974117 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:09.593467951 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:09.593502998 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:09.593579054 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:09.593594074 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:09.593621016 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:09.593648911 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:09.593974113 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:09.594032049 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:09.685492992 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:09.685525894 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:09.685678959 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:09.739310026 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:09.851919889 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:09.851958036 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:09.852032900 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:09.852291107 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:09.852336884 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:10.429733992 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:10.473819017 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:10.495520115 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:10.495548964 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:10.496727943 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:10.496817112 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:10.514904976 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:10.514988899 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:10.515080929 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:10.555326939 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:10.567363024 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:10.567426920 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:10.605848074 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:10.605927944 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:10.605999947 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:10.619245052 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.411753893 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.411782980 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.411792994 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.411845922 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.411925077 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.411925077 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.411925077 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.411957979 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.458004951 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.466154099 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.466166019 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.466214895 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.466223001 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.466245890 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.466286898 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.466317892 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.466463089 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.499722004 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.499730110 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.499907970 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.499974012 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.500405073 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.500464916 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.500483036 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.504729033 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.504751921 CET | 443 | 49775 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:11.504761934 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.504813910 CET | 49775 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:11.551816940 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:12.670955896 CET | 49829 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:12.671046972 CET | 443 | 49829 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:12.671138048 CET | 49829 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:12.672730923 CET | 49829 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:12.672766924 CET | 443 | 49829 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:13.457511902 CET | 443 | 49829 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:13.457596064 CET | 49829 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:13.460182905 CET | 49829 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:13.460212946 CET | 443 | 49829 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:13.460567951 CET | 443 | 49829 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:13.462728024 CET | 49829 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:13.462806940 CET | 49829 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:13.462819099 CET | 443 | 49829 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:13.462997913 CET | 49829 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:13.503330946 CET | 443 | 49829 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:13.638227940 CET | 443 | 49829 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:13.638370991 CET | 443 | 49829 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:13.638820887 CET | 49829 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:13.638881922 CET | 443 | 49829 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:13.638930082 CET | 49829 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:14.593523026 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:14.593691111 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:14.593921900 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:15.932538033 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:15.932555914 CET | 443 | 49776 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:15.932568073 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:15.932605028 CET | 49776 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:16.413619041 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:16.413691044 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:16.413794041 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:16.641362906 CET | 443 | 49790 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:30:16.641525030 CET | 443 | 49790 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:30:16.641597033 CET | 49790 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:30:17.912616968 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:17.912616968 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:17.912682056 CET | 443 | 49811 | 162.241.253.231 | 192.168.2.6 |
| Jan 15, 2025 00:30:17.912791967 CET | 49790 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:30:17.912811041 CET | 49811 | 443 | 192.168.2.6 | 162.241.253.231 |
| Jan 15, 2025 00:30:17.912874937 CET | 443 | 49790 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:30:26.357009888 CET | 443 | 49792 | 173.222.162.64 | 192.168.2.6 |
| Jan 15, 2025 00:30:26.357373953 CET | 49792 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jan 15, 2025 00:30:31.310303926 CET | 49944 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:31.310347080 CET | 443 | 49944 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:31.310461998 CET | 49944 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:31.311239004 CET | 49944 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:31.311256886 CET | 443 | 49944 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:32.133572102 CET | 443 | 49944 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:32.133661985 CET | 49944 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:32.137917042 CET | 49944 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:32.137934923 CET | 443 | 49944 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:32.138281107 CET | 443 | 49944 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:32.146220922 CET | 49944 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:32.146318913 CET | 49944 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:32.146328926 CET | 443 | 49944 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:32.146457911 CET | 49944 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:32.191337109 CET | 443 | 49944 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:32.329706907 CET | 443 | 49944 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:32.329840899 CET | 443 | 49944 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:32.329905987 CET | 49944 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:32.362571001 CET | 49944 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:32.362603903 CET | 443 | 49944 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:35.976495028 CET | 80 | 49704 | 217.20.57.20 | 192.168.2.6 |
| Jan 15, 2025 00:30:35.977185965 CET | 49704 | 80 | 192.168.2.6 | 217.20.57.20 |
| Jan 15, 2025 00:30:35.977271080 CET | 49704 | 80 | 192.168.2.6 | 217.20.57.20 |
| Jan 15, 2025 00:30:35.982150078 CET | 80 | 49704 | 217.20.57.20 | 192.168.2.6 |
| Jan 15, 2025 00:30:55.591859102 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:55.591902018 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:55.592001915 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:55.592683077 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:55.592709064 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:56.541158915 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:56.541415930 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:56.543972015 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:56.544004917 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:56.544245958 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:56.546123981 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:56.546215057 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:56.546232939 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:56.546324968 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:56.587352037 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:56.723068953 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:56.723215103 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:56.723798990 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:56.723839998 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:30:56.723968983 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:56.723968983 CET | 50007 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jan 15, 2025 00:30:56.723988056 CET | 443 | 50007 | 40.115.3.253 | 192.168.2.6 |
| Jan 15, 2025 00:31:04.497018099 CET | 56009 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:31:04.503385067 CET | 53 | 56009 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:31:04.503468037 CET | 56009 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:31:04.509962082 CET | 53 | 56009 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:31:04.970287085 CET | 56009 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:31:04.977046967 CET | 53 | 56009 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:31:04.977130890 CET | 56009 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:31:06.130820990 CET | 56011 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:31:06.130909920 CET | 443 | 56011 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:31:06.131001949 CET | 56011 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:31:06.131441116 CET | 56011 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:31:06.131475925 CET | 443 | 56011 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:31:06.773355961 CET | 443 | 56011 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:31:06.773772001 CET | 56011 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:31:06.773807049 CET | 443 | 56011 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:31:06.774300098 CET | 443 | 56011 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:31:06.774878979 CET | 56011 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:31:06.774974108 CET | 443 | 56011 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:31:06.816617966 CET | 56011 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:31:16.708060026 CET | 443 | 56011 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:31:16.708151102 CET | 443 | 56011 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:31:16.708209991 CET | 56011 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:31:17.912628889 CET | 56011 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:31:17.912708998 CET | 443 | 56011 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:31:24.645040035 CET | 49703 | 443 | 192.168.2.6 | 40.126.32.76 |
| Jan 15, 2025 00:31:24.652069092 CET | 443 | 49703 | 40.126.32.76 | 192.168.2.6 |
| Jan 15, 2025 00:31:24.652120113 CET | 49703 | 443 | 192.168.2.6 | 40.126.32.76 |
| Jan 15, 2025 00:31:28.176491976 CET | 49707 | 443 | 192.168.2.6 | 40.126.32.76 |
| Jan 15, 2025 00:31:28.183007956 CET | 443 | 49707 | 40.126.32.76 | 192.168.2.6 |
| Jan 15, 2025 00:31:28.183090925 CET | 49707 | 443 | 192.168.2.6 | 40.126.32.76 |
| Jan 15, 2025 00:31:29.366359949 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:29.366400957 CET | 443 | 56013 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:31:29.366583109 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:29.367228985 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:29.367242098 CET | 443 | 56013 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:31:30.260075092 CET | 443 | 56013 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:31:30.260174036 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:30.265120029 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:30.265130043 CET | 443 | 56013 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:31:30.265372992 CET | 443 | 56013 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:31:30.267416000 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:30.267494917 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:30.267499924 CET | 443 | 56013 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:31:30.267651081 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:30.311336994 CET | 443 | 56013 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:31:30.439213037 CET | 443 | 56013 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:31:30.439469099 CET | 443 | 56013 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:31:30.439604998 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:30.439758062 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:30.439773083 CET | 443 | 56013 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:31:30.439781904 CET | 56013 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:31:34.410829067 CET | 49712 | 443 | 192.168.2.6 | 184.28.90.27 |
| Jan 15, 2025 00:31:34.417445898 CET | 443 | 49712 | 184.28.90.27 | 192.168.2.6 |
| Jan 15, 2025 00:31:34.417537928 CET | 49712 | 443 | 192.168.2.6 | 184.28.90.27 |
| Jan 15, 2025 00:31:35.613631964 CET | 49713 | 443 | 192.168.2.6 | 184.28.90.27 |
| Jan 15, 2025 00:31:35.619147062 CET | 443 | 49713 | 184.28.90.27 | 192.168.2.6 |
| Jan 15, 2025 00:31:35.619195938 CET | 49713 | 443 | 192.168.2.6 | 184.28.90.27 |
| Jan 15, 2025 00:32:06.192940950 CET | 56017 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:32:06.193041086 CET | 443 | 56017 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:32:06.193144083 CET | 56017 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:32:06.193409920 CET | 56017 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:32:06.193449020 CET | 443 | 56017 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:32:06.819907904 CET | 443 | 56017 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:32:06.820286036 CET | 56017 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:32:06.820355892 CET | 443 | 56017 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:32:06.820677042 CET | 443 | 56017 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:32:06.820956945 CET | 56017 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:32:06.821026087 CET | 443 | 56017 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:32:06.863585949 CET | 56017 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:32:16.342303038 CET | 56019 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:32:16.342359066 CET | 443 | 56019 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:32:16.342442036 CET | 56019 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:32:16.343656063 CET | 56019 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:32:16.343667030 CET | 443 | 56019 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:32:16.740937948 CET | 443 | 56017 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:32:16.741024971 CET | 443 | 56017 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:32:16.741131067 CET | 56017 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:32:17.151350975 CET | 443 | 56019 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:32:17.151494026 CET | 56019 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:32:17.156981945 CET | 56019 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:32:17.156991005 CET | 443 | 56019 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:32:17.157228947 CET | 443 | 56019 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:32:17.159377098 CET | 56019 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:32:17.159446001 CET | 56019 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:32:17.159450054 CET | 443 | 56019 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:32:17.159579039 CET | 56019 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:32:17.203392029 CET | 443 | 56019 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:32:17.331918955 CET | 443 | 56019 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:32:17.331999063 CET | 443 | 56019 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:32:17.332160950 CET | 56019 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:32:17.332329988 CET | 56019 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:32:17.332345009 CET | 443 | 56019 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:32:17.551948071 CET | 56017 | 443 | 192.168.2.6 | 172.217.18.100 |
| Jan 15, 2025 00:32:17.552022934 CET | 443 | 56017 | 172.217.18.100 | 192.168.2.6 |
| Jan 15, 2025 00:33:03.433773041 CET | 56022 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:33:03.433805943 CET | 443 | 56022 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:33:03.433912039 CET | 56022 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:33:03.434437037 CET | 56022 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:33:03.434448957 CET | 443 | 56022 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:33:04.322063923 CET | 443 | 56022 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:33:04.322134018 CET | 56022 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:33:04.324080944 CET | 56022 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:33:04.324090004 CET | 443 | 56022 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:33:04.324606895 CET | 443 | 56022 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:33:04.326473951 CET | 56022 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:33:04.326523066 CET | 56022 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:33:04.326525927 CET | 443 | 56022 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:33:04.326675892 CET | 56022 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:33:04.371323109 CET | 443 | 56022 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:33:04.501321077 CET | 443 | 56022 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:33:04.501430035 CET | 443 | 56022 | 40.113.103.199 | 192.168.2.6 |
| Jan 15, 2025 00:33:04.501529932 CET | 56022 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:33:04.501732111 CET | 56022 | 443 | 192.168.2.6 | 40.113.103.199 |
| Jan 15, 2025 00:33:04.501751900 CET | 443 | 56022 | 40.113.103.199 | 192.168.2.6 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 15, 2025 00:30:01.489255905 CET | 63290 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:30:01.489409924 CET | 57308 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:30:01.498104095 CET | 53 | 54853 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.504647970 CET | 53 | 57308 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.506894112 CET | 53 | 58401 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:01.513299942 CET | 53 | 63290 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.529717922 CET | 53 | 65381 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.675055027 CET | 61435 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:30:02.675376892 CET | 49499 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:30:02.686559916 CET | 53 | 61435 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:02.688919067 CET | 53 | 49499 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:04.413626909 CET | 51332 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:30:04.413836002 CET | 65268 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:30:04.437823057 CET | 53 | 65268 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:04.727183104 CET | 53 | 51332 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.078083992 CET | 63684 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:30:06.078279018 CET | 60796 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:30:06.086343050 CET | 53 | 63684 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:06.086586952 CET | 53 | 60796 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:09.689538002 CET | 55503 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:30:09.689754009 CET | 61236 | 53 | 192.168.2.6 | 1.1.1.1 |
| Jan 15, 2025 00:30:09.731987000 CET | 53 | 61236 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:09.851079941 CET | 53 | 55503 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:19.559593916 CET | 53 | 62802 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:30:38.606048107 CET | 53 | 61980 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:31:01.360735893 CET | 53 | 60365 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:31:01.450156927 CET | 53 | 57426 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:31:04.496673107 CET | 53 | 53902 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:31:32.233141899 CET | 53 | 56102 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:32:09.024178982 CET | 53 | 61057 | 1.1.1.1 | 192.168.2.6 |
| Jan 15, 2025 00:32:17.561841011 CET | 53 | 51911 | 1.1.1.1 | 192.168.2.6 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jan 15, 2025 00:30:01.489255905 CET | 192.168.2.6 | 1.1.1.1 | 0x55d3 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jan 15, 2025 00:30:01.489409924 CET | 192.168.2.6 | 1.1.1.1 | 0xd223 | Standard query (0) | 65 | IN (0x0001) | false | |
| Jan 15, 2025 00:30:02.675055027 CET | 192.168.2.6 | 1.1.1.1 | 0x4a70 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jan 15, 2025 00:30:02.675376892 CET | 192.168.2.6 | 1.1.1.1 | 0xf9cb | Standard query (0) | 65 | IN (0x0001) | false | |
| Jan 15, 2025 00:30:04.413626909 CET | 192.168.2.6 | 1.1.1.1 | 0xac9a | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jan 15, 2025 00:30:04.413836002 CET | 192.168.2.6 | 1.1.1.1 | 0x3342 | Standard query (0) | 65 | IN (0x0001) | false | |
| Jan 15, 2025 00:30:06.078083992 CET | 192.168.2.6 | 1.1.1.1 | 0xfaea | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jan 15, 2025 00:30:06.078279018 CET | 192.168.2.6 | 1.1.1.1 | 0x10cf | Standard query (0) | 65 | IN (0x0001) | false | |
| Jan 15, 2025 00:30:09.689538002 CET | 192.168.2.6 | 1.1.1.1 | 0x1903 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jan 15, 2025 00:30:09.689754009 CET | 192.168.2.6 | 1.1.1.1 | 0x2540 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jan 15, 2025 00:30:01.513299942 CET | 1.1.1.1 | 192.168.2.6 | 0x55d3 | No error (0) | 54.71.143.107 | A (IP address) | IN (0x0001) | false | ||
| Jan 15, 2025 00:30:01.513299942 CET | 1.1.1.1 | 192.168.2.6 | 0x55d3 | No error (0) | 54.69.238.133 | A (IP address) | IN (0x0001) | false | ||
| Jan 15, 2025 00:30:02.686559916 CET | 1.1.1.1 | 192.168.2.6 | 0x4a70 | No error (0) | 139.99.9.144 | A (IP address) | IN (0x0001) | false | ||
| Jan 15, 2025 00:30:04.727183104 CET | 1.1.1.1 | 192.168.2.6 | 0xac9a | No error (0) | 162.241.253.231 | A (IP address) | IN (0x0001) | false | ||
| Jan 15, 2025 00:30:06.086343050 CET | 1.1.1.1 | 192.168.2.6 | 0xfaea | No error (0) | 172.217.18.100 | A (IP address) | IN (0x0001) | false | ||
| Jan 15, 2025 00:30:06.086586952 CET | 1.1.1.1 | 192.168.2.6 | 0x10cf | No error (0) | 65 | IN (0x0001) | false | |||
| Jan 15, 2025 00:30:09.851079941 CET | 1.1.1.1 | 192.168.2.6 | 0x1903 | No error (0) | 162.241.253.231 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 0 | 192.168.2.6 | 49714 | 40.115.3.253 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-14 23:29:53 UTC | 71 | OUT | |
| 2025-01-14 23:29:53 UTC | 249 | OUT | |
| 2025-01-14 23:29:53 UTC | 1084 | OUT | |
| 2025-01-14 23:29:53 UTC | 218 | OUT | |
| 2025-01-14 23:29:53 UTC | 14 | IN | |
| 2025-01-14 23:29:53 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 1 | 192.168.2.6 | 49740 | 40.115.3.253 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-14 23:30:01 UTC | 71 | OUT | |
| 2025-01-14 23:30:01 UTC | 249 | OUT | |
| 2025-01-14 23:30:01 UTC | 1084 | OUT | |
| 2025-01-14 23:30:01 UTC | 218 | OUT | |
| 2025-01-14 23:30:01 UTC | 14 | IN | |
| 2025-01-14 23:30:01 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.6 | 49747 | 54.71.143.107 | 443 | 5132 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-14 23:30:02 UTC | 807 | OUT | |
| 2025-01-14 23:30:02 UTC | 410 | IN | |
| 2025-01-14 23:30:02 UTC | 105 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.6 | 49762 | 139.99.9.144 | 443 | 5132 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-14 23:30:03 UTC | 673 | OUT | |
| 2025-01-14 23:30:04 UTC | 533 | IN | |
| 2025-01-14 23:30:04 UTC | 835 | IN | |
| 2025-01-14 23:30:04 UTC | 1295 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.6 | 49775 | 162.241.253.231 | 443 | 5132 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-14 23:30:05 UTC | 737 | OUT | |
| 2025-01-14 23:30:05 UTC | 343 | IN | |
| 2025-01-14 23:30:05 UTC | 294 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.6 | 49776 | 162.241.253.231 | 443 | 5132 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-14 23:30:05 UTC | 738 | OUT | |
| 2025-01-14 23:30:08 UTC | 429 | IN | |
| 2025-01-14 23:30:08 UTC | 1249 | IN | |
| 2025-01-14 23:30:08 UTC | 696 | OUT | |
| 2025-01-14 23:30:09 UTC | 8192 | IN |