Edit tour

macOS Analysis Report

Overview

General Information

Analysis ID:	1675557
Infos:

Detection

Score:	21
Range:	0 - 100

Signatures

Connects to a pastebin service (likely for C&C)

Executes commands using a shell command-line interpreter

Executes the "curl" command used to transfer data via the network (typically using HTTP/S)

Reads the systems hostname

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1675557
Start date and time:	2025-04-27 19:12:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultmaccmdlinecookbook.jbs
Analysis system description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.14
CPU architecture:	x86_64
Analysis Mode:	default
Detection:	SUS
Classification:	sus21.troj.mac@0/0@1/0

Warnings

Excluded IPs from analysis (whitelisted): 17.253.97.202, 17.253.97.203, 17.137.170.2, 104.18.38.233, 23.222.201.219, 17.36.200.79, 17.253.3.143, 17.253.3.144, 17.253.3.140, 23.210.0.24
Excluded domains from analysis (whitelisted): mesu-cdn.apple.com.akadns.net, e11408.d.akamaiedge.net, lcdn-locator-usuqo.apple.com.akadns.net, updates.cdn-apple.com.akadns.net, gateway.icloud.com, e673.dsce9.akamaiedge.net, help-ar.apple.com.edgekey.net, crl.apple.com, ocsp.comodoca.com, mesu-cdn.origin-apple.com.akadns.net, lcdn-locator.apple.com.akadns.net, help.origin-apple.com.akadns.net, radarsubmissions.apple.com.akadns.net, lcdn-locator.apple.com, mesu.g.aaplimg.com, updates.g.aaplimg.com, radarsubmissions.apple.com, itunes.apple.com.edgekey.net, help.apple.com, mesu.apple.com, init.itunes.apple.com, updates.cdn-apple.com, init-cdn.itunes-apple.com.akadns.net
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/bin/sh -c "curl https:/pastebin.com/contact"
PID:	615
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	<!DOCTYPE html> <html lang="en"> <head> <meta name="viewport" content="width=device-width, initial-scale=0.75, maximum-scale=5.0, user-scalable=yes" /> <script async src="https://www.googletagmanager.com/gtag/js?id=G-S72LBY47R8"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', "G-S72LBY47R8"); </script> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Pastebin.com - Contact Us</title> <link rel="shortcut icon" href="/favicon.ico" /> <meta name="description" content="Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time." /> <meta property="og:description" content="Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time." /> <meta property="fb:app_id" content="231493360234820" /> <meta property="og:title" content="Pastebin.com - Contact Us" /> <meta property="og:type" content="article" /> <meta property="og:url" content="https://pastebin.com/contact" /> <meta property="og:image" content="https://pastebin.com/i/facebook.png" /> <meta property="og:site_name" content="Pastebin" /> <meta name="google-site-verification" content="jkUAIOE8owUXu8UXIhRLB9oHJsWBfOgJbZzncqHoF4A" /> <link rel="canonical" href="https://pastebin.com/contact" /> <meta name="csrf-param" content="_csrf-frontend"> <meta name="csrf-token" content="iyjOmtlQuz9uY1uuU1tZx9Wz5W2DdXECwiBRflDC2f7NUKPFnAr0BwBQa8M5bRr-lP2BC7EyIEWvZitKNJq3pg=="> <link href="/assets/c80611c4/css/bootstrap.min.css" rel="stylesheet"> <link href="/assets/d65ff796/dist/bootstrap-tagsinput.css" rel="stylesheet"> <link href="/themes/pastebin/css/vendors.bundle.css?30d6ece6979ee0cf5531" rel="stylesheet"> <link href="/themes/pastebin/css/app.bundle.css?30d6ece6979ee0cf5531" rel="stylesheet"> </head> <body class="night-auto " data-pr="" data-pa="x2xy94pJ" data-sar="1" data-abd="1" data-bd="1"> <svg style="height: 0; width: 0; position: absolute; visibility: hidden" xmlns="http://www.w3.org/2000/svg"> <symbol id="add" viewBox="0 0 1024 1024"><path fill="#ccc" d="M512 16C238 16 16 238 16 512s222 496 496 496 496-222 496-496S786 16 512 16z m288 552c0 13.2-10.8 24-24 24h-184v184c0 13.2-10.8 24-24 24h-112c-13.2 0-24-10.8-24-24v-184h-184c-13.2 0-24-10.8-24-24v-112c0-13.2 10.8-24 24-24h184v-184c0-13.2 10.8-24 24-24h112c13.2 0 24 10.8 24 24v184h184c13.2 0 24 10.8 24 24v112z"/></symbol> <symbol id="search" viewBox="0 0 512 512"><path fill="#ccc" d="M354.2,216c0-38.2-13-70.7-40-97.7c-27-27-59.6-40-97.7-40s-70.7,13-97.7,40s-40,59.6-40,97.7 s13,70.7,40,97.7s59.6,40,97.7,40s70.7-13,97.7-40C340.2,285.8,354.2,253.2,354.2,216z M511.5,472c0,10.2-3.7,19.5-12.1,27.9 c-8.4,8.4-16.8,12.1-27.9,12.1c-11.2,0-20.5-3.7-27.9-12.1L339.3,393.8c-37.2,26.1-78.2,38.2-122.9,38.2 c-29.8,0-57.7-5.6-83.8-16.8c-27-11.2-50.3-27-68.9-46.5s-34.4-42.8-46.5-68.9C6.1,272.8,0.5,244.8,0.5,216s5.6-57.7,16.8-83.8 c11.2-27,27-50.3,46.5-68.9s42.8-34.4,68.9-46.5C159.7,5.6,187.6,0,216.4,0s57.7,5.6,83.8,16.8c27,11.2,50.3,27,68.9,46.5 c18.6,19.5,34.4,42.8,46.5,68.9c11.2,27,16.8,54.9,16.8,83.8c0,44.7-13,85.6-38.2,122.9L499.4,444 C507.8,451.5,511.5,460.8,511.5,472z"/></g></symbol> </svg> <div class="wrap"> <div class="header"> <div class="container"> <div class="header__container"> <div class="header__left"> <a class="header__logo" href="/"> Pastebin </a> <div class="header__links h_1024"> <a href="/doc_api">API</a> <a href="/tools">tools</a> <a href="/faq">faq</a> </div> <a class="header__btn" href="/"> <span>paste</span> </a> <div class="header__search"> <form id="w0" class="search_form" action="https://pastebin.com/search" method="get"> <input type="text" id="q" class="search_input" name="q" maxlength="128" placeholder="Search..."> <button type="submit" class="search_btn" aria-label="Search"><svg class="icon search"><use xlink:href="#search"></use></svg></button> </form> </div> </div> <div class="header__right"> <div class="header_sign"> <a href="/login" class="btn-sign sign-in">Login</a> <a href="/signup" class="btn-sign sign-up">Sign up</a> </div> </div> </div> </div> </div> <div class="container"> <div class="content"> <div class="page -top -right"> <div class="content__title">Contact Us</div> <div class="content__text"> Please email all your questions to <a href="/cdn-cgi/l/email-protection#6e0f0a0307002e1e0f1d1a0b0c0700400d0103"><span class="__cf_email__" data-cfemail="b5d4d1d8dcdbf5c5d4c6c1d0d7dcdb9bd6dad8">[email protected]</span></a> <b>(DO NOT EMAIL ADMIN FOR CONTENT REMOVAL REQUESTS, read part below)</b> </div> <div class="content__sub_title">How can I report bad content?</div> <div class="content__text"> To report possible malicious activity and/or violation of our T&Cs please use the <b>'REPORT ABUSE'</b> button above each paste, this requires a Pastebin account, or you may send an email to <a href="/cdn-cgi/l/email-protection#92e1f7f1e7e0fbe6ebd2e2f3e1e6f7f0fbfcbcf1fdff"><span class="__cf_email__" data-cfemail="6714020412150e131e271706141302050e094904080a">[email protected]</span></a> <br><br> The following steps are important: <br><br> 1. Please indicate <u>who</u> you are, <u>why</u> the item is abusive and also <b>include the direct link to the item(s) you want removed</b>.<br> 2. Make sure you write to us in <b>english</b>, otherwise we might ignore your email.<br> </div> <div class="content__sub_title">DMCA Requests</div> <div class="content__text"> Send the infringement notice via <a href="/dmca">this DMCA REQUEST form</a>.</div> </div> <div style="clear: both;"></div> </div> <div class="sidebar h_1024"> <div class="sidebar__title"> <a href="/archive">Public Pastes</a> </div> <ul class="sidebar__menu"> <li> <a href="/EL7K7D0J">Make $1000 15-MINUTES (BEGINNER) ME</a> <div class="details"> JavaScript \| 3 min ago \| 0.05 KB </div> </li> <li> <a href="/3Kse6LMu">EARN $900 INSTANTLY 2025 M6</a> <div class="details"> JavaScript \| 12 min ago \| 0.05 KB </div> </li> <li> <a href="/yjELyT1N">Make $1000 15-MINUTES (BEGINNER) 96</a> <div class="details"> JavaScript \| 22 min ago \| 0.05 KB </div> </li> <li> <a href="/DWp2iMfJ">EARN $900 INSTANTLY 2025 NU</a> <div class="details"> JavaScript \| 31 min ago \| 0.05 KB </div> </li> <li> <a href="/swTx4FKt">C# easy Singleton Cache Pattern</a> <div class="details"> C# \| 41 min ago \| 24.39 KB </div> </li> <li> <a href="/e2WBLnuH">Make $1000 15-MINUTES (BEGINNER) ME</a> <div class="details"> JavaScript \| 50 min ago \| 0.05 KB </div> </li> <li> <a href="/wuniv989">2025-04-27T18:21:27.588483</a> <div class="details"> PHP \| 52 min ago \| 0.50 KB </div> </li> <li> <a href="/VDP4C3TJ">EARN $900 INSTANTLY 2025 M6</a> <div class="details"> JavaScript \| 60 min ago \| 0.05 KB </div> </li> </ul> <div class="sidebar__sticky -on"> </div> </div> </div> </div> <div class="top-footer"> <a class="icon-link -size-24-24 -chrome" href="/tools#chrome" title="Google Chrome Extension"></a> <a class="icon-link -size-24-24 -firefox" href="/tools#firefox" title="Firefox Extension"></a> <a class="icon-link -size-24-24 -iphone" href="/tools#iphone" title="iPhone/iPad Application"></a> <a class="icon-link -size-24-24 -windows" href="/tools#windows" title="Windows Desktop Application"></a> <a class="icon-link -size-24-24 -android" href="/tools#android" title="Android Application"></a> <a class="icon-link -size-24-24 -macos" href="/tools#macos" title="MacOS X Widget"></a> <a class="icon-link -size-24-24 -opera" href="/tools#opera" title="Opera Extension"></a> <a class="icon-link -size-24-24 -unix" href="/tools#pastebincl" title="Linux Application"></a> </div> <footer class="footer"> <div class="container"> <div class="footer__container"> <div class="footer__left"> <a href="/">create new paste</a> <span class="footer__devider"> / </span> <a href="/languages">syntax languages</a> <span class="footer__devider"> / </span> <a href="/archive">archive</a> <span class="footer__devider"> / </span> <a href="/faq">faq</a> <span class="footer__devider"> / </span> <a href="/tools">tools</a> <span class="footer__devider"> / </span> <a href="/night_mode">night mode</a> <span class="footer__devider"> / </span> <a href="/doc_api">api</a> <span class="footer__devider"> / </span> <a href="/doc_scraping_api">scraping api</a> <span class="footer__devider"> / </span> <a href="/news">news</a> <span class="footer__devider"> / </span> <a href="/pro" class="pro">pro</a> <br> <a href="/doc_privacy_statement">privacy statement</a> <span class="footer__devider"> / </span> <a href="/doc_cookies_policy">cookies policy</a> <span class="footer__devider"> / </span> <a href="/doc_terms_of_service">terms of service</a><span class="footer__devider"> / </span> <a href="/doc_security_disclosure">security disclosure</a> <span class="footer__devider"> / </span> <a href="/dmca">dmca</a> <span class="footer__devider"> / </span> <a href="/report-abuse">report abuse</a> <span class="footer__devider"> / </span> <a href="/contact">contact</a> <br> <br> <span class="footer__bottom h_800"> By using Pastebin.com you agree to our <a href="/doc_cookies_policy">cookies policy</a> to enhance your experience. <br> Site design & logo © 2025 Pastebin</span> </div> <div class="footer__right h_1024"> <a class="icon-link -size-40-40 -facebook-circle" href="https://facebook.com/pastebin" rel="nofollow" title="Like us on Facebook" target="_blank"></a> <a class="icon-link -size-40-40 -twitter-circle" href="https://twitter.com/pastebin" rel="nofollow" title="Follow us on Twitter" target="_blank"></a> </div> </div> </div> </footer> <div class="popup-container"> <div class="popup-box -cookies" data-name="l2c_1"> We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the <a href="/doc_cookies_policy">Cookies Policy</a>.  <span class="cookie-button js-close-cookies">OK, I Understand</span> </div> <div class="popup-box -pro" data-name="l2c_2_pg"> <div class="pro-promo-img"> <a href="/signup" aria-label="Sign Up"> <img src="/themes/pastebin/img/hello.webp" alt=""/> </a> </div> <div class="pro-promo-text"> Not a member of Pastebin yet?<br/> <a href="/signup"><b>Sign Up</b></a>, it unlocks many cool features! </div> <div class="close js-close-pro-guest" title="Close Me"> </div> </div> </div> <span class="cd-top"></span> <script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script src="/assets/9ce1885/jquery.min.js"></script> <script src="/assets/f04f76b8/yii.js"></script> <script src="/assets/d65ff796/dist/bootstrap-tagsinput.js"></script> <script> const POST_EXPIRATION_NEVER = 'N'; const POST_EXPIRATION_BURN = 'B'; const POST_STATUS_PUBLIC = '0'; const POST_STATUS_UNLISTED = '1'; </script> <script src="/themes/pastebin/js/vendors.bundle.js?30d6ece6979ee0cf5531"></script> <script src="/themes/pastebin/js/app.bundle.js?30d6ece6979ee0cf5531"></script> </body> </html>
Standard Error:	% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 14739 0 14739 0 0 17076 0 --:--:-- --:--:-- --:--:-- 17078

Process Tree

System is macvm-mojave

xpcproxy New Fork (PID: 610, Parent: 1)

nsurlstoraged (MD5: 321b0a40e24b45f0af49ba42742b3f64) Arguments: /usr/libexec/nsurlstoraged --privileged

mono-sgen32 New Fork (PID: 615, Parent: 537)

sh (MD5: be55e8952a262d0e524239dbf82191ed) Arguments: /bin/sh -c curl https://pastebin.com/contact

curl (MD5: 2418204e23e2952e7995f1819a1f78f5) Arguments: curl https://pastebin.com/contact

xpcproxy New Fork (PID: 634, Parent: 1)

eficheck (MD5: 328beb81a2263449258057506bb4987f) Arguments: /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon

cleanup

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Persistence and Installation Behavior
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49347 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.248.199.71:443 -> 192.168.11.12:49348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49350 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.68.199:443 -> 192.168.11.12:49357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49385 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49387 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49404 version: TLS 1.2

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.47.6

Source: global traffic

HTTP traffic detected: GET /contact HTTP/1.1Host: pastebin.comUser-Agent: curl/7.54.0Accept: */*

Source: global traffic

DNS traffic detected: DNS query: pastebin.com

Source: /usr/bin/curl (PID: 615)

Reads from socket in process: data

Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49387
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49384
Source: unknown	Network traffic detected: HTTP traffic on port 49395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49350
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49404

Source: /usr/bin/curl (PID: 615)

Writes from socket in process: data

Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49347 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.248.199.71:443 -> 192.168.11.12:49348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49350 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.68.199:443 -> 192.168.11.12:49357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49385 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49387 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.47.6:443 -> 192.168.11.12:49404 version: TLS 1.2

Source: classification engine

Classification label: sus21.troj.mac@0/0@1/0

Source: /Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32 (PID: 615)

Shell command executed: /bin/sh -c curl https://pastebin.com/contact

Jump to behavior

Source: /bin/sh (PID: 615)

Curl executable: /usr/bin/curl -> curl https://pastebin.com/contact

Jump to behavior

Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 634)

Random device file read: /dev/random

Jump to behavior

Source: submitted sample

Stderr: % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0100 14739 0 14739 0 0 17076 0 --:--:-- --:--:-- --:--:-- 17078: exit code = 0

Source: /bin/sh (PID: 615)

Sysctl requested: kern.hostname (1.10)

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Web Service	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gateway.fe2.apple-dns.net	17.248.199.71	true	false		high
pastebin.com	104.22.68.199	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/contact	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.22.68.199	pastebin.com	United States	13335	CLOUDFLARENETUS	false
151.101.47.6	unknown	United States	54113	FASTLYUS	false
23.210.0.217	unknown	United States	16625	AKAMAI-ASUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.22.68.199	XClient3.exe	Get hash	malicious	XWorm	Browse
	Xworm V5.6.exe	Get hash	malicious	SheetRat	Browse
	fuckyou.exe	Get hash	malicious	XWorm	Browse
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	test.exe	Get hash	malicious	XWorm	Browse
	WizClient.exe	Get hash	malicious	XWorm	Browse
	Cool.exe	Get hash	malicious	XWorm	Browse
	bootstrapper.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	Blackops 2 Updated.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	Jrjmgxipcapq.exe	Get hash	malicious	XWorm	Browse
151.101.47.6	https://garglingably.com	Get hash	malicious	Unknown	Browse
	d8SJC8BaVe.dmg	Get hash	malicious	Banshee Stealer	Browse
	Eqx3KrV3ru.dmg	Get hash	malicious	Banshee Stealer	Browse
	log.json	Get hash	malicious	Unknown	Browse
23.210.0.217	https://garglingably.com	Get hash	malicious	Unknown	Browse
	imtjW1Rf7L.dmg	Get hash	malicious	Banshee Stealer	Browse
	Eqx3KrV3ru.dmg	Get hash	malicious	Banshee Stealer	Browse
	log.json	Get hash	malicious	Unknown	Browse
	CitrixReceiver11_4_3.dmg	Get hash	malicious	Unknown	Browse
	extracted-pkg.ziphttps://fluencydirect-distro.s3.amazonaws.com/releases.macOS/FluencyDirect-11.0.10.40.pkg	Get hash	malicious	Unknown	Browse
	http://zzhreceive.anondns.net	Get hash	malicious	Unknown	Browse
	http://usptrackxc.top	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	XClient3.exe	Get hash	malicious	XWorm	Browse	104.22.68.199
	svchost.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.22.69.199
	Xworm V5.6.exe	Get hash	malicious	SheetRat	Browse	104.22.68.199
	COM Surrogates.exe	Get hash	malicious	XWorm	Browse	104.22.69.199
	tall.exe	Get hash	malicious	XWorm	Browse	172.67.25.94
	XClient(1).exe	Get hash	malicious	XWorm	Browse	172.67.25.94
	fuckoff.exe	Get hash	malicious	XWorm	Browse	104.22.69.199
	fuckyou.exe	Get hash	malicious	XWorm	Browse	104.22.68.199
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.22.68.199
	Output.exe	Get hash	malicious	XWorm	Browse	104.22.69.199

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	9afe68a5-ccda-401c-846e-13aafeb63795.ps1	Get hash	malicious	GhostRat	Browse	185.199.111.133
	https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget%20billede%20(ingen%20mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=artisanglobaltour.com/fcrfr6/505388/bXRvcnJlc0B3YXRlcndvcmtzLmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	https://colegiojuancalvino.com/cloud/	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	SecuriteInfo.com.DecompressionBomb.30433.31834.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	SecuriteInfo.com.DecompressionBomb.30433.31834.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget%20billede%20(ingen%20mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=artisanglobaltour.com/fcrfr6/505388/bXRvcnJlc0B3YXRlcndvcmtzLmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://hbNVEb4OA8z1FhMfKL0z.ateeoky.es/O3GHNsy/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	DiscordUpdate.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	https://bit.ly/3WzcrWS	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://deareports.online/?p=1444	Get hash	malicious	Unknown	Browse	151.101.66.49
AKAMAI-ASUS	250427-tzsygaxkz6.bin.exe	Get hash	malicious	RemCom RemoteAdmin, Mimikatz, DUMPNTLM, Metasploit	Browse	2.23.77.231
	250427-ta714awpt9.bin.exe	Get hash	malicious	XRed	Browse	184.29.183.29
	Gdrive_files__________.zip_019207.pdf	Get hash	malicious	Unknown	Browse	72.246.157.111
	250427-ta714awpt9.bin.exe	Get hash	malicious	XRed	Browse	184.29.183.29
	250427-p5qcba1sdw.bin.exe	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, JasonRAT, LummaC Stealer	Browse	184.29.183.29
	random.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer	Browse	23.222.161.105
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, Quasar, RedLine, Vidar, Xmrig	Browse	184.28.253.43
	ZIRRZXJR.msi	Get hash	malicious	Unknown	Browse	23.209.84.49
	9afe68a5-ccda-401c-846e-13aafeb63795.ps1	Get hash	malicious	GhostRat	Browse	184.28.253.105
	iUbr.exe	Get hash	malicious	RemCom RemoteAdmin, Mimikatz, DUMPNTLM, Metasploit	Browse	2.23.77.202
CLOUDFLARENETUS	250427-tzsygaxkz6.bin.exe	Get hash	malicious	RemCom RemoteAdmin, Mimikatz, DUMPNTLM, Metasploit	Browse	1.1.1.211
	Sender.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.77.203
	XClient3.exe	Get hash	malicious	XWorm	Browse	104.22.68.199
	250427-s7lnpawnw3.bin.exe	Get hash	malicious	SilverRat	Browse	162.159.135.232
	250427-s7lnpawnw3.bin.exe	Get hash	malicious	SilverRat	Browse	162.159.138.232
	250427-ryd2tassex.bin.exe	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer	Browse	104.21.85.126
	250427-rzwcgsvn14.bin.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.125
	250427-p7bxps1sgx.bin.exe	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer	Browse	104.21.85.126
	250427-p5qcba1sdw.bin.exe	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, JasonRAT, LummaC Stealer	Browse	172.67.205.184
	random.exe	Get hash	malicious	Amadey, Credential Flusher, GhostRat, Healer AV Disabler, LummaC Stealer	Browse	172.67.205.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5c118da645babe52f060d0754256a73c	https://garglingably.com	Get hash	malicious	Unknown	Browse	17.248.199.71 151.101.47.6
	LygVsV8I5u.dmg	Get hash	malicious	Banshee Stealer	Browse	17.248.199.71 151.101.47.6
	d8SJC8BaVe.dmg	Get hash	malicious	Banshee Stealer	Browse	17.248.199.71 151.101.47.6
	imtjW1Rf7L.dmg	Get hash	malicious	Banshee Stealer	Browse	17.248.199.71 151.101.47.6
	Eqx3KrV3ru.dmg	Get hash	malicious	Banshee Stealer	Browse	17.248.199.71 151.101.47.6
	log.json	Get hash	malicious	Unknown	Browse	17.248.199.71 151.101.47.6
	Constate	Get hash	malicious	Unknown	Browse	17.248.199.71 151.101.47.6
	https://amhcouk.org/membership-proforma1	Get hash	malicious	Unknown	Browse	17.248.199.71 151.101.47.6
	minaUSB	Get hash	malicious	Unknown	Browse	17.248.199.71 151.101.47.6
	.BC.T_nlroYH.278.dr	Get hash	malicious	Unknown	Browse	17.248.199.71 151.101.47.6
a7a5e32c2ca29907256b5de4fbdf61ed	AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg	Get hash	malicious	Unknown	Browse	104.22.68.199
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFkILOsO1UnLItklUwD68rhtr94fRPJI4HAEjYZ7vdlgHTiHU_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPRzSyzWe4FlQQyqQA-2BOTqGjWjoN-2BuPm4tzM5LM6f6tO2PXKa74YSjAhzL6onG-2BuKO989bZZj9vupVvXtBWU0qXeI6VZny9p-2FgjssbU9Je1I2RDoZPOLgxX8gxf2-2BzsuoGYoVqnaS5CYR1Z5WEWAcZP0wmQbm4ikqer-2BGrlVppyDdPw-2BxPiObQZTbU2ZeclEy9V5nUC-2BnwlvdDmQwsjghHkHuJFiwInVWpyiCgGFo0uYjlPs3G8hdAgJBJu-2F-2B0K864-3D#ZmluYW5jZUBjbGVhcnZpZXcuYWk=	Get hash	malicious	Unknown	Browse	104.22.68.199
	extracted-pkg.ziphttps://fluencydirect-distro.s3.amazonaws.com/releases.macOS/FluencyDirect-11.0.10.40.pkg	Get hash	malicious	Unknown	Browse	104.22.68.199
	Aunteficator-installer-1it5dZOj.pkg	Get hash	malicious	Unknown	Browse	104.22.68.199
	MacKeeper.6.7.1.pkg	Get hash	malicious	Unknown	Browse	104.22.68.199

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

⊘No static file info

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 181
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2025 19:13:09.596807957 CEST	49347	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.697648048 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:09.701359987 CEST	443	49347	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.702027082 CEST	49347	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.703833103 CEST	49347	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.803354025 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:09.803996086 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:09.807864904 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:09.809931993 CEST	443	49347	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.811403036 CEST	443	49347	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.811433077 CEST	443	49347	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.811444044 CEST	443	49347	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.811454058 CEST	443	49347	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.811701059 CEST	443	49347	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.811717033 CEST	443	49347	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.813350916 CEST	49347	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.813456059 CEST	49347	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.813532114 CEST	49347	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.813703060 CEST	49347	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.821609974 CEST	49347	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.844494104 CEST	49350	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.916984081 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:09.917758942 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:09.917774916 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:09.918106079 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:09.918123007 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:09.918483019 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:09.918637991 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:09.931400061 CEST	443	49347	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.931628942 CEST	443	49347	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.932787895 CEST	49347	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.951519966 CEST	443	49350	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:09.952792883 CEST	49350	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:09.954051971 CEST	49350	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.044017076 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.058348894 CEST	443	49350	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.060393095 CEST	443	49350	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.060619116 CEST	443	49350	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.060632944 CEST	443	49350	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.060642958 CEST	443	49350	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.060651064 CEST	443	49350	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.060659885 CEST	443	49350	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.062146902 CEST	49350	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.062227964 CEST	49350	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.062227964 CEST	49350	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.064444065 CEST	49350	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.076558113 CEST	49350	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.091813087 CEST	49353	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.148397923 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.148411989 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.149127007 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.149147987 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.177509069 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.177871943 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.177892923 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.178141117 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.178653002 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.180311918 CEST	443	49350	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.180326939 CEST	443	49350	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.181042910 CEST	49350	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.195636034 CEST	443	49353	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.196358919 CEST	49353	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.197745085 CEST	49353	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.287118912 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.287132978 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.287671089 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.287704945 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.287815094 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.288086891 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.288105011 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.288113117 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.288794041 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.288916111 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.289391994 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.295756102 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.295767069 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.296448946 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.296685934 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.300566912 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.300582886 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.301275969 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.301484108 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.303992033 CEST	443	49353	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.305183887 CEST	443	49353	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.305422068 CEST	443	49353	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.305442095 CEST	443	49353	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.305449009 CEST	443	49353	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.305454016 CEST	443	49353	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.305459976 CEST	443	49353	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.306346893 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.306356907 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.306929111 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.307178020 CEST	49353	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.307264090 CEST	49353	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.307264090 CEST	49353	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.307372093 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.307473898 CEST	49353	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.312663078 CEST	49353	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.313618898 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.313628912 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.314229965 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.314472914 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.320017099 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.320027113 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.320863962 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.321178913 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.327665091 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.392276049 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.392285109 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.392899036 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.392988920 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.393444061 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.395412922 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.395642996 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.396888971 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.399086952 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.405508041 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.405770063 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.406315088 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.406548977 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.411034107 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.411272049 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.411696911 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.411969900 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.416523933 CEST	443	49353	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.416748047 CEST	443	49353	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:10.417386055 CEST	49353	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:10.418122053 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.418129921 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.418652058 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.418873072 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.427203894 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.427428961 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:10.427959919 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:10.920288086 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:11.024347067 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:11.871129990 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:11.872805119 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:11.975805044 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:11.976331949 CEST	49348	443	192.168.11.12	17.248.199.71
Apr 27, 2025 19:13:11.977650881 CEST	443	49348	17.248.199.71	192.168.11.12
Apr 27, 2025 19:13:13.632656097 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:13.632731915 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:13.633697987 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:13.656866074 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:13.656910896 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:13.903261900 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:13.905138016 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:13.905193090 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.012887001 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.012938023 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.013902903 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.014863968 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.015443087 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.057744026 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.350909948 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.350954056 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.350986958 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.351033926 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.351049900 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.351309061 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.351316929 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.351423025 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.353598118 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.353610992 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:14.353873014 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.354127884 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.354207993 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.354404926 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.354625940 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.354625940 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.355160952 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.355614901 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.356081963 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.356398106 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.358031988 CEST	49357	443	192.168.11.12	104.22.68.199
Apr 27, 2025 19:13:14.358045101 CEST	443	49357	104.22.68.199	192.168.11.12
Apr 27, 2025 19:13:43.345309973 CEST	49384	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.345338106 CEST	443	49384	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:43.346267939 CEST	49384	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.346940994 CEST	49384	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.346956015 CEST	443	49384	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:43.573071003 CEST	443	49384	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:43.573702097 CEST	49384	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.573760986 CEST	49384	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.727567911 CEST	49384	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.727756023 CEST	443	49384	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:43.728209019 CEST	443	49384	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:43.728303909 CEST	49384	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.728790045 CEST	49384	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.741645098 CEST	49385	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.741729021 CEST	443	49385	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:43.742244005 CEST	49385	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.743065119 CEST	49385	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.743118048 CEST	443	49385	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:43.973665953 CEST	443	49385	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:43.975142956 CEST	49385	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.975202084 CEST	49385	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.981688023 CEST	49385	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.981831074 CEST	443	49385	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:43.982238054 CEST	443	49385	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:43.982389927 CEST	49385	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.982599974 CEST	49385	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:43.999943018 CEST	49386	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.000024080 CEST	443	49386	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:44.000619888 CEST	49386	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.001307964 CEST	49386	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.001360893 CEST	443	49386	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:44.225745916 CEST	443	49386	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:44.226492882 CEST	49386	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.226614952 CEST	49386	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.235225916 CEST	49386	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.235408068 CEST	443	49386	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:44.235814095 CEST	443	49386	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:44.236246109 CEST	49386	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.236306906 CEST	49386	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.255908012 CEST	49387	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.255999088 CEST	443	49387	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:44.256583929 CEST	49387	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.257596016 CEST	49387	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.257667065 CEST	443	49387	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:44.474726915 CEST	443	49387	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:44.475512028 CEST	49387	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.476216078 CEST	49387	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.493618965 CEST	49387	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.493707895 CEST	443	49387	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:44.493829966 CEST	443	49387	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:44.494441986 CEST	49387	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:44.494441986 CEST	49387	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.200515032 CEST	49395	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.200618029 CEST	443	49395	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:52.201180935 CEST	49395	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.202182055 CEST	49395	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.202239037 CEST	443	49395	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:52.428498983 CEST	443	49395	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:52.430370092 CEST	49395	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.430442095 CEST	49395	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.461293936 CEST	49395	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.461329937 CEST	443	49395	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:52.461426020 CEST	443	49395	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:52.462236881 CEST	49395	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.462301016 CEST	49395	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.499290943 CEST	49396	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.499308109 CEST	443	49396	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:52.499975920 CEST	49396	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.500659943 CEST	49396	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.500673056 CEST	443	49396	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:52.721750975 CEST	443	49396	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:52.722450018 CEST	49396	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.722537041 CEST	49396	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.730108976 CEST	49396	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.730252981 CEST	443	49396	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:52.730721951 CEST	443	49396	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:52.730781078 CEST	49396	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:52.731240034 CEST	49396	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:53.742989063 CEST	49400	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:53.743093967 CEST	443	49400	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:53.743701935 CEST	49400	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:53.744369030 CEST	49400	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:53.744421959 CEST	443	49400	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:53.968250036 CEST	443	49400	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:53.969077110 CEST	49400	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:53.969309092 CEST	49400	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:53.975146055 CEST	49400	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:53.975317001 CEST	443	49400	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:53.975775957 CEST	443	49400	151.101.47.6	192.168.11.12
Apr 27, 2025 19:13:53.975908041 CEST	49400	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:13:53.976927042 CEST	49400	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:07.212553024 CEST	49344	80	192.168.11.12	23.210.0.217
Apr 27, 2025 19:14:07.323252916 CEST	80	49344	23.210.0.217	192.168.11.12
Apr 27, 2025 19:14:07.324011087 CEST	49344	80	192.168.11.12	23.210.0.217
Apr 27, 2025 19:14:15.019188881 CEST	49401	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.019269943 CEST	443	49401	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.019927025 CEST	49401	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.020804882 CEST	49401	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.020864964 CEST	443	49401	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.248020887 CEST	443	49401	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.248692989 CEST	49401	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.248869896 CEST	49401	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.261318922 CEST	49401	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.261442900 CEST	443	49401	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.261686087 CEST	443	49401	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.262120008 CEST	49401	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.262208939 CEST	49401	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.279709101 CEST	49402	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.279756069 CEST	443	49402	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.280324936 CEST	49402	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.283245087 CEST	49402	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.283277035 CEST	443	49402	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.506400108 CEST	443	49402	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.507445097 CEST	49402	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.507486105 CEST	49402	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.519227028 CEST	49402	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.519381046 CEST	443	49402	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.519741058 CEST	443	49402	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.520247936 CEST	49402	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.520304918 CEST	49402	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.545190096 CEST	49403	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.545268059 CEST	443	49403	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.545871973 CEST	49403	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.546787977 CEST	49403	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.546849966 CEST	443	49403	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.770488977 CEST	443	49403	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.771301031 CEST	49403	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.771342993 CEST	49403	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.777951002 CEST	49403	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.778126001 CEST	443	49403	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.778532982 CEST	443	49403	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.779289007 CEST	49403	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.779520035 CEST	49403	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.791520119 CEST	49404	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.791591883 CEST	443	49404	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:15.792196989 CEST	49404	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.793138981 CEST	49404	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:15.793190956 CEST	443	49404	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:16.018387079 CEST	443	49404	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:16.019160032 CEST	49404	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:16.019206047 CEST	49404	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:16.025827885 CEST	49404	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:16.025981903 CEST	443	49404	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:16.026354074 CEST	443	49404	151.101.47.6	192.168.11.12
Apr 27, 2025 19:14:16.026725054 CEST	49404	443	192.168.11.12	151.101.47.6
Apr 27, 2025 19:14:16.026972055 CEST	49404	443	192.168.11.12	151.101.47.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2025 19:13:13.498594999 CEST	62434	53	192.168.11.12	1.1.1.1
Apr 27, 2025 19:13:13.604306936 CEST	53	62434	1.1.1.1	192.168.11.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 27, 2025 19:13:13.498594999 CEST	192.168.11.12	1.1.1.1	0x74ba	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 27, 2025 19:13:09.693351984 CEST	1.1.1.1	192.168.11.12	0xd973	No error (0)	gateway.fe2.apple-dns.net	17.248.199.71	A (IP address)	IN (0x0001)	false
Apr 27, 2025 19:13:09.693351984 CEST	1.1.1.1	192.168.11.12	0xd973	No error (0)	gateway.fe2.apple-dns.net	17.248.199.69	A (IP address)	IN (0x0001)	false
Apr 27, 2025 19:13:09.693351984 CEST	1.1.1.1	192.168.11.12	0xd973	No error (0)	gateway.fe2.apple-dns.net	17.248.199.64	A (IP address)	IN (0x0001)	false
Apr 27, 2025 19:13:09.693351984 CEST	1.1.1.1	192.168.11.12	0xd973	No error (0)	gateway.fe2.apple-dns.net	17.248.199.65	A (IP address)	IN (0x0001)	false
Apr 27, 2025 19:13:09.693351984 CEST	1.1.1.1	192.168.11.12	0xd973	No error (0)	gateway.fe2.apple-dns.net	17.248.199.12	A (IP address)	IN (0x0001)	false
Apr 27, 2025 19:13:13.604306936 CEST	1.1.1.1	192.168.11.12	0x74ba	No error (0)	pastebin.com	104.22.68.199	A (IP address)	IN (0x0001)	false
Apr 27, 2025 19:13:13.604306936 CEST	1.1.1.1	192.168.11.12	0x74ba	No error (0)	pastebin.com	172.67.25.94	A (IP address)	IN (0x0001)	false
Apr 27, 2025 19:13:13.604306936 CEST	1.1.1.1	192.168.11.12	0x74ba	No error (0)	pastebin.com	104.22.69.199	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 27, 2025 19:13:09.811454058 CEST	151.101.47.6	443	192.168.11.12	49347	CN=bag.itunes.apple.com, O=Apple Inc., L=Cupertino, ST=California, C=US, SERIALNUMBER=C0806592, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Feb 04 19:54:22 CET 2025 Wed Apr 29 14:54:50 CEST 2020	Tue Nov 18 20:40:14 CET 2025 Thu Apr 11 01:59:59 CEST 2030	771,49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-23-13-5-13172-18-16-11-10,29-23-24-25,0	5c118da645babe52f060d0754256a73c
Apr 27, 2025 19:13:09.811454058 CEST	151.101.47.6	443	192.168.11.12	49347	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Apr 29 14:54:50 CEST 2020	Thu Apr 11 01:59:59 CEST 2030		5c118da645babe52f060d0754256a73c
Apr 27, 2025 19:13:09.918123007 CEST	17.248.199.71	443	192.168.11.12	49348	CN=gateway.icloud.com, O=Apple Inc., ST=California, C=US CN=Apple Public Server ECC CA 1 - G1, O=Apple Inc., C=US CN=Apple Public Server ECC CA 1 - G1, O=Apple Inc., C=US	CN=Apple Public Server ECC CA 1 - G1, O=Apple Inc., C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US C=US, O=Apple Inc., OU=Apple Certification Authority, CN=Apple Root CA - G3	Mon Oct 28 07:43:49 CET 2024 Wed Dec 12 13:00:00 CET 2018 Mon Dec 18 22:12:39 CET 2023	Tue Nov 18 21:36:07 CET 2025 Wed Dec 11 13:00:00 CET 2030 Wed Dec 05 01:00:00 CET 2029	771,49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-23-13-5-13172-18-16-11-10,29-23-24-25,0	5c118da645babe52f060d0754256a73c
					CN=Apple Public Server ECC CA 1 - G1, O=Apple Inc., C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Dec 12 13:00:00 CET 2018	Wed Dec 11 13:00:00 CET 2030
					CN=Apple Public Server ECC CA 1 - G1, O=Apple Inc., C=US	C=US, O=Apple Inc., OU=Apple Certification Authority, CN=Apple Root CA - G3	Mon Dec 18 22:12:39 CET 2023	Wed Dec 05 01:00:00 CET 2029
Apr 27, 2025 19:13:10.060642958 CEST	151.101.47.6	443	192.168.11.12	49350	CN=bag.itunes.apple.com, O=Apple Inc., L=Cupertino, ST=California, C=US, SERIALNUMBER=C0806592, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Feb 04 19:54:22 CET 2025 Wed Apr 29 14:54:50 CEST 2020	Tue Nov 18 20:40:14 CET 2025 Thu Apr 11 01:59:59 CEST 2030	771,49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-23-13-5-13172-18-16-11-10,29-23-24-25,0	5c118da645babe52f060d0754256a73c
Apr 27, 2025 19:13:10.060642958 CEST	151.101.47.6	443	192.168.11.12	49350	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Apr 29 14:54:50 CEST 2020	Thu Apr 11 01:59:59 CEST 2030		5c118da645babe52f060d0754256a73c
Apr 27, 2025 19:13:10.305449009 CEST	151.101.47.6	443	192.168.11.12	49353	CN=bag.itunes.apple.com, O=Apple Inc., L=Cupertino, ST=California, C=US, SERIALNUMBER=C0806592, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Feb 04 19:54:22 CET 2025 Wed Apr 29 14:54:50 CEST 2020	Tue Nov 18 20:40:14 CET 2025 Thu Apr 11 01:59:59 CEST 2030	771,49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-23-13-5-13172-18-16-11-10,29-23-24-25,0	5c118da645babe52f060d0754256a73c
Apr 27, 2025 19:13:10.305449009 CEST	151.101.47.6	443	192.168.11.12	49353	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Apr 29 14:54:50 CEST 2020	Thu Apr 11 01:59:59 CEST 2030		5c118da645babe52f060d0754256a73c

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.12	49357	104.22.68.199	443

Timestamp	Bytes transferred	Direction	Data
2025-04-27 17:13:14 UTC	83	OUT	GET /contact HTTP/1.1 Host: pastebin.com User-Agent: curl/7.54.0 Accept: /
2025-04-27 17:13:14 UTC	553	IN	HTTP/1.1 200 OK Date: Sun, 27 Apr 2025 17:13:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block set-cookie: _csrf-frontend=38b31b6569393a2ef40f208e40077db4de4b9341635742def3f076614439223da%3A2%3A%7Bi%3A0%3Bs%3A14%3A%22_csrf-frontend%22%3Bi%3A1%3Bs%3A32%3A%22Fxm_EZO8n30mj6C9ANdf2GQGmFz4dXnX%22%3B%7D; path=/; HttpOnly cf-cache-status: DYNAMIC vary: accept-encoding Server: cloudflare CF-RAY: 936ff3070eb628c9-EWR
2025-04-27 17:13:14 UTC	816	IN	Data Raw: 33 39 39 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 30 2e 37 35 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 35 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 79 65 73 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 53 37 32 4c 42 59 34 37 52 38 22 3e 3c 2f 73 63 72 69 70 74 Data Ascii: 3993<!DOCTYPE html><html lang="en"><head> <meta name="viewport" content="width=device-width, initial-scale=0.75, maximum-scale=5.0, user-scalable=yes" /> <script async src="https://www.googletagmanager.com/gtag/js?id=G-S72LBY47R8"></script
2025-04-27 17:13:14 UTC	1369	IN	Data Raw: 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 73 74 65 62 69 6e 2e 63 6f 6d 20 69 73 20 74 68 65 20 6e 75 6d 62 65 72 20 6f 6e 65 20 70 61 73 74 65 20 74 6f 6f 6c 20 73 69 6e 63 65 20 32 30 30 32 2e 20 50 61 73 74 65 62 69 6e 20 69 73 20 61 20 77 65 62 73 69 74 65 20 77 68 65 72 65 20 79 6f 75 20 63 61 6e 20 73 74 6f 72 65 20 74 65 78 74 20 6f 6e 6c 69 6e 65 20 66 6f 72 20 61 20 73 65 74 20 70 65 72 69 6f 64 20 6f 66 20 74 69 6d 65 2e 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 66 62 3a 61 70 70 5f 69 64 22 20 63 6f 6e 74 65 6e 74 3d 22 32 33 31 34 39 33 33 36 30 32 33 34 38 32 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f Data Ascii: y="og:description" content="Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time." /> <meta property="fb:app_id" content="231493360234820" /> <meta property="o
2025-04-27 17:13:14 UTC	1369	IN	Data Raw: 30 3b 20 77 69 64 74 68 3a 20 30 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 20 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 20 20 20 20 3c 73 79 6d 62 6f 6c 20 69 64 3d 22 61 64 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 32 34 20 31 30 32 34 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 63 63 63 22 20 64 3d 22 4d 35 31 32 20 31 36 43 32 33 38 20 31 36 20 31 36 20 32 33 38 20 31 36 20 35 31 32 73 32 32 32 20 34 39 36 20 34 39 36 20 34 39 36 20 34 39 36 2d 32 32 32 20 34 39 36 2d 34 39 36 53 37 38 36 20 31 36 20 35 31 32 20 31 36 7a 20 6d 32 38 38 20 35 35 32 63 30 20 31 33 2e 32 2d 31 30 2e 38 20 32 34 2d Data Ascii: 0; width: 0; position: absolute; visibility: hidden" xmlns="http://www.w3.org/2000/svg"> <symbol id="add" viewBox="0 0 1024 1024"><path fill="#ccc" d="M512 16C238 16 16 238 16 512s222 496 496 496 496-222 496-496S786 16 512 16z m288 552c0 13.2-10.8 24-
2025-04-27 17:13:14 UTC	1369	IN	Data Raw: 6e 74 61 69 6e 65 72 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 5f 5f 6c 65 66 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 5f 5f 6c 6f 67 6f 22 20 68 72 65 66 3d 22 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 50 61 73 74 65 62 69 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 5f 5f 6c 69 6e 6b 73 20 68 5f 31 30 32 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ntainer"> <div class="header__left"> <a class="header__logo" href="/"> Pastebin </a> <div class="header__links h_1024">
2025-04-27 17:13:14 UTC	1369	IN	Data Raw: 6e 20 73 69 67 6e 2d 75 70 22 3e 53 69 67 6e 20 75 70 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: n sign-up">Sign up</a> </div> </div> </div> </div></div> <div class="container"> <div class="content">
2025-04-27 17:13:14 UTC	1369	IN	Data Raw: 2c 20 3c 75 3e 77 68 79 3c 2f 75 3e 20 74 68 65 20 69 74 65 6d 20 69 73 20 61 62 75 73 69 76 65 20 61 6e 64 20 61 6c 73 6f 20 3c 62 3e 69 6e 63 6c 75 64 65 20 74 68 65 20 64 69 72 65 63 74 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 69 74 65 6d 28 73 29 20 79 6f 75 20 77 61 6e 74 20 72 65 6d 6f 76 65 64 3c 2f 62 3e 2e 3c 62 72 3e 0a 0a 20 20 20 20 32 2e 20 4d 61 6b 65 20 73 75 72 65 20 79 6f 75 20 77 72 69 74 65 20 74 6f 20 75 73 20 69 6e 20 3c 62 3e 65 6e 67 6c 69 73 68 3c 2f 62 3e 2c 20 6f 74 68 65 72 77 69 73 65 20 77 65 20 6d 69 67 68 74 20 69 67 6e 6f 72 65 20 79 6f 75 72 20 65 6d 61 69 6c 2e 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 5f 5f 73 75 62 5f 74 69 74 6c 65 22 3e 44 4d 43 41 20 52 65 71 75 65 Data Ascii: , <u>why</u> the item is abusive and also <b>include the direct link to the item(s) you want removed</b>.<br> 2. Make sure you write to us in <b>english</b>, otherwise we might ignore your email.<br></div><div class="content__sub_title">DMCA Reque
2025-04-27 17:13:14 UTC	1369	IN	Data Raw: 55 54 45 53 20 28 42 45 47 49 4e 4e 45 52 29 20 39 36 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 65 74 61 69 6c 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 4a 61 76 61 53 63 72 69 70 74 20 7c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 32 32 20 6d 69 6e 20 61 67 6f 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7c 20 30 2e 30 35 20 4b 42 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: UTES (BEGINNER) 96</a> <div class="details"> JavaScript \| 22 min ago \| 0.05 KB </div> </li>
2025-04-27 17:13:14 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 35 32 20 6d 69 6e 20 61 67 6f 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7c 20 30 2e 35 30 20 4b 42 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 56 44 50 34 43 33 54 4a 22 3e 45 41 52 4e 20 24 39 30 30 20 49 4e 53 54 41 4e 54 4c 59 20 32 30 32 35 20 4d 36 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 65 74 61 69 6c 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 52 min ago \| 0.50 KB </div> </li> <li> <a href="/VDP4C3TJ">EARN $900 INSTANTLY 2025 M6</a> <div class="details">
2025-04-27 17:13:14 UTC	1369	IN	Data Raw: 6c 69 63 61 74 69 6f 6e 22 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 66 6f 6f 74 65 72 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 5f 5f 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 5f 5f 6c 65 66 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 63 72 65 61 74 65 20 6e 65 77 20 70 61 73 74 65 3c 2f 61 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 5f 5f 64 65 76 69 64 65 72 22 3e 26 6e 62 73 70 3b 2f 26 6e 62 73 70 3b 3c 2f 73 70 61 6e 3e 0a Data Ascii: lication"></a></div><footer class="footer"> <div class="container"> <div class="footer__container"> <div class="footer__left"> <a href="/">create new paste</a> <span class="footer__devider"> / </span>
2025-04-27 17:13:14 UTC	1369	IN	Data Raw: 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 64 6f 63 5f 74 65 72 6d 73 5f 6f 66 5f 73 65 72 76 69 63 65 22 3e 74 65 72 6d 73 20 6f 66 20 73 65 72 76 69 63 65 3c 2f 61 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 5f 5f 64 65 76 69 64 65 72 22 3e 26 6e 62 73 70 3b 2f 26 6e 62 73 70 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 64 6f 63 5f 73 65 63 75 72 69 74 79 5f 64 69 73 63 6c 6f 73 75 72 65 22 3e 73 65 63 75 72 69 74 79 20 64 69 73 63 6c 6f 73 75 72 65 3c 2f 61 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 5f 5f 64 65 76 69 64 65 72 22 3e 26 6e 62 73 70 3b 2f 26 6e 62 73 70 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 Data Ascii: span> <a href="/doc_terms_of_service">terms of service</a><span class="footer__devider"> / </span> <a href="/doc_security_disclosure">security disclosure</a> <span class="footer__devider"> / </span>

System Behavior

Analysis Process: xpcproxy PID: 610, Parent PID: 1

General

Start time (UTC):	17:13:09
Start date (UTC):	27/04/2025
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

File Activities

File Opened

File Read

Process Activities

Process Spawned

System Activities

Sysctl Requested

Chronological Activities

Analysis Process: nsurlstoraged PID: 610, Parent PID: 1

General

Start time (UTC):	17:13:09
Start date (UTC):	27/04/2025
Path:	/usr/libexec/nsurlstoraged
Arguments:	/usr/libexec/nsurlstoraged --privileged
File size:	246624 bytes
MD5 hash:	321b0a40e24b45f0af49ba42742b3f64

File Activities

File Opened

File Read

Directory Enumerated

System Activities

Sysctl Requested

Chronological Activities

Analysis Process: mono-sgen32 PID: 615, Parent PID: 537

General

Start time (UTC):	17:13:12
Start date (UTC):	27/04/2025
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	-
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

File Activities

File Read (Anonymous Pipes)

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 615, Parent PID: 537

General

Start time (UTC):	17:13:12
Start date (UTC):	27/04/2025
Path:	/bin/sh
Arguments:	/bin/sh -c curl https://pastebin.com/contact
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

File Activities

File Opened

File Read

File Seeked

Process Activities

Process Overlayed (Exec)

System Activities

Sysctl Requested

Chronological Activities

Analysis Process: curl PID: 615, Parent PID: 537

General

Start time (UTC):	17:13:12
Start date (UTC):	27/04/2025
Path:	/usr/bin/curl
Arguments:	curl https://pastebin.com/contact
File size:	185072 bytes
MD5 hash:	2418204e23e2952e7995f1819a1f78f5

File Activities

File Opened

File Read

File Read (Sockets)

File Written (Anonymous Pipe)

File Written (Socket)

File Seeked

Process Activities

Process Exited

System Activities

Sysctl Requested

Chronological Activities

Analysis Process: xpcproxy PID: 634, Parent PID: 1

General

Start time (UTC):	17:13:42
Start date (UTC):	27/04/2025
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

File Activities

File Opened

Process Activities

Process Spawned

System Activities

Sysctl Requested

Chronological Activities

Analysis Process: eficheck PID: 634, Parent PID: 1

General

Start time (UTC):	17:13:42
Start date (UTC):	27/04/2025
Path:	/usr/libexec/firmwarecheckers/eficheck/eficheck
Arguments:	/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon
File size:	74048 bytes
MD5 hash:	328beb81a2263449258057506bb4987f

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Connections

HTTPS Proxied Packets

System Behavior

Analysis Process: xpcproxy PID: 610, Parent PID: 1

General

File Activities

File Opened

File Read

Process Activities

Process Spawned

System Activities

Sysctl Requested

Chronological Activities

Analysis Process: nsurlstoraged PID: 610, Parent PID: 1

General

File Activities

File Opened

File Read

Directory Enumerated

System Activities

Sysctl Requested

Chronological Activities

Analysis Process: mono-sgen32 PID: 615, Parent PID: 537

General

File Activities

File Read (Anonymous Pipes)