Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

macOS Analysis Report
Jacqueline_Dinsmore.pdf

Overview

General Information

Sample name:Jacqueline_Dinsmore.pdf
Analysis ID:1525189
MD5:02c546cf3968743d318fe66c4f9af5b2
SHA1:d2c564071d69de60469c61624c29acee8a8251df
SHA256:29807f225357227915f9cd05d17def86b35f19ba81dd512c98a52ee82b891662
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false

Signatures

No high impact signatures.

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1525189
Start date and time:2024-10-03 20:44:04 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 57s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultmacfilecookbook.jbs
Analysis system description:Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:10.14
CPU architecture:x86_64
Analysis Mode:default
Sample name:Jacqueline_Dinsmore.pdf
Detection:CLEAN
Classification:clean0.macPDF@0/1@1/0

Warnings

  • Excluded IPs from analysis (whitelisted): 17.253.3.203, 17.253.3.196, 23.34.248.198, 17.253.97.201, 17.253.97.205, 17.36.200.79, 17.253.27.195, 17.253.27.199, 17.253.97.203, 23.58.90.40
  • Excluded domains from analysis (whitelisted): mesu-cdn.apple.com.akadns.net, e11408.d.akamaiedge.net, lcdn-locator-usuqo.apple.com.akadns.net, updates.cdn-apple.com.akadns.net, e673.dsce9.akamaiedge.net, help-ar.apple.com.edgekey.net, crl.apple.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, mesu-cdn.origin-apple.com.akadns.net, lcdn-locator.apple.com.akadns.net, help.origin-apple.com.akadns.net, lcdn-locator.apple.com, mesu.g.aaplimg.com, updates.g.aaplimg.com, itunes.apple.com.edgekey.net, help.apple.com, mesu.apple.com, init.itunes.apple.com, updates.cdn-apple.com, init-cdn.itunes-apple.com.akadns.net
  • VT rate limit hit for: Jacqueline_Dinsmore.pdf

Runtime Messages

Command:open "/Users/bernard/Desktop/Jacqueline_Dinsmore.pdf"
PID:623
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • System is macvm-mojave
  • nsurlstoraged (MD5: 321b0a40e24b45f0af49ba42742b3f64) Arguments: /usr/libexec/nsurlstoraged --privileged
  • open (MD5: 34bd93241fa5d2aee225941b1ca14fa4) Arguments: /usr/bin/open /Users/bernard/Desktop/Jacqueline_Dinsmore.pdf
  • Preview (MD5: 6d42705dd70a79028f5961c87a79b9ce) Arguments: /Applications/Preview.app/Contents/MacOS/Preview
  • eficheck (MD5: 328beb81a2263449258057506bb4987f) Arguments: /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownHTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49351 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49381 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49382 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49383 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49384 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49392 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49393 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49394 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 17.248.199.67
Source: unknownTCP traffic detected without corresponding DNS query: 104.76.101.13
Source: unknownTCP traffic detected without corresponding DNS query: 104.76.101.13
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: h3.apis.apple.map.fastly.net
Source: unknownNetwork traffic detected: HTTP traffic on port 49351 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49348
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49401
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49384
Source: unknownNetwork traffic detected: HTTP traffic on port 49393 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49383
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49382
Source: unknownNetwork traffic detected: HTTP traffic on port 49395 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49381
Source: unknownNetwork traffic detected: HTTP traffic on port 49401 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49384 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49348 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49382 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49398 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49398
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49396
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49351
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49395
Source: unknownNetwork traffic detected: HTTP traffic on port 49394 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49394
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49393
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49392
Source: unknownNetwork traffic detected: HTTP traffic on port 49396 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49392 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49349 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49383 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49381 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49349
Source: unknownHTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49351 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49381 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49382 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49383 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49384 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49392 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49393 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49394 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknownHTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: classification engineClassification label: clean0.macPDF@0/1@1/0
Source: /Applications/Preview.app/Contents/MacOS/Preview (PID: 624)Random device file read: /dev/randomJump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 646)Random device file read: /dev/randomJump to behavior
Source: /Applications/Preview.app/Contents/MacOS/Preview (PID: 624)AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plistJump to behavior
Source: /usr/bin/open (PID: 623)System or server version plist file read: /System/Library/CoreServices/SystemVersion.plistJump to behavior
Source: /Applications/Preview.app/Contents/MacOS/Preview (PID: 624)System or server version plist file read: /System/Library/CoreServices/SystemVersion.plistJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Shell
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


cam-macmac-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
h3.apis.apple.map.fastly.net
151.101.3.6
truefalse
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    104.76.101.13
    		unknownUnited States
    		16625AKAMAI-ASUSfalse
    151.101.3.6
    		h3.apis.apple.map.fastly.netUnited States
    		54113FASTLYUSfalse
    151.101.195.6
    		unknownUnited States
    		54113FASTLYUSfalse

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    104.76.101.13https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bxn--dic%C2%ADesisdeba%C2%ADrin%C2%ADas%C2%AD-6%C2%ADu%C2%ADb.%E2%80%8Bor%C2%ADg%2Fsys%2Fcss%2FvzEOd74Ux6iYa/YWxldGhpYS5oZXJtb3NpbGxvQHdyaS5vcmc=Get hashmaliciousUnknownBrowse
      https://buildsend.com/ws/1.0/viewimage.aspx?c=bs3bElnjM35cIuYS0jC44KF5xlV9G0&i=337660&ct=application/url&f=People%20who%20test%20positive%20or%20were%20exposed&url=https://ecv.microsoft.com/IC2qMWnkhVGet hashmaliciousUnknownBrowse
        iVI0909jHM.dmgGet hashmaliciousAMOS StealerBrowse
          151.101.3.6https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==Get hashmaliciousUnknownBrowse
            https://b3dc9.dynv6.net/en-nz/itunes-gift-card-scamsGet hashmaliciousUnknownBrowse
              https://b3dc9.dynv6.net/en-uz/watchGet hashmaliciousUnknownBrowse
                EACA1218AC7D98866DFE1F45785598942394234D.htmlGet hashmaliciousUnknownBrowse
                  https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bxn--dic%C2%ADesisdeba%C2%ADrin%C2%ADas%C2%AD-6%C2%ADu%C2%ADb.%E2%80%8Bor%C2%ADg%2Fsys%2Fcss%2FvzEOd74Ux6iYa/YWxldGhpYS5oZXJtb3NpbGxvQHdyaS5vcmc=Get hashmaliciousUnknownBrowse
                    https://www.rashakhodro.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWJ6RkxWV3c9JnVpZD1VU0VSMTUwOTIwMjRVMTUwOTE1NDQ=N0123Ninfo@colemanenv.comGet hashmaliciousUnknownBrowse
                      https://topawardpicks.topGet hashmaliciousUnknownBrowse
                        VFtaM6iwOvGet hashmaliciousUnknownBrowse
                          extracted-pkg.ziphttps://fluencydirect-distro.s3.amazonaws.com/releases.macOS/FluencyDirect-11.0.10.40.pkgGet hashmaliciousUnknownBrowse
                            NX76Su3VOrGet hashmaliciousUnknownBrowse
                              151.101.195.6GlobalProtect-6.3.1.pkgGet hashmaliciousUnknownBrowse
                                https://b3dc9.dynv6.net/en-uz/macGet hashmaliciousUnknownBrowse
                                  https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFpWmkQCuyRKVYuXTODipkw1peyOsy7fzch2Qnjjx9TPdQLyq_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOGY47MMsA28ivpkfbUZ4Lg9A-2BpxdwxU5dKnUeajmF4HirYei02RaLjIoVpk4gyUMhgj92hT-2FHMQ8mxdm73E1rDJWG4U3srGJQAD6HJNqRuM2BNyhWi1cyQGPjs9bNnt3sCHX9HQ-2B1vlq1IrWdBpEUzmyiy7qWzbIHuomspNWnTuqZh3GX5k14qG6xYuxyW10TSL-2Fdyl0iPN0SOJtTt8-2FwmWJD-2F8w79oLdqJEekHbPrO-2B0v5UFAy7DfQgXJdU4VdPg-3DGet hashmaliciousUnknownBrowse
                                    EACA1218AC7D98866DFE1F45785598942394234D.htmlGet hashmaliciousUnknownBrowse
                                      http://grifon.info/announce?info_hash=%08%95%AE%D1m%DD%1A%0B%CEo%C0%27%3Af%7B%14sf%3FC&peer_id=-AZ5770-SNhwkI5WcC8E&supportcrypto=1&port=51797&azudp=51797&uploaded=0&downloaded=0&left=243670495&corrupt=0&event=started&numwant=75&no_peer_id=1&compact=1&key=j9C8cT74&azver=3(87.236.16.208)Get hashmaliciousUnknownBrowse
                                        https://lookerstudio.google.com/reporting/d787ae12-bf74-43b9-af2f-d8d57b4065f6/page/RpuBE?s=t1OjWts8lSQGet hashmaliciousUnknownBrowse
                                          https://topawardpicks.topGet hashmaliciousUnknownBrowse
                                            VFtaM6iwOvGet hashmaliciousUnknownBrowse
                                              https://ab5.dultzman.ru/453661207694068nTmWxOZPLYNVYOTMBINCEQSANMABCGVTBFIXRSRIKIYCZTFGet hashmaliciousUnknownBrowse
                                                https://eu2.contabostorage.com/0f057bf4d91340d3ae18d5f31372fa7e:new/document.html#rthurston@democracyforward.orgGet hashmaliciousUnknownBrowse

                                                  Domains

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  h3.apis.apple.map.fastly.netGlobalProtect-6.3.1.pkgGet hashmaliciousUnknownBrowse
                                                  • 151.101.195.6
                                                  https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==Get hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  https://topawardpicks.topGet hashmaliciousUnknownBrowse
                                                  • 151.101.131.6
                                                  https://b3dc9.dynv6.net/en-tj/iphoneGet hashmaliciousUnknownBrowse
                                                  • 151.101.131.6
                                                  https://b3dc9.dynv6.net/en-nz/itunes-gift-card-scamsGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  https://b3dc9.dynv6.net/en-uz/macGet hashmaliciousUnknownBrowse
                                                  • 151.101.195.6
                                                  https://b3dc9.dynv6.net/en-uz/watchGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFpWmkQCuyRKVYuXTODipkw1peyOsy7fzch2Qnjjx9TPdQLyq_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOGY47MMsA28ivpkfbUZ4Lg9A-2BpxdwxU5dKnUeajmF4HirYei02RaLjIoVpk4gyUMhgj92hT-2FHMQ8mxdm73E1rDJWG4U3srGJQAD6HJNqRuM2BNyhWi1cyQGPjs9bNnt3sCHX9HQ-2B1vlq1IrWdBpEUzmyiy7qWzbIHuomspNWnTuqZh3GX5k14qG6xYuxyW10TSL-2Fdyl0iPN0SOJtTt8-2FwmWJD-2F8w79oLdqJEekHbPrO-2B0v5UFAy7DfQgXJdU4VdPg-3DGet hashmaliciousUnknownBrowse
                                                  • 151.101.131.6
                                                  EACA1218AC7D98866DFE1F45785598942394234D.htmlGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  https://www.rashakhodro.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWJ6RkxWV3c9JnVpZD1VU0VSMTUwOTIwMjRVMTUwOTE1NDQ=N0123Ninfo@colemanenv.comGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6

                                                  ASNs

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  FASTLYUS3wtD2jXnxy.exeGet hashmaliciousRedLine, STRRATBrowse
                                                  • 199.232.196.209
                                                  https://www.calameo.com/read/0077804248b46bb5a7c19Get hashmaliciousHtmlDropperBrowse
                                                  • 151.101.66.137
                                                  https://u9313450.ct.sendgrid.net/ls/click?upn=u001.ZfA-2BqTl2mXIVteOCc-2BANg-2BtYQAbYWaU-2BKDDWa611GxHig-2BgElXnUy1eAOeNoTI9ToS9WuAxRUdR21lAIsTPE0g-3D-3Dd8kL_bf4JG6rVotaFp8XsYJMcbHq5p6ju5xz6OkJFWJQMhev1YsQkFFV7zJr96yz5256BnjjwP-2FrVNKeomJDukUeXnM2-2FUbrpvrFpNFdN8Hxo-2B8NA1G5PPzQiWnVnq4RPrf4MxseS-2FjeJBGe3OOYXNXxDmns1gfYeFwrIC6tXtQ3KJv23PKABAyqpBB-2FnsXl7BropPMbry14s3UYpaAeg1aJih0NQeQpVSOm5MBDYOXEHCyJCtLrpoW6SuZeJlGeeWyYAhbotSAdFsjwH5JN5fjIYp-2BMzHm9VPykPI2oeKmW91mIcQqO5YJ1dVv925b7N0T1vGet hashmaliciousUnknownBrowse
                                                  • 151.101.65.195
                                                  http://reviewnewdocuments.wordpress.com/Get hashmaliciousUnknownBrowse
                                                  • 151.101.129.140
                                                  https://links.truthsocial.com/link/113203933939427541Get hashmaliciousUnknownBrowse
                                                  • 151.101.194.137
                                                  Notaire-document.htmlGet hashmaliciousUnknownBrowse
                                                  • 151.101.66.137
                                                  voicemaiVOIP_1002202474911222280000000082autoresponse.htmGet hashmaliciousHTMLPhisherBrowse
                                                  • 151.101.66.137
                                                  https://trello.com/c/HA4sCE32Get hashmaliciousHTMLPhisherBrowse
                                                  • 199.232.188.157
                                                  phish_alert_sp2_2.0.0.0.emlGet hashmaliciousPhisherBrowse
                                                  • 151.101.194.137
                                                  http://arcor.cfdGet hashmaliciousHTMLPhisherBrowse
                                                  • 151.101.2.137
                                                  AKAMAI-ASUSc84f2f8df965727bcdcc4de6beecf70c960ef7c885e77.dllGet hashmaliciousLummaCBrowse
                                                  • 104.102.49.254
                                                  75c6a7ee973b556a2a3914a9e4b18bc019636e70fb6f4c2f8c6f7da0af050cbb.7zGet hashmaliciousUnknownBrowse
                                                  • 23.201.253.231
                                                  0a839761915d.exeGet hashmaliciousLummaCBrowse
                                                  • 104.102.49.254
                                                  Activator by URKE v2.5.exeGet hashmaliciousLummaCBrowse
                                                  • 104.102.49.254
                                                  file.exeGet hashmaliciousLummaC, VidarBrowse
                                                  • 104.102.49.254
                                                  phish_alert_sp2_2.0.0.0.emlGet hashmaliciousPhisherBrowse
                                                  • 184.28.90.27
                                                  http://arcor.cfdGet hashmaliciousHTMLPhisherBrowse
                                                  • 104.78.188.188
                                                  Message_2484922.emlGet hashmaliciousUnknownBrowse
                                                  • 184.28.90.27
                                                  https://terryatchison-my.sharepoint.com/:f:/g/personal/terry_terryatchison_com_au/ElPLLTBYg_xBi3psE6F6HW0BDiAPLHOUdwoTRpPTGgsocg?e=hlVHMOGet hashmaliciousUnknownBrowse
                                                  • 23.38.98.96
                                                  file.exeGet hashmaliciousVidarBrowse
                                                  • 104.102.49.254
                                                  FASTLYUS3wtD2jXnxy.exeGet hashmaliciousRedLine, STRRATBrowse
                                                  • 199.232.196.209
                                                  https://www.calameo.com/read/0077804248b46bb5a7c19Get hashmaliciousHtmlDropperBrowse
                                                  • 151.101.66.137
                                                  https://u9313450.ct.sendgrid.net/ls/click?upn=u001.ZfA-2BqTl2mXIVteOCc-2BANg-2BtYQAbYWaU-2BKDDWa611GxHig-2BgElXnUy1eAOeNoTI9ToS9WuAxRUdR21lAIsTPE0g-3D-3Dd8kL_bf4JG6rVotaFp8XsYJMcbHq5p6ju5xz6OkJFWJQMhev1YsQkFFV7zJr96yz5256BnjjwP-2FrVNKeomJDukUeXnM2-2FUbrpvrFpNFdN8Hxo-2B8NA1G5PPzQiWnVnq4RPrf4MxseS-2FjeJBGe3OOYXNXxDmns1gfYeFwrIC6tXtQ3KJv23PKABAyqpBB-2FnsXl7BropPMbry14s3UYpaAeg1aJih0NQeQpVSOm5MBDYOXEHCyJCtLrpoW6SuZeJlGeeWyYAhbotSAdFsjwH5JN5fjIYp-2BMzHm9VPykPI2oeKmW91mIcQqO5YJ1dVv925b7N0T1vGet hashmaliciousUnknownBrowse
                                                  • 151.101.65.195
                                                  http://reviewnewdocuments.wordpress.com/Get hashmaliciousUnknownBrowse
                                                  • 151.101.129.140
                                                  https://links.truthsocial.com/link/113203933939427541Get hashmaliciousUnknownBrowse
                                                  • 151.101.194.137
                                                  Notaire-document.htmlGet hashmaliciousUnknownBrowse
                                                  • 151.101.66.137
                                                  voicemaiVOIP_1002202474911222280000000082autoresponse.htmGet hashmaliciousHTMLPhisherBrowse
                                                  • 151.101.66.137
                                                  https://trello.com/c/HA4sCE32Get hashmaliciousHTMLPhisherBrowse
                                                  • 199.232.188.157
                                                  phish_alert_sp2_2.0.0.0.emlGet hashmaliciousPhisherBrowse
                                                  • 151.101.194.137
                                                  http://arcor.cfdGet hashmaliciousHTMLPhisherBrowse
                                                  • 151.101.2.137

                                                  JA3 Fingerprints

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  5c118da645babe52f060d0754256a73cGlobalProtect-6.3.1.pkgGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  • 151.101.195.6
                                                  https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==Get hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  • 151.101.195.6
                                                  https://topawardpicks.topGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  • 151.101.195.6
                                                  https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFpWmkQCuyRKVYuXTODipkw1peyOsy7fzch2Qnjjx9TPdQLyq_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOGY47MMsA28ivpkfbUZ4Lg9A-2BpxdwxU5dKnUeajmF4HirYei02RaLjIoVpk4gyUMhgj92hT-2FHMQ8mxdm73E1rDJWG4U3srGJQAD6HJNqRuM2BNyhWi1cyQGPjs9bNnt3sCHX9HQ-2B1vlq1IrWdBpEUzmyiy7qWzbIHuomspNWnTuqZh3GX5k14qG6xYuxyW10TSL-2Fdyl0iPN0SOJtTt8-2FwmWJD-2F8w79oLdqJEekHbPrO-2B0v5UFAy7DfQgXJdU4VdPg-3DGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  • 151.101.195.6
                                                  EACA1218AC7D98866DFE1F45785598942394234D.htmlGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  • 151.101.195.6
                                                  http://grifon.info/announce?info_hash=%08%95%AE%D1m%DD%1A%0B%CEo%C0%27%3Af%7B%14sf%3FC&peer_id=-AZ5770-SNhwkI5WcC8E&supportcrypto=1&port=51797&azudp=51797&uploaded=0&downloaded=0&left=243670495&corrupt=0&event=started&numwant=75&no_peer_id=1&compact=1&key=j9C8cT74&azver=3(87.236.16.208)Get hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  • 151.101.195.6
                                                  https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bxn--dic%C2%ADesisdeba%C2%ADrin%C2%ADas%C2%AD-6%C2%ADu%C2%ADb.%E2%80%8Bor%C2%ADg%2Fsys%2Fcss%2FvzEOd74Ux6iYa/YWxldGhpYS5oZXJtb3NpbGxvQHdyaS5vcmc=Get hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  • 151.101.195.6
                                                  https://www.rashakhodro.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWJ6RkxWV3c9JnVpZD1VU0VSMTUwOTIwMjRVMTUwOTE1NDQ=N0123Ninfo@colemanenv.comGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  • 151.101.195.6
                                                  https://lookerstudio.google.com/reporting/d787ae12-bf74-43b9-af2f-d8d57b4065f6/page/RpuBE?s=t1OjWts8lSQGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  • 151.101.195.6
                                                  https://topawardpicks.topGet hashmaliciousUnknownBrowse
                                                  • 151.101.3.6
                                                  • 151.101.195.6

                                                  Dropped Files

                                                  ⊘No context

                                                  Created / dropped Files

                                                  /dev/null

                                                  Download File
                                                  Process:/Applications/Preview.app/Contents/MacOS/Preview
                                                  File Type:ASCII text, with very long lines (412)
                                                  Category:dropped
                                                  Size (bytes):686
                                                  Entropy (8bit):5.192434293895196
                                                  Encrypted:false
                                                  SSDEEP:12:GJjPXrNfKtrPtXhF4FSy7kf9UoyFf9UXQzUQljleVKsh:GhxuzBhF4FD7kFAFTxlAVr
                                                  MD5:6E7775C290DA86E35382620E87816345
                                                  SHA1:0E760117C61C5E40ADC3E4093992BA10B94BC0B3
                                                  SHA-256:74CF23EFBA9475D8E909BA614D3A5FC4A103D19C1C36F64759C06359CC536FDA
                                                  SHA-512:D9125AC618E41392B0DF3B1B5FE6EAE519A6C3B8D1AE74BF55B0A713207A057FBB19CA9F6C3E7B1FCD74A8657E276F242CD47E795F12FC20316B8D4783C8BB20
                                                  Malicious:false
                                                  Reputation:low
                                                  Preview:2024-10-03 13:45:13.569 Preview[624:5026] ApplePersistence=NO.2024-10-03 13:45:14.471 Preview[624:5026] WARNING: The SplitView is not layer-backed, but trying to use overlay sidebars.. implicitly layer-backing for now. Please file a radar against this app if you see this..objc[624]: Class FIFinderSyncExtensionHost is implemented in both /System/Library/PrivateFrameworks/FinderKit.framework/Versions/A/FinderKit (0x7fffacd91210) and /System/Library/PrivateFrameworks/FileProvider.framework/OverrideBundles/FinderSyncCollaborationFileProviderOverride.bundle/Contents/MacOS/FinderSyncCollaborationFileProviderOverride (0x10fa49dc8). One of the two will be used. Which one is undefined..

                                                  Static File Info

                                                  General

                                                  File type:PDF document, version 1.4, 0 pages
                                                  Entropy (8bit):7.723930723540299
                                                  TrID:
                                                  • Adobe Portable Document Format (5005/1) 100.00%
                                                  File name:Jacqueline_Dinsmore.pdf
                                                  File size:24'425 bytes
                                                  MD5:02c546cf3968743d318fe66c4f9af5b2
                                                  SHA1:d2c564071d69de60469c61624c29acee8a8251df
                                                  SHA256:29807f225357227915f9cd05d17def86b35f19ba81dd512c98a52ee82b891662
                                                  SHA512:149cded252d50c3a2e564e5541e676ae09c88b77823c574f122552b43f971dd3848ff1926fd629b8cd3c7605de8e5ad658a3b49648a07a52ebd2e9be99e44f5e
                                                  SSDEEP:384:v84e677XeYl7j2vQ6/bV9yMc+kxz3bCUSvIIh1u/zYRnayDB4uACUSy:v8JsTeYl67/b2j++sIIh1+YRayiN
                                                  TLSH:28B29F69E8D81C4DE8E3D736B5B5391E443DF1138AE4AA9170320B067918F946D33AAF
                                                  File Content Preview:%PDF-1.4.1 0 obj.<<./Title (..)./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...6)./Producer (...Q.t. .4...8...7)./CreationDate (D:20241003164712+02'00').>>.endobj.3 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>>.endo

                                                  Static PDF Info

                                                  General

                                                  Header:%PDF-1.4
                                                  Total Entropy:7.723931
                                                  Total Bytes:24425
                                                  Stream Entropy:7.925023
                                                  Stream Bytes:19948
                                                  Entropy outside Streams:5.159128
                                                  Bytes outside Streams:4477
                                                  Number of EOF found:1
                                                  Bytes after EOF:

                                                  Keywords Statistics

                                                  NameCount
                                                  obj32
                                                  endobj32
                                                  stream7
                                                  endstream7
                                                  xref1
                                                  trailer1
                                                  startxref1
                                                  /Page1
                                                  /Encrypt0
                                                  /ObjStm0
                                                  /URI0
                                                  /JS0
                                                  /JavaScript0
                                                  /AA0
                                                  /OpenAction0
                                                  /AcroForm0
                                                  /JBIG2Decode0
                                                  /RichMedia0
                                                  /Launch0
                                                  /EmbeddedFile0

                                                  Image Streams

                                                  IDDHASHMD5Preview
                                                  62000307161a01000c5c672eee1dd3277b52449864c04bb69
                                                  800000000000000007770adc8629bda31a7e109b7824bb9c3

                                                  Network Behavior

                                                  Network Port Distribution

                                                  TCP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Oct 3, 2024 20:45:07.502757072 CEST49351443192.168.11.12151.101.195.6
                                                  Oct 3, 2024 20:45:07.507560968 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.507761955 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.507827044 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.508121014 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.508471012 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.549818039 CEST44349349151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.549905062 CEST44349349151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.550668001 CEST49349443192.168.11.12151.101.195.6
                                                  Oct 3, 2024 20:45:07.598086119 CEST44349351151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.599069118 CEST49351443192.168.11.12151.101.195.6
                                                  Oct 3, 2024 20:45:07.602483034 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.602722883 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.602979898 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.602998018 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.603010893 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.603565931 CEST49351443192.168.11.12151.101.195.6
                                                  Oct 3, 2024 20:45:07.603610992 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.603635073 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.604490995 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.604490995 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.605117083 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.609781981 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.609811068 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.610583067 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.610583067 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.616368055 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.616396904 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.617027044 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.617479086 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.623241901 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.623274088 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.624084949 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.624496937 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.629852057 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.629889965 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.630892038 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.631386042 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.636374950 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.636440992 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.637198925 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.637339115 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.643177986 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.643233061 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.644376040 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.644613028 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.649909973 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.649982929 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.650661945 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.650758982 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.698148012 CEST44349351151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.699137926 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.699240923 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.699373007 CEST44349351151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.699489117 CEST44349351151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.699557066 CEST44349351151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.699668884 CEST44349351151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.699724913 CEST44349351151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.702545881 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.702567101 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.702629089 CEST49351443192.168.11.12151.101.195.6
                                                  Oct 3, 2024 20:45:07.702629089 CEST49351443192.168.11.12151.101.195.6
                                                  Oct 3, 2024 20:45:07.702672005 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.702712059 CEST49351443192.168.11.12151.101.195.6
                                                  Oct 3, 2024 20:45:07.702919006 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.703177929 CEST49351443192.168.11.12151.101.195.6
                                                  Oct 3, 2024 20:45:07.703552008 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.703826904 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.709094048 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:07.710134983 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:07.711016893 CEST49351443192.168.11.12151.101.195.6
                                                  Oct 3, 2024 20:45:07.805641890 CEST44349351151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.805720091 CEST44349351151.101.195.6192.168.11.12
                                                  Oct 3, 2024 20:45:07.806617022 CEST49351443192.168.11.12151.101.195.6
                                                  Oct 3, 2024 20:45:08.114694118 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:08.208801985 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:09.376574993 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:09.381747961 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:09.470895052 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:09.471796036 CEST49348443192.168.11.1217.248.199.67
                                                  Oct 3, 2024 20:45:09.475959063 CEST4434934817.248.199.67192.168.11.12
                                                  Oct 3, 2024 20:45:41.221081018 CEST49381443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.221240044 CEST44349381151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:41.222009897 CEST49381443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.231127024 CEST49381443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.231249094 CEST44349381151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:41.466799974 CEST44349381151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:41.467650890 CEST49381443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.467652082 CEST49381443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.800848007 CEST49381443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.801034927 CEST44349381151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:41.801450968 CEST44349381151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:41.801631927 CEST49381443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.802036047 CEST49381443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.862555981 CEST49382443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.862689972 CEST44349382151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:41.863451958 CEST49382443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.869205952 CEST49382443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:41.869307041 CEST44349382151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.086541891 CEST44349382151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.087444067 CEST49382443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.087444067 CEST49382443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.102118015 CEST49382443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.102317095 CEST44349382151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.102747917 CEST44349382151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.103207111 CEST49382443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.103260994 CEST49382443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.175354958 CEST49383443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.175513029 CEST44349383151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.176203966 CEST49383443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.177165031 CEST49383443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.177248001 CEST44349383151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.380158901 CEST44349383151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.381211996 CEST49383443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.381211996 CEST49383443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.395076990 CEST49383443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.395222902 CEST44349383151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.395513058 CEST44349383151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.396130085 CEST49383443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.396275043 CEST49383443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.447283030 CEST49384443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.447441101 CEST44349384151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.448339939 CEST49384443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.459888935 CEST49384443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.460011005 CEST44349384151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.677143097 CEST44349384151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.678308964 CEST49384443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.678308964 CEST49384443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.701940060 CEST49384443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.702163935 CEST44349384151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.702738047 CEST49384443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:45:42.702800035 CEST44349384151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:45:42.703350067 CEST49384443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:05.766094923 CEST4934480192.168.11.12104.76.101.13
                                                  Oct 3, 2024 20:46:05.860744953 CEST8049344104.76.101.13192.168.11.12
                                                  Oct 3, 2024 20:46:05.861463070 CEST4934480192.168.11.12104.76.101.13
                                                  Oct 3, 2024 20:46:23.417032957 CEST49392443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.417192936 CEST44349392151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:23.418138981 CEST49392443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.418781996 CEST49392443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.418879986 CEST44349392151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:23.626631975 CEST44349392151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:23.627619028 CEST49392443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.627619028 CEST49392443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.636154890 CEST49392443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.636482954 CEST44349392151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:23.637151957 CEST49392443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.666076899 CEST49393443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.666234016 CEST44349393151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:23.667118073 CEST49393443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.669646025 CEST49393443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.669768095 CEST44349393151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:23.879239082 CEST44349393151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:23.880110979 CEST49393443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.880229950 CEST49393443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.892438889 CEST49393443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.892774105 CEST44349393151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:23.893421888 CEST49393443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.893495083 CEST44349393151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:23.894084930 CEST49393443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.925043106 CEST49394443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.925200939 CEST44349394151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:23.926018953 CEST49394443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.927103043 CEST49394443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:23.927221060 CEST44349394151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:24.125005960 CEST44349394151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:24.125849009 CEST49394443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.125849009 CEST49394443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.131783009 CEST49394443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.131922007 CEST44349394151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:24.132163048 CEST44349394151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:24.132693052 CEST49394443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.132949114 CEST49394443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.147746086 CEST49395443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.147805929 CEST44349395151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:24.148726940 CEST49395443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.149601936 CEST49395443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.149665117 CEST44349395151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:24.351336002 CEST44349395151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:24.352286100 CEST49395443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.352286100 CEST49395443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.359802008 CEST49395443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:24.360089064 CEST44349395151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:24.360697985 CEST49395443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.422388077 CEST49396443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.422564983 CEST44349396151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:45.423397064 CEST49396443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.426162004 CEST49396443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.426307917 CEST44349396151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:45.665993929 CEST44349396151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:45.666919947 CEST49396443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.666919947 CEST49396443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.697381020 CEST49396443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.697674990 CEST44349396151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:45.698246956 CEST44349396151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:45.698245049 CEST49396443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.698836088 CEST49396443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.842804909 CEST49398443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.842983961 CEST44349398151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:45.843852043 CEST49398443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.844796896 CEST49398443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:45.844926119 CEST44349398151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:46.051387072 CEST44349398151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:46.052217960 CEST49398443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:46.052310944 CEST49398443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:46.060295105 CEST49398443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:46.060422897 CEST44349398151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:46.060698032 CEST44349398151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:46.061135054 CEST49398443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:46.061435938 CEST49398443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:46.899003983 CEST49401443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:46.899162054 CEST44349401151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:46.900314093 CEST49401443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:46.901438951 CEST49401443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:46.901557922 CEST44349401151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:47.106925011 CEST44349401151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:47.107763052 CEST49401443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:47.107763052 CEST49401443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:47.113481998 CEST49401443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:47.113626957 CEST44349401151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:47.113910913 CEST44349401151.101.3.6192.168.11.12
                                                  Oct 3, 2024 20:46:47.114443064 CEST49401443192.168.11.12151.101.3.6
                                                  Oct 3, 2024 20:46:47.114484072 CEST49401443192.168.11.12151.101.3.6

                                                  UDP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Oct 3, 2024 20:45:29.415402889 CEST53592611.1.1.1192.168.11.12
                                                  Oct 3, 2024 20:46:23.316263914 CEST5787853192.168.11.121.1.1.1
                                                  Oct 3, 2024 20:46:23.411510944 CEST53578781.1.1.1192.168.11.12

                                                  DNS Queries

                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                  Oct 3, 2024 20:46:23.316263914 CEST192.168.11.121.1.1.10x62b9Standard query (0)h3.apis.apple.map.fastly.netA (IP address)IN (0x0001)false

                                                  DNS Answers

                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                  Oct 3, 2024 20:46:23.411510944 CEST1.1.1.1192.168.11.120x62b9No error (0)h3.apis.apple.map.fastly.net151.101.3.6A (IP address)IN (0x0001)false
                                                  Oct 3, 2024 20:46:23.411510944 CEST1.1.1.1192.168.11.120x62b9No error (0)h3.apis.apple.map.fastly.net151.101.195.6A (IP address)IN (0x0001)false
                                                  Oct 3, 2024 20:46:23.411510944 CEST1.1.1.1192.168.11.120x62b9No error (0)h3.apis.apple.map.fastly.net151.101.67.6A (IP address)IN (0x0001)false
                                                  Oct 3, 2024 20:46:23.411510944 CEST1.1.1.1192.168.11.120x62b9No error (0)h3.apis.apple.map.fastly.net151.101.131.6A (IP address)IN (0x0001)false

                                                  HTTPS Connections

                                                  TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                  Oct 3, 2024 20:45:07.699557066 CEST151.101.195.6443192.168.11.1249351CN=bag.itunes.apple.com, O=Apple Inc., L=Cupertino, ST=California, C=US, SERIALNUMBER=C0806592, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=USCN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USThu Sep 26 15:47:44 CEST 2024 Wed Apr 29 14:54:50 CEST 2020Thu Dec 19 19:00:57 CET 2024 Thu Apr 11 01:59:59 CEST 2030771,49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-23-13-5-13172-18-16-11-10,29-23-24-25,05c118da645babe52f060d0754256a73c
                                                  CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=USCN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USWed Apr 29 14:54:50 CEST 2020Thu Apr 11 01:59:59 CEST 2030

                                                  System Behavior

                                                  General

                                                  Start time (UTC):18:45:06
                                                  Start date (UTC):03/10/2024
                                                  Path:/usr/libexec/xpcproxy
                                                  Arguments:-
                                                  File size:44048 bytes
                                                  MD5 hash:4764d9eafe6b7dac23253a9f8b7f73d6

                                                  Chronological Activities

                                                  General

                                                  Start time (UTC):18:45:06
                                                  Start date (UTC):03/10/2024
                                                  Path:/usr/libexec/nsurlstoraged
                                                  Arguments:/usr/libexec/nsurlstoraged --privileged
                                                  File size:246624 bytes
                                                  MD5 hash:321b0a40e24b45f0af49ba42742b3f64

                                                  Chronological Activities

                                                  General

                                                  Start time (UTC):18:45:12
                                                  Start date (UTC):03/10/2024
                                                  Path:/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
                                                  Arguments:-
                                                  File size:3722408 bytes
                                                  MD5 hash:8910349f44a940d8d79318367855b236

                                                  Chronological Activities

                                                  General

                                                  Start time (UTC):18:45:12
                                                  Start date (UTC):03/10/2024
                                                  Path:/usr/bin/open
                                                  Arguments:/usr/bin/open /Users/bernard/Desktop/Jacqueline_Dinsmore.pdf
                                                  File size:105952 bytes
                                                  MD5 hash:34bd93241fa5d2aee225941b1ca14fa4

                                                  Chronological Activities

                                                  General

                                                  Start time (UTC):18:45:12
                                                  Start date (UTC):03/10/2024
                                                  Path:/usr/libexec/xpcproxy
                                                  Arguments:-
                                                  File size:44048 bytes
                                                  MD5 hash:4764d9eafe6b7dac23253a9f8b7f73d6

                                                  Chronological Activities

                                                  General

                                                  Start time (UTC):18:45:12
                                                  Start date (UTC):03/10/2024
                                                  Path:/Applications/Preview.app/Contents/MacOS/Preview
                                                  Arguments:/Applications/Preview.app/Contents/MacOS/Preview
                                                  File size:2730496 bytes
                                                  MD5 hash:6d42705dd70a79028f5961c87a79b9ce

                                                  Chronological Activities

                                                  General

                                                  Start time (UTC):18:46:43
                                                  Start date (UTC):03/10/2024
                                                  Path:/usr/libexec/xpcproxy
                                                  Arguments:-
                                                  File size:44048 bytes
                                                  MD5 hash:4764d9eafe6b7dac23253a9f8b7f73d6

                                                  Chronological Activities

                                                  General

                                                  Start time (UTC):18:46:43
                                                  Start date (UTC):03/10/2024
                                                  Path:/usr/libexec/firmwarecheckers/eficheck/eficheck
                                                  Arguments:/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon
                                                  File size:74048 bytes
                                                  MD5 hash:328beb81a2263449258057506bb4987f

                                                  Chronological Activities