Edit tour
Windows
Analysis Report
20Listen.eml
Overview
General Information
| Sample name: | 20Listen.emlrenamed because original name is a hash value |
| Original sample name: | Missed__Caller.Ringer-Transcript....%3E%3E%3E%3E%3E%3EID_-eef1da413490032ee87f60ea1a5f1d84,%20Download%20to%20Listen.eml |
| Analysis ID: | 1532856 |
| MD5: | 1162a9ab755e7e125f28b18063c78fcd |
| SHA1: | e76222078fde8083637c12e1cb3d665bacc4e51c |
| SHA256: | 05bf04eb228e30647194652f82d426fef36e85c7b595a44bdcc2b2e0aa4bc58f |
| Infos: |   |
 | |
Detection
HTMLPhisher
| Score: | 56 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Yara detected HtmlPhish73
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory
Classification
- System is w10x64_ra
OUTLOOK.EXE (PID: 7048 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\OUTLO OK.EXE" /e ml "C:\Use rs\user\De sktop\20Li sten.eml" MD5: 91A5292942864110ED734005B7E005C0) 
ai.exe (PID: 7136 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \root\vfs\ ProgramFil esCommonX6 4\Microsof t Shared\O ffice16\ai .exe" "694 1A605-7302 -4BD6-BF5C -30601A8A9 03D" "8406 B14A-7017- 4EA4-9ED7- 6830C8DE33 65" "7048" "C:\Progr am Files ( x86)\Micro soft Offic e\Root\Off ice16\OUTL OOK.EXE" " WordCombin edFloatieL reOnline.o nnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD) 
chrome.exe (PID: 5492 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t C:\Users \user\AppD ata\Local\ Microsoft\ Windows\IN etCache\Co ntent.Outl ook\68W6OD 7A\Listen_ Now_REC(Ta ra.brown). html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 1444 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2200 --fi eld-trial- handle=195 6,i,183873 5476330692 8465,23466 4923182356 5567,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 1220 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t C:\Users \user\AppD ata\Local\ Microsoft\ Windows\IN etCache\Co ntent.Outl ook\68W6OD 7A\Listen_ Now_REC(Ta ra.brown). html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 4008 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2152 --fi eld-trial- handle=190 8,i,146958 8672593538 9924,20688 3108574070 3090,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HtmlPhish_73 | Yara detected HtmlPhish_73 | Joe Security | ||
| JoeSecurity_HtmlPhish_73 | Yara detected HtmlPhish_73 | Joe Security |
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: frack113: | ||
| Source: | Author: X__Junior (Nextron Systems): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | SlashNext: | ||
Phishing | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window found: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 Registry Run Keys / Startup Folder | 1 DLL Side-Loading | 1 Process Injection | LSASS Memory | 1 File and Directory Discovery | Remote Desktop Protocol | Data from Removable Media | 4 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 Registry Run Keys / Startup Folder | 1 DLL Side-Loading | Security Account Manager | 13 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 5 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | Binary Padding | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 3 Ingress Tool Transfer | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse | ||
| 3% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | SlashNext | Credential Stealing type: Phishing & Social Engineering | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 1% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| mira-tmc.tm-4.office.com | 52.123.243.192 | true | false |
| unknown |
| www.iprende.com | 194.53.148.86 | true | false |
| unknown |
| www.google.com | 142.250.186.36 | true | false |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.186.36 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 194.53.148.86 | www.iprende.com | Spain | 210181 | OPEN6HOSTINGES | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 52.123.243.192 | mira-tmc.tm-4.office.com | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false |
| IP |
|---|
| 192.168.2.16 |
| 127.0.0.1 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1532856 |
| Start date and time: | 2024-10-14 02:05:23 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 42s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 18 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 20Listen.emlrenamed because original name is a hash value |
| Original Sample Name: | Missed__Caller.Ringer-Transcript....%3E%3E%3E%3E%3E%3EID_-eef1da413490032ee87f60ea1a5f1d84,%20Download%20to%20Listen.eml |
| Detection: | MAL |
| Classification: | mal56.phis.winEML@30/25@4/6 |
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 52.109.28.46, 13.70.79.200, 20.189.173.14, 52.109.28.48, 142.250.186.67, 142.250.186.78, 64.233.184.84, 34.104.35.123, 52.109.76.144, 52.109.89.119, 142.250.186.35, 142.250.184.206, 52.109.68.130
- Excluded domains from analysis (whitelisted): osiprod-uks-bronze-azsc-000.uksouth.cloudapp.azure.com, neu-azsc-000.odc.officeapps.live.com, odc.officeapps.live.com, slscr.update.microsoft.com, europe.odcsm1.live.com.akadns.net, clientservices.googleapis.com, mobile.events.data.microsoft.com, osiprod-weu-bronze-azsc-000.westeurope.cloudapp.azure.com, clients2.google.com, update.googleapis.com, officeclient.microsoft.com, osiprod-neu-bronze-azsc-000.northeurope.cloudapp.azure.com, clients1.google.com, ecs.office.com, onedscolprdaue01.australiaeast.cloudapp.azure.com, fs.microsoft.com, onedscolprdwus13.westus.cloudapp.azure.com, accounts.google.com, prod.configsvc1.live.com.akadns.net, frc-azsc-000.odc.officeapps.live.com, weu-azsc-000.odc.officeapps.live.com, fe3cr.delivery.mp.microsoft.com, uks-azsc-000.odc.officeapps.live.com, edgedl.me.gvt1.com, config.officeapps.live.com, osiprod-frc-bronze-azsc-000.francecentral.cloudapp.azure.com, ecs.office.trafficmanager.net, clients.l.google.com, europe.configsvc1.live
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtSetValueKey calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
⊘No simulations
| Input | Output |
|---|---|
| URL: Email Model: jbxai | {
"brands":[],
"text":"You don't often get email from call_service-playback-automatedrecvoic.notecaab961e40336b3bcf9c777e6742a98689809bb2f2526a528987656789876567898764f4-mail.protection.outlook.commmmx.box615bfe9fc949fcc54392c416c2fe0a-a8d90738fc1ae1d2fe925d1623e943a0mx.01support@t1dpartnership.com.au. Learn why this is important",
"contains_trigger_text":true,
"trigger_text":"You don't often get email from call_service-playback-automatedrecvoic.notecaab961e40336b3bcf9c777e6742a98689809bb2f2526a528987656789876567898764f4-mail.protection.outlook.commmmx.box615bfe9fc949fcc54392c416c2fe0a-a8d90738fc1ae1d2fe925d1623e943a0mx.01support@t1dpartnership.com.au. Learn why this is important",
"prominent_button_name":"Learn why this is important",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false} |
 |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | HTMLPhisher | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Captcha Phish | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| mira-tmc.tm-4.office.com | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| OPEN6HOSTINGES | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Captcha Phish | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | LummaC | Browse |
| |
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
|
⊘No context
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 231348 |
| Entropy (8bit): | 4.386345664659467 |
| Encrypted: | false |
| SSDEEP: | 1536:o+YLqIgscCz1js9jxgs0vNcAz79ysQqt2fTqJjqoQU0rcm0FvsJYyRv6pI8cI455:0NgWgfgxmiGu20qoQfrt0FvicfU3WYs4 |
| MD5: | D158AABD1C682ABD657676C81839760A |
| SHA1: | FB752C951EF710A67B8238F95719FCF371C15822 |
| SHA-256: | 44D911546C2688DC098C8FDE3A1492AF4E92B57CCEE1596F05611254056329DD |
| SHA-512: | B2AB0C41016AD264EB1B474E9D7A49C348F9B0073038BDFE5B7B1318D751751EB475AC7A62A337E7EB21B274D95EE603B1A8D78FBB93374EEB033069B77E59E2 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\81118F54-2AB5-474E-AAA2-811828A5F714
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 178099 |
| Entropy (8bit): | 5.290527899516943 |
| Encrypted: | false |
| SSDEEP: | 1536:3i2XfRAqcbH41gwEwLe7HW8bM/o/NMdcAZl1p5ihs7EXXDEAD2Odago:CCe7HW8bM/o/TXgk9o |
| MD5: | 84208914CEA92FD5098375A60A418DCB |
| SHA1: | A75A2407616EE7DA908A829B0CCCDE8FD5B5D304 |
| SHA-256: | 4AC5E269EC0D8B9C8F82B1084644F54A576D3E9FE9AE77D4AB00629766F2512D |
| SHA-512: | DA0FDD0A25D57BA0DD958F207B5831924D93DF4E39E8ED8B578E5F26667CC38C56276B7087FBE5F0C81381CEB3AA22ED4DA3CD8E15194BC9B8F70DF9B88DF487 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32768 |
| Entropy (8bit): | 0.04472433142578256 |
| Encrypted: | false |
| SSDEEP: | 3:GtlxtjlNdO6ffDlI/ltlxtjlNdO6ffD/l7R9//8l1lvlll1lllwlvlllglbelDbj:GttdXDilttdXDtF9X01PH4l942wU |
| MD5: | 9CA9838B81346870CA4CA3D23528C4B4 |
| SHA1: | 2E40E78A1C64885F4ED38FEB48F1488BA0D9A15E |
| SHA-256: | DCA75D49337510C4FC520497D9D74DC5125BBF0A08D35D8736FB78C5A5E21781 |
| SHA-512: | 7F97A6759EAD87C598DBA4855D0AA91ECB2B46AF44FCD29D7D7E18DE1B58F0E1A78BEA3FB3984F1372FED05425BCBA3D533347625269DEE450A2F590B2A0DD09 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 49472 |
| Entropy (8bit): | 0.48296676217662327 |
| Encrypted: | false |
| SSDEEP: | 48:RsYQ1ubzUll7DYMzzO8VFDYMsojwsBO8VFDYML:Rw6All44jVGToHjVGC |
| MD5: | AA0781F759261C0AA2E73EA394F4606E |
| SHA1: | 5FE639B3AD16A93DB768F7C9F05D2D152CE002F0 |
| SHA-256: | 02634317E649D6B5D87CE2B39EA798FB79B8BF64DDD3CEFFDAD61AF09BFFAA7D |
| SHA-512: | 05E261668784C64EE16B29431FE5CD97B0B83C83F1F1C0E7DDFB7DDD3BB6692CC01F57742F5938EF8D8F28C45658A080E49FA9B764A1294C04A9A978D4B7B245 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\68W6OD7A\Listen_Now_REC(Tara.brown) (002).html 
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5331 |
| Entropy (8bit): | 4.487787364106538 |
| Encrypted: | false |
| SSDEEP: | 48:KBjjReqHZDICRergqsVDncvBhWxnOvDxN7IglOcMSP1tZ2d1mU1o41Tgf1T61u5y:KjxFBtVDs9FwV8DJ9/Svxzf |
| MD5: | 5D6363398F012EADBD7836162077ACE4 |
| SHA1: | 92DA37EDECAB7EB95232C4E7E753EF1AAACD6FE9 |
| SHA-256: | 732885ED085B25EFA916DD22DA4D10E4B6506BD4A2F8F77F70B5DDC1A556BA1C |
| SHA-512: | 8F208B7252B7735D7B26370B07515496FB92678D914433D8BD67FB73072A4F6CDA03F4FCEE337666A1F8E00FEC303C434E6DA53D613A24D757B92DA0BAFF8573 |
| Malicious: | true |
| Yara Hits: |
|
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\68W6OD7A\Listen_Now_REC(Tara.brown) (002).html:Zone.Identifier
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:gAWY3n:qY3n |
| MD5: | FBCCF14D504B7B2DBCB5A5BDA75BD93B |
| SHA1: | D59FC84CDD5217C6CF74785703655F78DA6B582B |
| SHA-256: | EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 |
| SHA-512: | AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\68W6OD7A\Listen_Now_REC(Tara.brown).html
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5331 |
| Entropy (8bit): | 4.487787364106538 |
| Encrypted: | false |
| SSDEEP: | 48:KBjjReqHZDICRergqsVDncvBhWxnOvDxN7IglOcMSP1tZ2d1mU1o41Tgf1T61u5y:KjxFBtVDs9FwV8DJ9/Svxzf |
| MD5: | 5D6363398F012EADBD7836162077ACE4 |
| SHA1: | 92DA37EDECAB7EB95232C4E7E753EF1AAACD6FE9 |
| SHA-256: | 732885ED085B25EFA916DD22DA4D10E4B6506BD4A2F8F77F70B5DDC1A556BA1C |
| SHA-512: | 8F208B7252B7735D7B26370B07515496FB92678D914433D8BD67FB73072A4F6CDA03F4FCEE337666A1F8E00FEC303C434E6DA53D613A24D757B92DA0BAFF8573 |
| Malicious: | true |
| Yara Hits: |
|
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\68W6OD7A\Listen_Now_REC(Tara.brown).html:Zone.Identifier
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:gAWY3n:qY3n |
| MD5: | FBCCF14D504B7B2DBCB5A5BDA75BD93B |
| SHA1: | D59FC84CDD5217C6CF74785703655F78DA6B582B |
| SHA-256: | EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 |
| SHA-512: | AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{2E924EC0-9FFA-429A-8381-6D8982CC741D}.tmp
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2292 |
| Entropy (8bit): | 1.7255942694622088 |
| Encrypted: | false |
| SSDEEP: | 12:gxlXUIHPXz+5uvElKk8YepJLzXcFKuOwv9VAG1QlQlqM7WDicXL2Vkl5ikl:gxlXUIHy5v8l1zdZO9cicXL2Vkll |
| MD5: | EE0752AC3D40649D287EF9D1E690798C |
| SHA1: | B5DE0E21692B3BC195741BB9B2C9A9573D7DED2D |
| SHA-256: | 3BB3F5596B20C5ADF3F5381E6D0BF92BA5B1884BB1FE3DA1D1226AA743920540 |
| SHA-512: | 075D7EE28F7CECCD118577AC2C34F84D1098D4985C1D432B793495A92F66D5A281BF2C25AA23F696B0B901C19755314B5E78833E63A62E6A120CAF386FD598C9 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728864356199181800_2A707FD7-108D-4FB3-93C8-BAE9FC2D72D8.log
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 20971520 |
| Entropy (8bit): | 0.16029723303237584 |
| Encrypted: | false |
| SSDEEP: | 1536:QbkRA2noT7FBYyoCZHVE8EduPpO90t1jH98bVkfxaCyEqcYstk8q5BtBH:s2olBYiT7ts |
| MD5: | 3AF6162499A755DA327D78F2A1AB5EA4 |
| SHA1: | 768E884B69E58222111ABFE9E88D7EE1C1B155B7 |
| SHA-256: | 8185BC15D8E91F6FDBDD681671EDC0A748E39DAC43EE1F194302A5DFC4C885FA |
| SHA-512: | 1AF3BF771D78E63708368EC689ABC35D94BF23EF0A0BEDB92B7DA02E83093A4A04FD06AB4B3C98FD9289D53DF35EA156DAF089E72710AC4EE9845C3090ABD13D |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728864356200109300_2A707FD7-108D-4FB3-93C8-BAE9FC2D72D8.log
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 20971520 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | 8F4E33F3DC3E414FF94E5FB6905CBA8C |
| SHA1: | 9674344C90C2F0646F0B78026E127C9B86E3AD77 |
| SHA-256: | CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC |
| SHA-512: | 7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241013T2005550986-7048.etl
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 106496 |
| Entropy (8bit): | 4.512215081909634 |
| Encrypted: | false |
| SSDEEP: | 768:SN/JR9+iKdH71Q73QR4YzXEY58yGrJ39s46FxqDXKLzfYWBW3WXWuftQS:Oq4Yq39s46qDXKntQS |
| MD5: | 2832D8FBB93DAF811818B9C1F5C7F522 |
| SHA1: | 8C5DD0163E9B13DA93F2ADCFA2B5D8AF7F508904 |
| SHA-256: | 391779D3B69B000B1752BD5B1D7D43457E6E5972DBBF0B9ED53DD9E22A625BA2 |
| SHA-512: | 707BA3C2CBC3E6C66244966939C036B31CC5E5C37B94FB7F9EA6588292E2804080EA1AD1ADF0D9D337149C38C9120FD49C8172E37F90C1813ABBBCA1C15517A4 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 30 |
| Entropy (8bit): | 1.2389205950315936 |
| Encrypted: | false |
| SSDEEP: | 3:0Eav:0L |
| MD5: | C3EE575F560E26D5D341982B8B3F6530 |
| SHA1: | D714D2252A8E2F49B5360A1E532EF4AA28FE67EE |
| SHA-256: | 11E1C2C8063239367EBC3DEFB91ECDEDFBDCB8A634BA2A454EA6D5069BE4405C |
| SHA-512: | E8BA09A56C17AB9B757D1E4ABD214A000A4DFBD6260609B4191E5C8D509FD03CC7A23653A7F448FF1F976D967541EC444DD6E14D982B08D308AC119F379C5179 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2673 |
| Entropy (8bit): | 3.97479433045738 |
| Encrypted: | false |
| SSDEEP: | 48:8jdVT956H6idAKZdA1FehwiZUklqehKy+3:8Ln/Fy |
| MD5: | 2E7C0862CB24FAEFC199B5B6A5ED583A |
| SHA1: | AB74E0330529742DFD444760626BF1328E56958B |
| SHA-256: | DDB359CF8E086293C5A981E8C473C09A41868109059BB75B9424A5210989EAEA |
| SHA-512: | 9E2A57190D600B6C2B317D2FAFCC3E613CA90C2E921D36202644F9D9E3BA4F23C14FBF0C23520745D7E0C7207324B39AA0E4CBB2DA75C3015ECC0052131D2417 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2675 |
| Entropy (8bit): | 3.9921634592383097 |
| Encrypted: | false |
| SSDEEP: | 48:8tdVT956H6idAKZdA1seh/iZUkAQkqeh1y+2:81nJ9Qoy |
| MD5: | 9F671053CB36AAB12093382FB2699E51 |
| SHA1: | C66B1B921CF9429DDAEACC96C8F660EA5C48409A |
| SHA-256: | 04EC78F76D5F9DC3706BB8CB3DB4F300C6D76A7CC096AA63D1D09088097162AE |
| SHA-512: | D1B3019537CB1C533B1C4E24FEFD60BEB8C5A9CDD1A30768D8899AAB98BC3CF3B1294FFEE6F858EC5F193E0209CFA2F0E7C475C5F738F69C7FB2E79756A7E407 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2689 |
| Entropy (8bit): | 3.9995839486871043 |
| Encrypted: | false |
| SSDEEP: | 48:8bdVT95AH6idAKZdA14meh7sFiZUkmgqeh7sby+BX:8jnbn5y |
| MD5: | 0D6979367A51F88DC927CD782C1A004B |
| SHA1: | F193F2C70674363F47CD909D45F496ED28420B52 |
| SHA-256: | CE76BED2F48D83E7FB86DC12569348293FB0DCDC0A05D767D11BE0DEC310D36F |
| SHA-512: | 6A156467B6F74F70D6DB998AE852D91A2E1C435F1BBDDC03F7224FAB0359B2236B542D2AF0DE41AE5760DF3BC8E92264017D1463C6300BEDBB76D774264E82C5 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.9874392995080306 |
| Encrypted: | false |
| SSDEEP: | 48:89dVT956H6idAKZdA1TehDiZUkwqehxy+R:8lnazy |
| MD5: | D7297B7993E8515A3FDAA72DCD08998E |
| SHA1: | ADE43709B8C77C6A6CE25239E38ECE995FB9D386 |
| SHA-256: | E3E00470C4F300DD3F7E0D0A0FAEEDFA1A73E1A9254231ED6F20BE54537EC4CD |
| SHA-512: | 16D1764AB665FDC8E946A620A4E3A84A5B219AAAFE66099D33794648BE461F8F5D67E8703F3099EB1AAF403F8969AD41CB5EF89B6C02EB29DB8A0BBA083A6AF0 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.9764321057355905 |
| Encrypted: | false |
| SSDEEP: | 48:85dVT956H6idAKZdA1dehBiZUk1W1qehPy+C:8pn69vy |
| MD5: | 6578823F92B5E072351A4CC7FA24F2C7 |
| SHA1: | FD4754E07FA9ED7544D2626D31D7BC5578CEB880 |
| SHA-256: | 3E293B3E0BEE701F1C31D8544742B417D6F858881B7C26F7244F726C1E8177D0 |
| SHA-512: | 177AC6A6B60D5D5B154CEAECA6B102FA7F1C8942E913F1AF5CFA9748CE490516DA66EF61AC6DB94C83C6197291706A4C6612EDCDA4B23981D04072F700FAD987 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.988312463528096 |
| Encrypted: | false |
| SSDEEP: | 48:8tdVT956H6idAKZdA1duTeehOuTbbiZUk5OjqehOuTb5y+yT+:81nQTfTbxWOvTb5y7T |
| MD5: | 34F9837AE66F342B20E8AE64A2A7C855 |
| SHA1: | 666F2B0F513BC73C50AED40C2B9DE0CF8F8FBE2B |
| SHA-256: | 8A4F2B5698BA13C2AD1A208300C6897833360A81503F9381A7AEBC2CB748AECD |
| SHA-512: | 018350B237EC5AE7E59A67FBD834674A1A6184C10D26421219A6D024E00562964FA8A2B932863BB7DC142DA05821BFECE92E37882FC52652AC447520C7B94D21 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 271360 |
| Entropy (8bit): | 3.1180109714776294 |
| Encrypted: | false |
| SSDEEP: | 6144:MPw6pCEkNCEkrCEkaCEk/CEkvCEkqXCEkKYar:apCEkNCEkrCEkaCEk/CEkvCEkqXCEk |
| MD5: | B8345B5DAADC73EF7546D13D6DCED39C |
| SHA1: | 71E7791EB31B119BE07A2BBA5C169822DB18ABDC |
| SHA-256: | A0AB60326040F341AFA09EEB9A37847A992ABD2C3DCB1F1252A849BFC4AE94A8 |
| SHA-512: | 1E89BCA19DFEEA2A3489DEBA2E3DBFCD81E9720CCF8CC68F763B91DAD4A825295B164147B9CF50CDC12F90DF79A44B7E0A5CBC453FDA8DD234142A7076138DB7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 131072 |
| Entropy (8bit): | 4.305318281309235 |
| Encrypted: | false |
| SSDEEP: | 3072:yp9pdACEkNCEkrCEkaCEk/CEkpCEkqXCEk1wlp9cDH:y5iCEkNCEkrCEkaCEk/CEkpCEkqXCEkJ |
| MD5: | F55B0052CB89EAB275E6E393B3C66D15 |
| SHA1: | 9DDE8436B8F6F61F95BA4283E471B6D4F89A1556 |
| SHA-256: | D576EFB32DAD35B36C504D20C9B7863CFD25309E76615F7C44E85B01060A9544 |
| SHA-512: | 4D3C9B6218B146F24BD1A9C126E622485B39D739B7B66B150D34026CEFDA70B05AC239B3CF6FC5E69AB7BBD401DE9A5620A64125C0E38BA1937C4F896AE5458E |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:v:v |
| MD5: | 68B329DA9893E34099C7D8AD5CB9C940 |
| SHA1: | ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC |
| SHA-256: | 01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B |
| SHA-512: | BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09 |
| Malicious: | false |
| URL: | https://www.iprende.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TTFwR1pGUT0mdWlkPVVTRVIxODA5MjAyNFUzMjA5MTgwNA== |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 24626 |
| Entropy (8bit): | 4.469248688270725 |
| Encrypted: | false |
| SSDEEP: | 192:wks+vasSJavEAflgzBFE/ImdzJtrcpOIitlomlBJfkqVcpHT2l/01:Js+vas0a56zQ/I0tlTJfktHT401 |
| MD5: | F8E099141F272B588F656DCBFEE25A2D |
| SHA1: | FE360B06948108F86941C7E69AD250F20ACE316F |
| SHA-256: | 7B3EF563E6487FB17D6DB4080E5973B06A88F011D5037EECB580B4BBF339F237 |
| SHA-512: | 302751C85EE34B3AB14F3024C1A2E8D7E25E72CE2E6443AAA4438D88631758BD80B44521630454080D3C6C7AE8E4109CD0E51FB05670742439F30A97DB2DE083 |
| Malicious: | false |
| URL: | https://www.iprende.com/favicon.ico |
| Preview: |
| File type: | |
| Entropy (8bit): | 5.865959783409361 |
| TrID: |
|
| File name: | 20Listen.eml |
| File size: | 36'146 bytes |
| MD5: | 1162a9ab755e7e125f28b18063c78fcd |
| SHA1: | e76222078fde8083637c12e1cb3d665bacc4e51c |
| SHA256: | 05bf04eb228e30647194652f82d426fef36e85c7b595a44bdcc2b2e0aa4bc58f |
| SHA512: | 07720b97b423fbe9a301c4c0479b98cba1c7e1fc7f8884611d6571b25995426f82193a3f2f627f881dd41965f30bf83aed3de37e25a8d4847bf1bb3b105836c7 |
| SSDEEP: | 768:HOBgfb+m7JyIGlz61To/18KKzZKjjstmMPd3u:HOBKb+m/0z61To/18KKzhC |
| TLSH: | C7F2E803AFC01C11CB9A0991258F77BD3B3D6BC68A7248B0299B7FBE064ECD69AD1545 |
| File Content Preview: | Received: from SY4PR01MB5561.ausprd01.prod.outlook.com (2603:10c6:10:fd::7) by.. ME3PR01MB5736.ausprd01.prod.outlook.com with HTTPS; Fri, 11 Oct 2024 01:39:25.. +0000..ARC-Seal: i=2; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=pass;.. b=AaRHcds8 |
| Subject: | Missed__Caller.Ringer-Transcript....>>>>>>ID:-eef1da413490032ee87f60ea1a5f1d84, Download to Listen |
| From: | Call_Service-PlayBack-automatedrecvoic.notecaab961e40336b3bcf9c777e6742a98689809bb2f2526a528987656789876567898764f4-mail.protection.outlook.commmmx.box615bfe9fc949fcccc54392c416c2fe0a-a8d90738fc1ae1d2fe925d1623e943a0mx.01support@t1dpartnership.com.au |
| To: | tara.brown@icare.nsw.gov.au |
| Cc: | |
| BCC: | |
| Date: | Fri, 11 Oct 2024 01:34:03 +0000 |
| Communications: |
|
| Attachments: |
|
| Key | Value |
|---|---|
| Received | from [127.0.0.1] (172.81.130.40) by ML1PEPF0000F17A.mail.protection.outlook.com (10.167.241.71) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8048.13 via Frontend Transport; Fri, 11 Oct 2024 01:34:04 +0000 |
| ARC-Seal | i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=qzkVPeYdPxQQhLL6AweWq/dwC5gCXWcGeFt5lCZ3HDs8fSalsTYK8qZY0/b4VLOXkyzVtyU0uzEhUI+HGMVXv7W8mO5mNNPD6w3vLKOYafez3Xu+zTjcFz+WIb2CRiOoXAwb2wqG8Tac/fKpV33oHmcRQM2qvDNzum5/kCOzpozLyrT11QNQeUn842qft7bba20QGFJi7ib00C+7OiKGIty2XYw0vSIBb/QAmu08inc2bh2P3guSsipGZKeMbwIDEdXs13IDQjUqfkRo1biSq1aufM3S7UiOFPbzD89Wnp0StdKLQLInxF/2CrEIlLSqpMobGw+DlI9wI2hInkbUKQ== |
| ARC-Message-Signature | i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=wvq6cSfbh0devOxv+e8ZWknP183wJokSLmJ+dqQ9z+4=; b=DqFA95X//HJQhs2+4x9qRPAym2Ll4dn8wkHrg7FgVp7i+MA48R+IGwbyXmtWeo8vhs1EXro/c0Jhn+yjyW0JKwwAw3yGb67RPSbzkRfKIugvcUTRAPBQbnWtOdgSHRbNGhzppbXFLb0eY+a+/sX1Upe9Um1owse4tg87Q6FhSZBan+msRBL+ceQBiOdN/XGVVbzxRZI3J6mpFGFMbV8rLtdt3eLreLVn7qzcn+/NVgKU1VnyVnlMYGyVc3uv9yOczQs6wRFZzvVvfaEWsxbrRhEpfkwsB9/7oTyb6pcfnTWEywD7I2z+Er+bRDxTYJU0W5KtqSC/qVfJlGPj6AOc1w== |
| ARC-Authentication-Results | i=1; mx.microsoft.com 1; spf=fail (sender ip is 172.81.130.40) smtp.rcpttodomain=icare.nsw.gov.au smtp.mailfrom=t1dpartnership.com.au; dmarc=none action=none header.from=t1dpartnership.com.au; dkim=none (message not signed); arc=none (0) |
| Authentication-Results | spf=pass (sender IP is 52.101.150.107) smtp.mailfrom=t1dpartnership.com.au; dkim=pass (signature was verified) header.d=t1dpartnershipcomau.onmicrosoft.com;dmarc=bestguesspass action=none header.from=t1dpartnership.com.au;compauth=pass reason=109 |
| Received-SPF | Fail (protection.outlook.com: domain of t1dpartnership.com.au does not designate 172.81.130.40 as permitted sender) receiver=protection.outlook.com; client-ip=172.81.130.40; helo=[127.0.0.1]; |
| DKIM-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=t1dpartnershipcomau.onmicrosoft.com; s=selector2-t1dpartnershipcomau-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wvq6cSfbh0devOxv+e8ZWknP183wJokSLmJ+dqQ9z+4=; b=irvDttaZXeNyaHQV9Xgutd/5GyEinoX6fMJQJWIHqBluzJYE7+HRz1yl+EVxbVlh5TNJ514eWqeDow0gwQ9KPDeTt297k1FPyzj/CzjbIxdBQRXsADAfU0hctKwwjEvqQO52d+ZKVToNTZ0lNjnrlNO0QiLCzCru9bJngSg7/R8= |
| X-MS-Exchange-Authentication-Results | spf=fail (sender IP is 172.81.130.40) smtp.mailfrom=t1dpartnership.com.au; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=t1dpartnership.com.au; |
| Content-Type | multipart/mixed; boundary="--_NmP-9294ca0ee1ce52d7-Part_1" |
| X-Mailer | Microsoft Outlook Express 6.00.2900.2180 |
| X-Mimeole | Produced By Microsoft MimeOLE V6.00.2900.2180 |
| From | Call_Service-PlayBack-automatedrecvoic.notecaab961e40336b3bcf9c777e6742a98689809bb2f2526a528987656789876567898764f4-mail.protection.outlook.commmmx.box615bfe9fc949fcccc54392c416c2fe0a-a8d90738fc1ae1d2fe925d1623e943a0mx.01support@t1dpartnership.com.au |
| To | tara.brown@icare.nsw.gov.au |
| Subject | Missed__Caller.Ringer-Transcript....>>>>>>ID:-eef1da413490032ee87f60ea1a5f1d84, Download to Listen |
| Message-ID | <00ebaccd-3132-62e4-2b27-47d5cec2e2e5@t1dpartnership.com.au> |
| Date | Fri, 11 Oct 2024 01:34:03 +0000 |
| Return-Path | Call_Service-PlayBack-automatedrecvoic.notecaab961e40336b3bcf9c777e6742a98689809bb2f2526a528987656789876567898764f4-mail.protection.outlook.commmmx.box615bfe9fc949fcccc54392c416c2fe0a-a8d90738fc1ae1d2fe925d1623e943a0mx.01support@t1dpartnership.com.au |
| X-EOPAttributedMessage | 1 |
| X-MS-TrafficTypeDiagnostic | ML1PEPF0000F17A:EE_|SY6PR01MB8460:EE_|SY1PEPF00005A3D:EE_|SY4PR01MB5561:EE_|ME3PR01MB5736:EE_ |
| X-MS-Office365-Filtering-Correlation-Id | 66ef7e05-c7db-463e-232f-08dce994ce05 |
| X-MS-Exchange-SenderADCheck | 1 |
| X-MS-Exchange-AntiSpam-Relay | 0 |
| X-Microsoft-Antispam-Untrusted | BCL:0;ARA:13230040|376014|61400799027|36860700013|82310400026|2613699012|95630200002; |
| X-Microsoft-Antispam-Message-Info-Original | RBFbI8qM5CVWFjK8xt88Sfobj4ms0XpSGtKs8jezf3AfEue7pGGdeRWYcG6O78PHVBrZBufN7X9LGqTnEPnN1AHIz++ywSVk18AZcj012M+5wI2Ds07UXmqvNhC82pLlWI7hpcXgQTG1uJ1wCcHkYGom58sPOsWIiwg9QuuqoUhWildDZBXTK/SBt0yb+h/eM/pYcHMSxNZMhDBXiaivxomPTJzm8zWZcdpUcvZQTdBzxY876MAC0KxSFy7B2UQA9IQ3Jh/l9w8YDla8OP8zN5b2zAOkfsuVLStC7hdlqs4AP5SRLK8P2zoriPxkwfpVmoQc/+M6qSpLaJbgoeAifDQFulSXblasyuvjbkVhuojFfuE9HM2oU5Xhfw3+uVKodB3EBqiOn5hq9Zf9tT95ogWEMAMZQHgWHaaMNs87td/NwQvbA4iE0j2x9QGGA6CUgSJi3F0HY6QddOn/ihmyG93+YCQOIvUbGKVwRB4ITHgV8XvUPykUI4F278sk7ZNKwn5yuOGKZsLR4xtnoSfCzDmRFqnGa5KYPOKx1sWGiwdLnzzH541z8FkbHRqe76Fw71Q07CVRMwqXIqNeX1SF07Fg1UndXc4eptwtfpYgLAdC4uTpLb1TvhEr83l9eRJW0m/YWF/wSXTGuSbdo5WvfQArB4k7NFqe7KezVmpR3mCt0N6MlYx/U2TrAlGzfoW9e5L0sm5QOAslDowk+7jweCl2QoKnBy9DKXBSEKvPrx18XPOXDhJtpOkUqDMy5yESfEh9gAy3YJcbHHeEyt8I1Xr4gobYxm1mGmkrA75xYrp53cJSIXpvAfkeV530Y3TUGhOA21Ap+Rx8m1wqBCJ7Hmzf9nKJsafK6effcCAN7lHMBLPWQ8rIHndV3hrlSZyC6iiO5WX2Lq6wgE5cfUN06VNKc8P1Pbe1gS4gPrvuBuFcqQOy6tc5l/7VPvNR+Eiw+TyWBJp0JB2ehdWD6XkzqW405UO4IuN1SnsOqACtt+E2Bl/nkX2RWLSLzbMDV+uaKWUNJPsLzo4B1qKWt+GysSMURpCkS8kS03+RkYRwIN+8eb7S8CwqdYxL0VlsjQ3600UnjNZ5UNWMaMzlCKaEwoACJkCwT0ddKk5r2nvhAw8= |
| X-Forefront-Antispam-Report-Untrusted | CIP:172.81.130.40;CTRY:GB;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:[127.0.0.1];PTR:ip-172-81-130-40.host;CAT:NONE;SFS:(13230040)(376014)(61400799027)(36860700013)(82310400026)(2613699012)(95630200002);DIR:OUT;SFP:1102; |
| X-MS-Exchange-Transport-CrossTenantHeadersStamped | SY4PR01MB5561 |
| X-MS-Exchange-Organization-ExpirationStartTime | 11 Oct 2024 01:34:10.0642 (UTC) |
| X-MS-Exchange-Organization-ExpirationStartTimeReason | OriginalSubmit |
| X-MS-Exchange-Organization-ExpirationInterval | 1:00:00:00.0000000 |
| X-MS-Exchange-Organization-ExpirationIntervalReason | OriginalSubmit |
| X-MS-Exchange-Organization-Network-Message-Id | 66ef7e05-c7db-463e-232f-08dce994ce05 |
| X-EOPTenantAttributedMessage | 34ae0514-4eb5-4608-8b64-b002d2054238:0 |
| X-MS-Exchange-Organization-MessageDirectionality | Incoming |
| X-MS-Exchange-Transport-CrossTenantHeadersStripped | SY1PEPF00005A3D.ausprd01.prod.outlook.com |
| X-MS-Exchange-Transport-CrossTenantHeadersPromoted | SY1PEPF00005A3D.ausprd01.prod.outlook.com |
| X-MS-PublicTrafficType | |
| X-MS-Exchange-Organization-AuthSource | SY1PEPF00005A3D.ausprd01.prod.outlook.com |
| X-MS-Exchange-Organization-AuthAs | Anonymous |
| X-MS-Office365-Filtering-Correlation-Id-Prvs | 824198ae-94db-4d5a-ad85-08dce994cb63 |
| X-MS-Exchange-AtpMessageProperties | SA|SL |
| X-MS-Exchange-Organization-BypassFocusedInbox | true |
| X-MS-Exchange-Organization-SCL | 1 |
| X-Microsoft-Antispam | BCL:0;ARA:13230040|12012899012|35042699022|12062699021|2613699012|2722699018|8052699015|43540500003|95630200002; |
| X-Forefront-Antispam-Report | CIP:52.101.150.107;CTRY:AU;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SY8PR01CU002.outbound.protection.outlook.com;PTR:mail-australiaeastazon11020107.outbound.protection.outlook.com;CAT:NONE;SFTY:9.25;SFS:(13230040)(12012899012)(35042699022)(12062699021)(2613699012)(2722699018)(8052699015)(43540500003)(95630200002);DIR:INB;SFTY:9.25; |
| X-MS-Exchange-CrossTenant-OriginalArrivalTime | 11 Oct 2024 01:34:10.0486 (UTC) |
| X-MS-Exchange-CrossTenant-Network-Message-Id | 66ef7e05-c7db-463e-232f-08dce994ce05 |
| X-MS-Exchange-CrossTenant-Id | 34ae0514-4eb5-4608-8b64-b002d2054238 |
| X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp | TenantId=ed024331-b2c0-44f3-b0e0-045c81e086c5;Ip=[172.81.130.40];Helo=[[127.0.0.1]] |
| X-MS-Exchange-CrossTenant-AuthSource | SY1PEPF00005A3D.ausprd01.prod.outlook.com |
| X-MS-Exchange-CrossTenant-AuthAs | Anonymous |
| X-MS-Exchange-CrossTenant-FromEntityHeader | Internet |
| X-MS-Exchange-Transport-EndToEndLatency | 00:05:15.2697048 |
| X-MS-Exchange-Processed-By-BccFoldering | 15.20.8048.017 |
| X-Microsoft-Antispam-Mailbox-Delivery | ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003); |
| X-Microsoft-Antispam-Message-Info | q4xI9VL3VAjn2gX9TcLZsDguy9m9pkL949c2ddRZvUK/Z+FTAU2X4DECfSsLvHExVYgHjjWvAcpT/OCEp1O5zUbjrH6Cu9eqGDPkUMnI0LZV8G5PFSvY7K+a3EM3NeIF0zfcuXfVnd5womha48OkY/XAijHwr9lCBWSVQqdWwIkIx4m9jpSsxNAZuCDYx3C2TluatSED43/jiYgfAIiEwbsjH9moyueF1uYqMhMnaHAsFdV+SHqJuA7XrDBql3ZH8GbnHOeKki6ZGrkiHF5EDnOBjTA6BkDVnuSB18uWqIpEiwYEnBDMxQgcnz+fEd055mE1n4MNkbsTRYDDIRrTPB7L/bgGehbmDTzXDpKO7wzXO9rIOPUPwMwyqDszOkgrkoyytXup0eFJp+srmn+dJqeuGfz4zt/w5YT/1sM4uV2OFxU1nKiUfUXXWl0rBeD6cn8zaTBVL9e995hOa0NHn4iZ8mnpzdM4kCRZiYcsYCtHa8WOmEUk7BoyNVswJNiLLyn93iAWKnLXZo2+Q/sq/g0RZzvk8v/TN4HSmTAVfOVo7dyE6tLBNSSjUGPRUpr9K9iouzBcC5pGwopLWEW5qAti8xnEEoom9kK6/Rw/tFtu7ZvNQ5OZbYkb1Nc7nF3ouTW/5eQCMbFeQMWE6RaCqLpQkOwj2DLzninwpcCBkJwv7zF+E+Hj7K4Eth9qNV9nE3o9cXZ1D/8+14lNlfVe8qhf4+/uvP5x5DHt+tABoODSgAlcKn75LS1fMHQBLeN9aKVA/fZgKlEixphzNEn7EqTkH7EwvZVkqwGpI/FCL4Y1BeB1rcbPzpXEF05Kbj7WTQpsaAYlPsmEKUYuxDfni3iadloYke//54J9UsEUrlEw0hUjjPFDy8IdQXiW0q30TqzDCQTKJy8dqHZBNCBd/fwz7DmpjPPcKGR0IeZf1Ce0mRSCeHl37kmzvCY2On6kD2HLss2x3OGpjCNPE8eBGznNC6L43OCKsxifvOIyUyineDJoZ7QfDfvut8St9dEB4WMsh32KS5cY4Vgo8kVnlomfmyasw8iz643fvdavIWciEvMi5gLpcC6aNYcNJbZWeMgqh/3WqynVJsHqtl2qKfMGxACyhCAsOrCf2OMcpxNPEWjuw4EvAPBDRO/58u11dTOWc8Hm14msVvQfM0qHip6TZaVgQbRyp1oBlq5tGo2fssMPDqUO+BavNXqdMe/mD39JiE1PV5Jggy1RpIhlwTGdCt+XJBtM8XIhY0P1ss85gQ7YeEYgwcL2Vsz9PW/DfT8swODB/aNjqo4gW7K/M5CBff0WOoDH6fLEh19D3FXMT6jXapLQg6jqjjnQ65oLIix88GenL4ay3qeDWlNsY4wvs8dcZgMzfeRSCSWXz7zNDTNllj7TLN8lwTUmhudKGD8QxdruwwM5ZjWp6BsEhX0gMtKIqGwGkCdFPkFSJ/jWaP2AsWw6FVtRGDKmj7KogKUZ0GyVXh+mnjbSJZ3u1oeZIq+1JSmwl4Pwalq+kWTLe9hHxxia8Bc00ZEQE6tCOzI3sQfj8tvO7rgFs46zjNzQzDdOJqldiqARHpoj1ID9mErnHmcPYT1Yd583+Qwqbz8nfdCAaLUgNL47ixL8FKu6olzX9Py6Bm4dNLqeWzEnjtN3m7AGvAfg/z+9NqZt7o0uXnoxk37UFjnrWbDoZuP9M94bgApRzQ+ZSM0G+Z4+oJeMwqsxS6QFFSLJTVspBprlzHO90WZ9VTvNmHFlCCmK0ZGwUxkfBC3G31iYPaM2rsMwVdwZT7HuLAS7szN9eUQvDwiwYcmsdOvd8sWpX9CDE3vn5stVLVx+5Xk7pAY5RQZKjg3KB0gLai/xfKmL1swyRq8Z/eJOsHu2YpJvfZZeN/CnuX2MlB4e9VvvTXigSoISw+YnPSGx3FvsLYeR1urkwLbspsQwtvszzxgZJsquHeL2Mz4/KtO8T3QE6Le+ryR1mUXs8Sk4i2IQkCsTT6+mQibOKqeiju2w4x+SUw== |
| MIME-Version | 1.0 |
 | |
| Icon Hash: | 46070c0a8e0c67d6 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 14, 2024 02:05:53.536997080 CEST | 49673 | 443 | 192.168.2.16 | 204.79.197.203 |
| Oct 14, 2024 02:05:53.840606928 CEST | 49673 | 443 | 192.168.2.16 | 204.79.197.203 |
| Oct 14, 2024 02:05:54.447513103 CEST | 49673 | 443 | 192.168.2.16 | 204.79.197.203 |
| Oct 14, 2024 02:05:55.653610945 CEST | 49673 | 443 | 192.168.2.16 | 204.79.197.203 |
| Oct 14, 2024 02:05:56.520052910 CEST | 49689 | 80 | 192.168.2.16 | 192.229.211.108 |
| Oct 14, 2024 02:05:58.057615995 CEST | 49673 | 443 | 192.168.2.16 | 204.79.197.203 |
| Oct 14, 2024 02:05:58.285788059 CEST | 49708 | 443 | 192.168.2.16 | 52.123.243.192 |
| Oct 14, 2024 02:05:58.285873890 CEST | 443 | 49708 | 52.123.243.192 | 192.168.2.16 |
| Oct 14, 2024 02:05:58.286298037 CEST | 49708 | 443 | 192.168.2.16 | 52.123.243.192 |
| Oct 14, 2024 02:05:58.286592960 CEST | 49708 | 443 | 192.168.2.16 | 52.123.243.192 |
| Oct 14, 2024 02:05:58.286628008 CEST | 443 | 49708 | 52.123.243.192 | 192.168.2.16 |
| Oct 14, 2024 02:05:59.114180088 CEST | 443 | 49708 | 52.123.243.192 | 192.168.2.16 |
| Oct 14, 2024 02:05:59.114294052 CEST | 49708 | 443 | 192.168.2.16 | 52.123.243.192 |
| Oct 14, 2024 02:05:59.116902113 CEST | 49708 | 443 | 192.168.2.16 | 52.123.243.192 |
| Oct 14, 2024 02:05:59.116931915 CEST | 443 | 49708 | 52.123.243.192 | 192.168.2.16 |
| Oct 14, 2024 02:05:59.117306948 CEST | 443 | 49708 | 52.123.243.192 | 192.168.2.16 |
| Oct 14, 2024 02:05:59.118586063 CEST | 49708 | 443 | 192.168.2.16 | 52.123.243.192 |
| Oct 14, 2024 02:05:59.159435034 CEST | 443 | 49708 | 52.123.243.192 | 192.168.2.16 |
| Oct 14, 2024 02:05:59.404182911 CEST | 443 | 49708 | 52.123.243.192 | 192.168.2.16 |
| Oct 14, 2024 02:05:59.404377937 CEST | 443 | 49708 | 52.123.243.192 | 192.168.2.16 |
| Oct 14, 2024 02:05:59.404452085 CEST | 49708 | 443 | 192.168.2.16 | 52.123.243.192 |
| Oct 14, 2024 02:05:59.404520035 CEST | 49708 | 443 | 192.168.2.16 | 52.123.243.192 |
| Oct 14, 2024 02:05:59.404520035 CEST | 49708 | 443 | 192.168.2.16 | 52.123.243.192 |
| Oct 14, 2024 02:05:59.404556990 CEST | 443 | 49708 | 52.123.243.192 | 192.168.2.16 |
| Oct 14, 2024 02:05:59.404578924 CEST | 443 | 49708 | 52.123.243.192 | 192.168.2.16 |
| Oct 14, 2024 02:05:59.767704964 CEST | 49709 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:05:59.767780066 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:05:59.767863035 CEST | 49709 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:05:59.769299984 CEST | 49709 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:05:59.769334078 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.528489113 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.528589964 CEST | 49709 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:00.530273914 CEST | 49709 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:00.530302048 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.530694962 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.570410013 CEST | 49709 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:00.615403891 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.854482889 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.854639053 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.854676962 CEST | 49709 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:00.854739904 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.854773045 CEST | 49709 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:00.854773045 CEST | 49709 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:00.854794979 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.854813099 CEST | 443 | 49709 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.893893957 CEST | 49710 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:00.893940926 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:00.894022942 CEST | 49710 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:00.894268036 CEST | 49710 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:00.894299030 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:01.610635042 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:01.610690117 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:01.610915899 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:01.611079931 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:01.611095905 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:01.611330032 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:01.611411095 CEST | 49710 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:01.612344027 CEST | 49710 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:01.612361908 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:01.612878084 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:01.613907099 CEST | 49710 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:01.659404039 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:01.703737974 CEST | 49678 | 443 | 192.168.2.16 | 20.189.173.10 |
| Oct 14, 2024 02:06:01.942723989 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:01.942913055 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:01.942981005 CEST | 49710 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:01.943572044 CEST | 49710 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:01.943603039 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:01.943619013 CEST | 49710 | 443 | 192.168.2.16 | 184.28.90.27 |
| Oct 14, 2024 02:06:01.943627119 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.005585909 CEST | 49678 | 443 | 192.168.2.16 | 20.189.173.10 |
| Oct 14, 2024 02:06:02.417946100 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.418028116 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:02.428869963 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:02.428890944 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.429241896 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.429646969 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:02.429694891 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:02.429760933 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.611490965 CEST | 49678 | 443 | 192.168.2.16 | 20.189.173.10 |
| Oct 14, 2024 02:06:02.808876991 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.808914900 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.808973074 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:02.808986902 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.809041977 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.809052944 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:02.809165955 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.809175968 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:02.809192896 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:02.809211016 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.809231997 CEST | 49711 | 443 | 192.168.2.16 | 20.190.160.14 |
| Oct 14, 2024 02:06:02.809247971 CEST | 443 | 49711 | 20.190.160.14 | 192.168.2.16 |
| Oct 14, 2024 02:06:02.867510080 CEST | 49673 | 443 | 192.168.2.16 | 204.79.197.203 |
| Oct 14, 2024 02:06:03.826493025 CEST | 49678 | 443 | 192.168.2.16 | 20.189.173.10 |
| Oct 14, 2024 02:06:05.010090113 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:05.010137081 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:05.010231018 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:05.011554956 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:05.011575937 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:05.840604067 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:05.840675116 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:05.842729092 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:05.842750072 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:05.843269110 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:05.887581110 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:05.907648087 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:05.955409050 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.139321089 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.139425039 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.139447927 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.139499903 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.139539003 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.139620066 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:06.139657021 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.139686108 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:06.139718056 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.139719963 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:06.139761925 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.139808893 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:06.139808893 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:06.139822960 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.140053034 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.140270948 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:06.153871059 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:06.153871059 CEST | 49712 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:06.153889894 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.153901100 CEST | 443 | 49712 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:06.175832033 CEST | 49680 | 80 | 192.168.2.16 | 192.229.211.108 |
| Oct 14, 2024 02:06:06.239538908 CEST | 49678 | 443 | 192.168.2.16 | 20.189.173.10 |
| Oct 14, 2024 02:06:06.484915018 CEST | 49680 | 80 | 192.168.2.16 | 192.229.211.108 |
| Oct 14, 2024 02:06:07.085531950 CEST | 49680 | 80 | 192.168.2.16 | 192.229.211.108 |
| Oct 14, 2024 02:06:08.300695896 CEST | 49680 | 80 | 192.168.2.16 | 192.229.211.108 |
| Oct 14, 2024 02:06:10.712539911 CEST | 49680 | 80 | 192.168.2.16 | 192.229.211.108 |
| Oct 14, 2024 02:06:11.047528028 CEST | 49678 | 443 | 192.168.2.16 | 20.189.173.10 |
| Oct 14, 2024 02:06:12.481725931 CEST | 49673 | 443 | 192.168.2.16 | 204.79.197.203 |
| Oct 14, 2024 02:06:15.518552065 CEST | 49680 | 80 | 192.168.2.16 | 192.229.211.108 |
| Oct 14, 2024 02:06:20.652667046 CEST | 49678 | 443 | 192.168.2.16 | 20.189.173.10 |
| Oct 14, 2024 02:06:22.302666903 CEST | 49718 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:22.302712917 CEST | 443 | 49718 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:22.302793980 CEST | 49718 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:22.303416014 CEST | 49718 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:22.303435087 CEST | 443 | 49718 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.203978062 CEST | 443 | 49718 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.204283953 CEST | 49718 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:23.204344034 CEST | 443 | 49718 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.206094027 CEST | 443 | 49718 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.206175089 CEST | 49718 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:23.207243919 CEST | 49718 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:23.207336903 CEST | 443 | 49718 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.207492113 CEST | 49718 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:23.207508087 CEST | 443 | 49718 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.250675917 CEST | 49718 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:23.691101074 CEST | 443 | 49718 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.691492081 CEST | 443 | 49718 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.691584110 CEST | 49718 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:23.692071915 CEST | 49718 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:23.692137003 CEST | 443 | 49718 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.723342896 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:23.723460913 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.723577976 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:23.723947048 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:23.724059105 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:24.388087988 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:24.388375044 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:24.388407946 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:24.388773918 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:24.389156103 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:24.389223099 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:24.389329910 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:24.435441017 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:24.964231014 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:24.964453936 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:24.964560986 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:24.964626074 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:25.019676924 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:25.019737959 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:25.067231894 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:25.067408085 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:25.067528963 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:25.067550898 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:25.067579031 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:25.067650080 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:25.067687035 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:25.068042040 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:25.068113089 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:25.068382978 CEST | 49720 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:25.068434954 CEST | 443 | 49720 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:25.130880117 CEST | 49680 | 80 | 192.168.2.16 | 192.229.211.108 |
| Oct 14, 2024 02:06:26.973469973 CEST | 49722 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:06:26.973562002 CEST | 443 | 49722 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:06:26.973649979 CEST | 49722 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:06:26.973913908 CEST | 49722 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:06:26.973949909 CEST | 443 | 49722 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:06:27.626545906 CEST | 443 | 49722 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:06:27.626849890 CEST | 49722 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:06:27.626897097 CEST | 443 | 49722 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:06:27.628562927 CEST | 443 | 49722 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:06:27.628640890 CEST | 49722 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:06:27.630062103 CEST | 49722 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:06:27.630153894 CEST | 443 | 49722 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:06:27.677571058 CEST | 49722 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:06:27.677607059 CEST | 443 | 49722 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:06:27.725555897 CEST | 49722 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:06:34.241864920 CEST | 49723 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.241956949 CEST | 443 | 49723 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.242006063 CEST | 49724 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.242052078 CEST | 443 | 49724 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.242280960 CEST | 49723 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.242321014 CEST | 49724 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.242396116 CEST | 49723 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.242428064 CEST | 443 | 49723 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.242618084 CEST | 49724 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.242662907 CEST | 443 | 49724 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.921437025 CEST | 443 | 49723 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.921848059 CEST | 49723 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.921912909 CEST | 443 | 49723 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.923060894 CEST | 443 | 49723 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.923372984 CEST | 49723 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.923505068 CEST | 49723 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.923521042 CEST | 443 | 49723 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.923593998 CEST | 443 | 49723 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.937134027 CEST | 443 | 49724 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.937417030 CEST | 49724 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.937448978 CEST | 443 | 49724 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.937814951 CEST | 443 | 49724 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.938221931 CEST | 49724 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.938304901 CEST | 443 | 49724 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:34.976737022 CEST | 49723 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:34.992646933 CEST | 49724 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:35.474821091 CEST | 443 | 49723 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:35.475255966 CEST | 443 | 49723 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:35.475343943 CEST | 49723 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:35.476146936 CEST | 49723 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:35.476196051 CEST | 443 | 49723 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:37.526431084 CEST | 443 | 49722 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:06:37.526581049 CEST | 443 | 49722 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:06:37.526639938 CEST | 49722 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:06:38.446276903 CEST | 49722 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:06:38.446322918 CEST | 443 | 49722 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:06:42.634243965 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:42.634311914 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:42.634417057 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:42.634942055 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:42.634968042 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.165702105 CEST | 49698 | 80 | 192.168.2.16 | 88.221.110.91 |
| Oct 14, 2024 02:06:43.165858030 CEST | 49699 | 80 | 192.168.2.16 | 88.221.110.91 |
| Oct 14, 2024 02:06:43.170883894 CEST | 80 | 49698 | 88.221.110.91 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.170963049 CEST | 49698 | 80 | 192.168.2.16 | 88.221.110.91 |
| Oct 14, 2024 02:06:43.171158075 CEST | 80 | 49699 | 88.221.110.91 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.171217918 CEST | 49699 | 80 | 192.168.2.16 | 88.221.110.91 |
| Oct 14, 2024 02:06:43.344398975 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.344500065 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:43.346206903 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:43.346220970 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.346715927 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.347877979 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:43.395435095 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.618186951 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.618249893 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.618458033 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.618458986 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:43.618524075 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.618680954 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:43.618709087 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.618798018 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:43.619630098 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.619688988 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:43.619764090 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.619828939 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:43.621058941 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:43.621081114 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:43.621094942 CEST | 49725 | 443 | 192.168.2.16 | 172.202.163.200 |
| Oct 14, 2024 02:06:43.621100903 CEST | 443 | 49725 | 172.202.163.200 | 192.168.2.16 |
| Oct 14, 2024 02:06:56.092359066 CEST | 443 | 49724 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:56.092526913 CEST | 443 | 49724 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:06:56.092755079 CEST | 49724 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:56.445142031 CEST | 49724 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:06:56.445193052 CEST | 443 | 49724 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:23.972500086 CEST | 49727 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:23.972551107 CEST | 443 | 49727 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:23.972662926 CEST | 49727 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:23.973100901 CEST | 49728 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:23.973190069 CEST | 443 | 49728 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:23.973275900 CEST | 49728 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:23.973341942 CEST | 49727 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:23.973365068 CEST | 443 | 49727 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:23.973583937 CEST | 49728 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:23.973619938 CEST | 443 | 49728 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:24.659188032 CEST | 443 | 49727 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:24.659540892 CEST | 49727 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:24.659576893 CEST | 443 | 49727 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:24.660815954 CEST | 443 | 49727 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:24.661218882 CEST | 49727 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:24.661381006 CEST | 49727 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:24.661396027 CEST | 443 | 49727 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:24.661434889 CEST | 443 | 49727 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:24.688303947 CEST | 443 | 49728 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:24.688625097 CEST | 49728 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:24.688658953 CEST | 443 | 49728 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:24.689793110 CEST | 443 | 49728 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:24.690237045 CEST | 49728 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:24.690433979 CEST | 443 | 49728 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:24.710764885 CEST | 49727 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:24.742688894 CEST | 49728 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:25.168523073 CEST | 443 | 49727 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:25.169209957 CEST | 443 | 49727 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:25.169343948 CEST | 49727 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:25.169616938 CEST | 49727 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:25.169656038 CEST | 443 | 49727 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:27.026628971 CEST | 49729 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:07:27.026724100 CEST | 443 | 49729 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:07:27.026884079 CEST | 49729 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:07:27.027079105 CEST | 49729 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:07:27.027103901 CEST | 443 | 49729 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:07:27.908557892 CEST | 443 | 49729 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:07:27.908845901 CEST | 49729 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:07:27.908898115 CEST | 443 | 49729 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:07:27.909723043 CEST | 443 | 49729 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:07:27.910003901 CEST | 49729 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:07:27.910095930 CEST | 443 | 49729 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:07:27.952716112 CEST | 49729 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:07:33.562972069 CEST | 49701 | 80 | 192.168.2.16 | 192.229.221.95 |
| Oct 14, 2024 02:07:33.568732023 CEST | 80 | 49701 | 192.229.221.95 | 192.168.2.16 |
| Oct 14, 2024 02:07:33.568814039 CEST | 49701 | 80 | 192.168.2.16 | 192.229.221.95 |
| Oct 14, 2024 02:07:37.737291098 CEST | 443 | 49729 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:07:37.737447977 CEST | 443 | 49729 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:07:37.737629890 CEST | 49729 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:07:38.444334984 CEST | 49729 | 443 | 192.168.2.16 | 142.250.186.36 |
| Oct 14, 2024 02:07:38.444386959 CEST | 443 | 49729 | 142.250.186.36 | 192.168.2.16 |
| Oct 14, 2024 02:07:45.825289965 CEST | 443 | 49728 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:45.825382948 CEST | 443 | 49728 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:45.825453997 CEST | 49728 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:46.438210964 CEST | 49728 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:46.438281059 CEST | 443 | 49728 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:48.374095917 CEST | 49737 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:48.374185085 CEST | 443 | 49737 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:48.374257088 CEST | 49738 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:48.374284029 CEST | 443 | 49738 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:48.374315977 CEST | 49737 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:48.374377966 CEST | 49738 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:48.384591103 CEST | 49738 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:48.384674072 CEST | 443 | 49738 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:48.384713888 CEST | 49737 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:48.384743929 CEST | 443 | 49737 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.061311960 CEST | 443 | 49737 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.061631918 CEST | 49737 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:49.061664104 CEST | 443 | 49737 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.062906981 CEST | 443 | 49737 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.063209057 CEST | 49737 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:49.063333988 CEST | 49737 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:49.063340902 CEST | 443 | 49737 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.063431025 CEST | 443 | 49737 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.065285921 CEST | 443 | 49738 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.065462112 CEST | 49738 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:49.065470934 CEST | 443 | 49738 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.067248106 CEST | 443 | 49738 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.067495108 CEST | 49738 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:49.067682981 CEST | 443 | 49738 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.106758118 CEST | 49737 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:49.122770071 CEST | 49738 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:49.680705070 CEST | 443 | 49737 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.681081057 CEST | 443 | 49737 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:49.681205034 CEST | 49737 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:49.681684971 CEST | 49737 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:49.681725025 CEST | 443 | 49737 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:59.805881977 CEST | 49745 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:59.806021929 CEST | 443 | 49745 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:59.806155920 CEST | 49745 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:59.806339979 CEST | 49745 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:59.806382895 CEST | 443 | 49745 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:07:59.806440115 CEST | 49738 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:07:59.851408005 CEST | 443 | 49738 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:08:00.125730038 CEST | 443 | 49738 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:08:00.126152039 CEST | 443 | 49738 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:08:00.126388073 CEST | 49738 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:08:00.126524925 CEST | 49738 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:08:00.126571894 CEST | 443 | 49738 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:08:00.474355936 CEST | 443 | 49745 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:08:00.474812031 CEST | 49745 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:08:00.474878073 CEST | 443 | 49745 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:08:00.475506067 CEST | 443 | 49745 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:08:00.475825071 CEST | 49745 | 443 | 192.168.2.16 | 194.53.148.86 |
| Oct 14, 2024 02:08:00.475955009 CEST | 443 | 49745 | 194.53.148.86 | 192.168.2.16 |
| Oct 14, 2024 02:08:00.516793966 CEST | 49745 | 443 | 192.168.2.16 | 194.53.148.86 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 14, 2024 02:06:22.213273048 CEST | 53 | 52755 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:06:22.275151968 CEST | 53790 | 53 | 192.168.2.16 | 1.1.1.1 |
| Oct 14, 2024 02:06:22.275298119 CEST | 61732 | 53 | 192.168.2.16 | 1.1.1.1 |
| Oct 14, 2024 02:06:22.285713911 CEST | 53 | 62812 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:06:22.295711994 CEST | 53 | 53790 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:06:22.366962910 CEST | 53 | 61732 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:06:23.270437002 CEST | 53 | 51072 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:06:26.965502977 CEST | 61237 | 53 | 192.168.2.16 | 1.1.1.1 |
| Oct 14, 2024 02:06:26.965681076 CEST | 53071 | 53 | 192.168.2.16 | 1.1.1.1 |
| Oct 14, 2024 02:06:26.972497940 CEST | 53 | 53071 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:06:26.972544909 CEST | 53 | 61237 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:06:40.355124950 CEST | 53 | 56572 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:06:57.868607044 CEST | 138 | 138 | 192.168.2.16 | 192.168.2.255 |
| Oct 14, 2024 02:06:59.034128904 CEST | 53 | 61112 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:07:22.037982941 CEST | 53 | 61385 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:07:22.105499983 CEST | 53 | 59433 | 1.1.1.1 | 192.168.2.16 |
| Oct 14, 2024 02:07:50.171941996 CEST | 53 | 58199 | 1.1.1.1 | 192.168.2.16 |
| Timestamp | Source IP | Dest IP | Checksum | Code | Type |
|---|---|---|---|---|---|
| Oct 14, 2024 02:06:22.367067099 CEST | 192.168.2.16 | 1.1.1.1 | c231 | (Port unreachable) | Destination Unreachable |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 14, 2024 02:06:22.275151968 CEST | 192.168.2.16 | 1.1.1.1 | 0x280e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 14, 2024 02:06:22.275298119 CEST | 192.168.2.16 | 1.1.1.1 | 0x79b6 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 14, 2024 02:06:26.965502977 CEST | 192.168.2.16 | 1.1.1.1 | 0x145c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 14, 2024 02:06:26.965681076 CEST | 192.168.2.16 | 1.1.1.1 | 0x3a5a | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 14, 2024 02:05:58.284851074 CEST | 1.1.1.1 | 192.168.2.16 | 0xb782 | No error (0) | mira-tmc.tm-4.office.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 14, 2024 02:05:58.284851074 CEST | 1.1.1.1 | 192.168.2.16 | 0xb782 | No error (0) | 52.123.243.192 | A (IP address) | IN (0x0001) | false | ||
| Oct 14, 2024 02:05:58.284851074 CEST | 1.1.1.1 | 192.168.2.16 | 0xb782 | No error (0) | 52.123.243.193 | A (IP address) | IN (0x0001) | false | ||
| Oct 14, 2024 02:05:58.284851074 CEST | 1.1.1.1 | 192.168.2.16 | 0xb782 | No error (0) | 52.123.243.84 | A (IP address) | IN (0x0001) | false | ||
| Oct 14, 2024 02:05:58.284851074 CEST | 1.1.1.1 | 192.168.2.16 | 0xb782 | No error (0) | 52.123.243.199 | A (IP address) | IN (0x0001) | false | ||
| Oct 14, 2024 02:05:58.284851074 CEST | 1.1.1.1 | 192.168.2.16 | 0xb782 | No error (0) | 52.123.243.71 | A (IP address) | IN (0x0001) | false | ||
| Oct 14, 2024 02:05:58.284851074 CEST | 1.1.1.1 | 192.168.2.16 | 0xb782 | No error (0) | 52.123.243.74 | A (IP address) | IN (0x0001) | false | ||
| Oct 14, 2024 02:05:58.284851074 CEST | 1.1.1.1 | 192.168.2.16 | 0xb782 | No error (0) | 52.123.243.80 | A (IP address) | IN (0x0001) | false | ||
| Oct 14, 2024 02:05:58.284851074 CEST | 1.1.1.1 | 192.168.2.16 | 0xb782 | No error (0) | 52.123.243.68 | A (IP address) | IN (0x0001) | false | ||
| Oct 14, 2024 02:06:22.295711994 CEST | 1.1.1.1 | 192.168.2.16 | 0x280e | No error (0) | 194.53.148.86 | A (IP address) | IN (0x0001) | false | ||
| Oct 14, 2024 02:06:26.972497940 CEST | 1.1.1.1 | 192.168.2.16 | 0x3a5a | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 14, 2024 02:06:26.972544909 CEST | 1.1.1.1 | 192.168.2.16 | 0x145c | No error (0) | 142.250.186.36 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.16 | 49708 | 52.123.243.192 | 443 | 7048 | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:05:59 UTC | 857 | OUT | |
| 2024-10-14 00:05:59 UTC | 1155 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.16 | 49709 | 184.28.90.27 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:06:00 UTC | 161 | OUT | |
| 2024-10-14 00:06:00 UTC | 467 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.16 | 49710 | 184.28.90.27 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:06:01 UTC | 239 | OUT | |
| 2024-10-14 00:06:01 UTC | 515 | IN | |
| 2024-10-14 00:06:01 UTC | 55 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 3 | 192.168.2.16 | 49711 | 20.190.160.14 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:06:02 UTC | 422 | OUT | |
| 2024-10-14 00:06:02 UTC | 4762 | OUT | |
| 2024-10-14 00:06:02 UTC | 569 | IN | |
| 2024-10-14 00:06:02 UTC | 10197 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.16 | 49712 | 172.202.163.200 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:06:05 UTC | 306 | OUT | |
| 2024-10-14 00:06:06 UTC | 560 | IN | |
| 2024-10-14 00:06:06 UTC | 15824 | IN | |
| 2024-10-14 00:06:06 UTC | 8666 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.16 | 49718 | 194.53.148.86 | 443 | 1444 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:06:23 UTC | 723 | OUT | |
| 2024-10-14 00:06:23 UTC | 182 | IN | |
| 2024-10-14 00:06:23 UTC | 3 | IN | |
| 2024-10-14 00:06:23 UTC | 1 | IN | |
| 2024-10-14 00:06:23 UTC | 2 | IN | |
| 2024-10-14 00:06:23 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.16 | 49720 | 194.53.148.86 | 443 | 1444 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:06:24 UTC | 665 | OUT | |
| 2024-10-14 00:06:24 UTC | 400 | IN | |
| 2024-10-14 00:06:24 UTC | 6 | IN | |
| 2024-10-14 00:06:24 UTC | 8192 | IN | |
| 2024-10-14 00:06:24 UTC | 2 | IN | |
| 2024-10-14 00:06:24 UTC | 6 | IN | |
| 2024-10-14 00:06:25 UTC | 8192 | IN | |
| 2024-10-14 00:06:25 UTC | 2 | IN | |
| 2024-10-14 00:06:25 UTC | 6 | IN | |
| 2024-10-14 00:06:25 UTC | 8192 | IN | |
| 2024-10-14 00:06:25 UTC | 2 | IN | |
| 2024-10-14 00:06:25 UTC | 4 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.16 | 49723 | 194.53.148.86 | 443 | 1444 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:06:34 UTC | 838 | OUT | |
| 2024-10-14 00:06:35 UTC | 182 | IN | |
| 2024-10-14 00:06:35 UTC | 3 | IN | |
| 2024-10-14 00:06:35 UTC | 1 | IN | |
| 2024-10-14 00:06:35 UTC | 2 | IN | |
| 2024-10-14 00:06:35 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.16 | 49725 | 172.202.163.200 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:06:43 UTC | 306 | OUT | |
| 2024-10-14 00:06:43 UTC | 560 | IN | |
| 2024-10-14 00:06:43 UTC | 15824 | IN | |
| 2024-10-14 00:06:43 UTC | 14181 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.16 | 49727 | 194.53.148.86 | 443 | 1444 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:07:24 UTC | 838 | OUT | |
| 2024-10-14 00:07:25 UTC | 182 | IN | |
| 2024-10-14 00:07:25 UTC | 3 | IN | |
| 2024-10-14 00:07:25 UTC | 1 | IN | |
| 2024-10-14 00:07:25 UTC | 2 | IN | |
| 2024-10-14 00:07:25 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.16 | 49737 | 194.53.148.86 | 443 | 1444 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:07:49 UTC | 798 | OUT | |
| 2024-10-14 00:07:49 UTC | 182 | IN | |
| 2024-10-14 00:07:49 UTC | 3 | IN | |
| 2024-10-14 00:07:49 UTC | 1 | IN | |
| 2024-10-14 00:07:49 UTC | 2 | IN | |
| 2024-10-14 00:07:49 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.16 | 49738 | 194.53.148.86 | 443 | 1444 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-14 00:07:59 UTC | 844 | OUT | |
| 2024-10-14 00:08:00 UTC | 182 | IN | |
| 2024-10-14 00:08:00 UTC | 3 | IN | |
| 2024-10-14 00:08:00 UTC | 1 | IN | |
| 2024-10-14 00:08:00 UTC | 2 | IN | |
| 2024-10-14 00:08:00 UTC | 5 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 1 |
| Start time: | 20:05:55 |
| Start date: | 13/10/2024 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xc50000 |
| File size: | 34'446'744 bytes |
| MD5 hash: | 91A5292942864110ED734005B7E005C0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 3 |
| Start time: | 20:05:57 |
| Start date: | 13/10/2024 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6a3a20000 |
| File size: | 710'048 bytes |
| MD5 hash: | EC652BEDD90E089D9406AFED89A8A8BD |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 10 |
| Start time: | 20:06:20 |
| Start date: | 13/10/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7f9810000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 11 |
| Start time: | 20:06:21 |
| Start date: | 13/10/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7f9810000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 15 |
| Start time: | 20:07:47 |
| Start date: | 13/10/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7f9810000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 16 |
| Start time: | 20:07:47 |
| Start date: | 13/10/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7f9810000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 45DE480806D1B5D462A7DDE4DCEFC4E4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
⊘No disassembly