Edit tour
Windows
Analysis Report
Salary_Increase_Approval_Open_Enrollment_2024.zip
Overview
General Information
| Sample name: | Salary_Increase_Approval_Open_Enrollment_2024.zip |
| Analysis ID: | 1542133 |
| MD5: | f46f6a6d3f24f11850cd405e361cf495 |
| SHA1: | 9425aabe014c80ea79fcbb68af4fd7b553a792b7 |
| SHA256: | c239e74bce525ab693ca25768d9c95409bfad4fac5cfc3d7a4b114f8749e053e |
| Infos: | |
 | |
Detection
| Score: | 1 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 80% |
Signatures
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Stores files to the Windows start menu directory
Classification
- System is w10x64_ra
rundll32.exe (PID: 7144 cmdline: C:\Windows \System32\ rundll32.e xe C:\Wind ows\System 32\shell32 .dll,SHCre ateLocalSe rverRunDll {9aa46009 -3ce0-458a -a354-7156 10a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
Acrobat.exe (PID: 6412 cmdline: "C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\Acrobat .exe" "C:\ Users\user \AppData\L ocal\Temp\ Temp1_Sala ry_Increas e_Approval _Open_Enro llment_202 4.zip\Sala ry_Increas e_Approval _Open_Enro llment_202 440943.pdf " MD5: 24EAD1C46A47022347DC0F05F6EFBB8C) 
AcroCEF.exe (PID: 6684 cmdline: "C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\acrocef _1\AcroCEF .exe" --ba ckgroundco lor=167772 15 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE) - AcroCEF.exe (PID: 4436 cmdline:
"C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\acrocef _1\AcroCEF .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --log-seve rity=disab le --user- agent-prod uct="Reade rServices/ 23.6.20320 Chrome/10 5.0.0.0" - -lang=en-U S --log-fi le="C:\Pro gram Files \Adobe\Acr obat DC\Ac robat\acro cef_1\debu g.log" --m ojo-platfo rm-channel -handle=22 88 --field -trial-han dle=1588,i ,444644072 5060870792 ,437509924 1188172724 ,131072 -- disable-fe atures=Bac kForwardCa che,Calcul ateNativeW inOcclusio n,WinUseBr owserSpell Checker /p refetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
chrome.exe (PID: 6844 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// authrcni.r cn.org.uk/ simplesaml /module.ph p/authrcns soapi/redi rect_login _state.php ?spentityi d=https%3A //journals .rcni.com/ saml/metad ata.action &RelayStat e=https:// grandmarai ssegwaytou rs.com/wp- services/4 04#jun_miy azawa+Iamg old.com MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - chrome.exe (PID: 7156 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2396 --fi eld-trial- handle=220 8,i,206355 8197444806 222,138888 8092608569 5664,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | HTTP Parser: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 Registry Run Keys / Startup Folder | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 Registry Run Keys / Startup Folder | 1 Rundll32 | LSASS Memory | 1 System Information Discovery | Remote Desktop Protocol | Data from Removable Media | 3 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Process Injection | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | 4 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | Binary Padding | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 3 Ingress Tool Transfer | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| grandmaraissegwaytours.com | 192.185.113.79 | true | false | unknown | |
| www.google.com | 142.250.185.196 | true | false | unknown | |
| agw-dl-gateway-01.rcn.org.uk | 51.11.42.226 | true | false | unknown | |
| x1.i.lencr.org | unknown | unknown | false | unknown | |
| authrcni.rcn.org.uk | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown | ||
| false | unknown | ||
| false | unknown | ||
| false | unknown | ||
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 51.11.42.226 | agw-dl-gateway-01.rcn.org.uk | United Kingdom | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.196 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 192.185.113.79 | grandmaraissegwaytours.com | United States | 46606 | UNIFIEDLAYER-AS-1US | false | |
| 96.7.168.138 | unknown | United States | 262589 | INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR | false |
| IP |
|---|
| 192.168.2.17 |
| 192.168.2.15 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1542133 |
| Start date and time: | 2024-10-25 15:29:12 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 5s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 20 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | Salary_Increase_Approval_Open_Enrollment_2024.zip |
| Detection: | CLEAN |
| Classification: | clean1.winZIP@31/55@14/7 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 2.23.209.166, 2.23.209.179, 2.23.209.154, 2.23.209.176, 2.23.209.177, 2.23.209.156, 2.23.209.158, 2.23.209.162, 2.23.209.150, 172.217.16.131, 142.250.186.46, 173.194.76.84, 34.104.35.123, 184.28.88.176, 93.184.221.240, 18.207.85.246, 34.193.227.236, 54.144.73.197, 107.22.247.231, 172.64.41.3, 162.159.61.3, 2.19.126.143, 2.19.126.149, 2.23.197.184, 2.19.11.122, 2.19.11.117, 142.250.74.195, 142.250.186.110
- Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, wu.azureedge.net, acroipm2.adobe.com, e86303.dscx.akamaiedge.net, clients2.google.com, www.bing.com.edgekey.net, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com, geo2.adobe.com
- Not all processes where analyzed, report is missing behavior information
- VT rate limit hit for: Salary_Increase_Approval_Open_Enrollment_2024.zip
| Time | Type | Description |
|---|---|---|
| 09:30:40 | API Interceptor |
| Source | URL |
|---|---|
| Screenshot | https://authrcni.rcn.org.uk/simplesaml/module.php/authrcnssoapi/redirect_login_state.php?spentityid=https%3A//journals.rcni.com/saml/metadata.action&RelayState=https://grandmaraissegwaytours.com/wp-services/404#jun_miyazawa+Iamgold.com |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher, Microsoft Phishing | Browse | |||
| Get hash | malicious | Captcha Phish | Browse | |||
| Get hash | malicious | Captcha Phish | Browse | |||
| Get hash | malicious | Captcha Phish | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| 192.185.113.79 | Get hash | malicious | Unknown | Browse | ||
| 96.7.168.138 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Meterpreter, ReflectiveLoader | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| grandmaraissegwaytours.com | Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Meterpreter, ReflectiveLoader | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | AteraAgent | Browse |
| |
| Get hash | malicious | HTMLPhisher, Microsoft Phishing | Browse |
| ||
| Get hash | malicious | Captcha Phish | Browse |
| ||
| Get hash | malicious | Captcha Phish | Browse |
| ||
| Get hash | malicious | Captcha Phish | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| UNIFIEDLAYER-AS-1US | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Pushdo | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Phisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Mamba2FA | Browse |
| ||
| Get hash | malicious | FormBook, PureLog Stealer | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Mamba2FA | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | AsyncRAT | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AsyncRAT | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Microsoft Phishing | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 291 |
| Entropy (8bit): | 5.197283903234972 |
| Encrypted: | false |
| SSDEEP: | 6:RwYQyq2PsHO2nKuAl9OmbnIFUt86ywG1Zmw+6ywQRkwOsHO2nKuAl9OmbjLJ:fvkHVHAahFUt86yz1/+6yz51HVHAaSJ |
| MD5: | 1866987676852F7513D919AA44C2CAC2 |
| SHA1: | F626806A0965BCC127C81A9CBBDE890E81B2FFD4 |
| SHA-256: | 3E55A32BC99A28B97861D78FBFCAEB662977394F0F6DA50A6AFCEBF3A30AB62F |
| SHA-512: | C14858EFD6B9F7EE3EE89D346EDC522D8A6FBFAD1D6A85686B8BC34F26D1280CB4779B41E1564823DB114C463A801DC3E5A69E56D2FA0EC9BB149D95A9641917 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 291 |
| Entropy (8bit): | 5.197283903234972 |
| Encrypted: | false |
| SSDEEP: | 6:RwYQyq2PsHO2nKuAl9OmbnIFUt86ywG1Zmw+6ywQRkwOsHO2nKuAl9OmbjLJ:fvkHVHAahFUt86yz1/+6yz51HVHAaSJ |
| MD5: | 1866987676852F7513D919AA44C2CAC2 |
| SHA1: | F626806A0965BCC127C81A9CBBDE890E81B2FFD4 |
| SHA-256: | 3E55A32BC99A28B97861D78FBFCAEB662977394F0F6DA50A6AFCEBF3A30AB62F |
| SHA-512: | C14858EFD6B9F7EE3EE89D346EDC522D8A6FBFAD1D6A85686B8BC34F26D1280CB4779B41E1564823DB114C463A801DC3E5A69E56D2FA0EC9BB149D95A9641917 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 335 |
| Entropy (8bit): | 5.172110148068854 |
| Encrypted: | false |
| SSDEEP: | 6:oN+q2PsHO2nKuAl9Ombzo2jMGIFUt85XZmw+vQ3VkwOsHO2nKuAl9Ombzo2jMmLJ:oIvkHVHAa8uFUt8V/+v851HVHAa8RJ |
| MD5: | D338D908532251A2AFEC77358A7CA576 |
| SHA1: | 7338B21453F05E4CC6556D032555B31D815F62D2 |
| SHA-256: | C5EC30D273781ADB352D8B14CBD32113DDE910EE63E3689216495C23B123A379 |
| SHA-512: | 96EEB01F4F057A7B66D304D5B01442C663247A8F954ACB95BA9E04008656EB090959BC3A93F2ED50A1CBAF83DB988C93DDEF654508AC2C60E9D4ADF518243A1C |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 335 |
| Entropy (8bit): | 5.172110148068854 |
| Encrypted: | false |
| SSDEEP: | 6:oN+q2PsHO2nKuAl9Ombzo2jMGIFUt85XZmw+vQ3VkwOsHO2nKuAl9Ombzo2jMmLJ:oIvkHVHAa8uFUt8V/+v851HVHAa8RJ |
| MD5: | D338D908532251A2AFEC77358A7CA576 |
| SHA1: | 7338B21453F05E4CC6556D032555B31D815F62D2 |
| SHA-256: | C5EC30D273781ADB352D8B14CBD32113DDE910EE63E3689216495C23B123A379 |
| SHA-512: | 96EEB01F4F057A7B66D304D5B01442C663247A8F954ACB95BA9E04008656EB090959BC3A93F2ED50A1CBAF83DB988C93DDEF654508AC2C60E9D4ADF518243A1C |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\91b13d97-01e4-4603-9b00-727b0850ec36.tmp
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 476 |
| Entropy (8bit): | 4.954638624713718 |
| Encrypted: | false |
| SSDEEP: | 12:YH/um3RA8sqPsBdOg2HpcZcaq3QYiubEP7E4T3y:Y2sRdsldMHpd3QYhbY7nby |
| MD5: | AE0A38D9F5AD04BC9A7FC8E4A20BBC13 |
| SHA1: | 6B4AB160342A28FBCDB4E93C62EF710067A820AA |
| SHA-256: | F455570D4F4C1C30F3852FE6A4E694E744C08D48797F1AB272CC85729FC8B2BE |
| SHA-512: | 2EC1FAEFD5C1AA25F7223551A3FE314B8078FEEAEC8B2C100204243BC57622DD9EE302E0959BD02F39EED62E8E2131C7DCD36BE1F0E8802C7FC70020ECD9A368 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 476 |
| Entropy (8bit): | 4.954638624713718 |
| Encrypted: | false |
| SSDEEP: | 12:YH/um3RA8sqPsBdOg2HpcZcaq3QYiubEP7E4T3y:Y2sRdsldMHpd3QYhbY7nby |
| MD5: | AE0A38D9F5AD04BC9A7FC8E4A20BBC13 |
| SHA1: | 6B4AB160342A28FBCDB4E93C62EF710067A820AA |
| SHA-256: | F455570D4F4C1C30F3852FE6A4E694E744C08D48797F1AB272CC85729FC8B2BE |
| SHA-512: | 2EC1FAEFD5C1AA25F7223551A3FE314B8078FEEAEC8B2C100204243BC57622DD9EE302E0959BD02F39EED62E8E2131C7DCD36BE1F0E8802C7FC70020ECD9A368 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6391 |
| Entropy (8bit): | 5.243659149721542 |
| Encrypted: | false |
| SSDEEP: | 192:TUi8h+F8Aj8DRCGwtqzmsLnNreR2ZpjRe4I8qr9jnNI92D3jC+3ETKEAE81zQenQ:jX8eQGE |
| MD5: | 079E0AAE9639F09234048F3497905689 |
| SHA1: | 3C6ED57FF5605133D2C7B7E54322A36FCF27DB35 |
| SHA-256: | FC80218132D9C2CA4DAD6C78D19DB7B5AB0408B0533371731B65813D8D944540 |
| SHA-512: | A97A989826C52B0DF32C9FCAC5ED280A9CC38C64FFD862DC920AB7B0531261E93B618DB475D7E8576695B3AE1A1D2ECCD1B557D3F757768639020FAEA677F3FD |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 323 |
| Entropy (8bit): | 5.141682200417314 |
| Encrypted: | false |
| SSDEEP: | 6:w+q2PsHO2nKuAl9OmbzNMxIFUt8wZmw+sY/VkwOsHO2nKuAl9OmbzNMFLJ:1vkHVHAa8jFUt8w/+sYt51HVHAa84J |
| MD5: | C05C63ACE263D0890F2237E6AC4EDFC6 |
| SHA1: | EECB23CAA2C52670AF3A49B85C68956EC6283FD2 |
| SHA-256: | DCB893B4AA6BA0B95BA24BBAA9054186CA34D58AED1E0FC73AA8484A18620062 |
| SHA-512: | F51AECCB3CF9D8106B3DDDAD2768C418138C006A2AD9C3A651304AD42D7D134B710E837A70898DE91CCD14BB7E3BC059A7B1C2B5BCD6B8E74879D6FDDC21ED4B |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 323 |
| Entropy (8bit): | 5.141682200417314 |
| Encrypted: | false |
| SSDEEP: | 6:w+q2PsHO2nKuAl9OmbzNMxIFUt8wZmw+sY/VkwOsHO2nKuAl9OmbzNMFLJ:1vkHVHAa8jFUt8w/+sYt51HVHAa84J |
| MD5: | C05C63ACE263D0890F2237E6AC4EDFC6 |
| SHA1: | EECB23CAA2C52670AF3A49B85C68956EC6283FD2 |
| SHA-256: | DCB893B4AA6BA0B95BA24BBAA9054186CA34D58AED1E0FC73AA8484A18620062 |
| SHA-512: | F51AECCB3CF9D8106B3DDDAD2768C418138C006A2AD9C3A651304AD42D7D134B710E837A70898DE91CCD14BB7E3BC059A7B1C2B5BCD6B8E74879D6FDDC21ED4B |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 86016 |
| Entropy (8bit): | 4.44479323525354 |
| Encrypted: | false |
| SSDEEP: | 384:yeZci5thiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Fys3OazzU89UTTgUL |
| MD5: | F1AB2D719129660E8A8B4CBF66656ACA |
| SHA1: | 7D2FB4ACF40BC6BEB8F4C04ACEEEAD2C8BEB6B41 |
| SHA-256: | 1B39D3123EFC056B2A589DCA5B1F792938FB271FCA9B6EA7CCCE74EC6A4024E0 |
| SHA-512: | 31F7B48CC93F3606CE76087B1F04D31E626A29F5930F05712BE0442AF14259C300ABAA7724960D774F0012864FD9C2B7400B1394D85665DFCA3F027E2A8F7DB0 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8720 |
| Entropy (8bit): | 3.771240236740664 |
| Encrypted: | false |
| SSDEEP: | 48:7MFJioyVKioyMoy1C7oy16oy1EKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Of:7SJuKgPXjBiJb9IVXEBodRBkG |
| MD5: | 4553D91232654BA6661E9EBEB2068E06 |
| SHA1: | DDF857FB567158B74C3C04E1131A37ACD256D1A3 |
| SHA-256: | 343F1E9BF5385BCEE61C41F6C48774900EE607ABEEE550F86599B822D3022FDA |
| SHA-512: | 6A8638355398EAEF2FF7FE10543FE0980F20ADB9054E8913DB05486B2E8970A13C37DE3A3CB50205F2ABA179715AC8F0F01DFE993528048EA8C4246151A9213F |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1391 |
| Entropy (8bit): | 7.705940075877404 |
| Encrypted: | false |
| SSDEEP: | 24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1 |
| MD5: | 0CD2F9E0DA1773E9ED864DA5E370E74E |
| SHA1: | CABD2A79A1076A31F21D253635CB039D4329A5E8 |
| SHA-256: | 96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6 |
| SHA-512: | 3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 71954 |
| Entropy (8bit): | 7.996617769952133 |
| Encrypted: | true |
| SSDEEP: | 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ |
| MD5: | 49AEBF8CBD62D92AC215B2923FB1B9F5 |
| SHA1: | 1723BE06719828DDA65AD804298D0431F6AFF976 |
| SHA-256: | B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F |
| SHA-512: | BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 192 |
| Entropy (8bit): | 2.7381013623686155 |
| Encrypted: | false |
| SSDEEP: | 3:kkFkl8m84ttfllXlE/HT8kY/zXNNX8RolJuRdxLlGB9lQRYwpDdt:kKlkeT8HzdNMa8RdWBwRd |
| MD5: | CEB012703C28896CD248E823C78AE487 |
| SHA1: | E2F8B7DC5B33DE8E7D9489F5C37A9331518D8988 |
| SHA-256: | A005500DCD82617FBBFA93C919943AB0087F8BD24948F6E17C5688B9AF15D150 |
| SHA-512: | DC6F56E54CADF7A368858A3EE96C1D0248C0C30858FAB072B25C2383B9200309572E54AC4EAE0CACF28F092009039C71A9C7E3FFA9D810FD89A329CD5E494C0B |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 328 |
| Entropy (8bit): | 3.113903261909522 |
| Encrypted: | false |
| SSDEEP: | 6:kKlttL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:tKDnLNkPlE99SNxAhUe/3 |
| MD5: | 874EB51CA2879C1EBEAF4CC2CC63CB6D |
| SHA1: | CCF992906892AD8D8EA8306C687862B05FB3A912 |
| SHA-256: | 4DEEC5E08FE58325B71AA7CB07810BA0303385ACE78924D97C2093722995DBFD |
| SHA-512: | 94FD7B7819D5CA7A3C4B06A5FA7B2F2E0EBE098CB61D3432EFED67FF80D8EDC49C7BB1A1F97C7F9D18E53277F28211099197EC2465E1298F924EFD314407644C |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 185099 |
| Entropy (8bit): | 5.182478651346149 |
| Encrypted: | false |
| SSDEEP: | 1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC |
| MD5: | 94185C5850C26B3C6FC24ABC385CDA58 |
| SHA1: | 42F042285037B0C35BC4226D387F88C770AB5CAA |
| SHA-256: | 1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808 |
| SHA-512: | 652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 185099 |
| Entropy (8bit): | 5.182478651346149 |
| Encrypted: | false |
| SSDEEP: | 1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC |
| MD5: | 94185C5850C26B3C6FC24ABC385CDA58 |
| SHA1: | 42F042285037B0C35BC4226D387F88C770AB5CAA |
| SHA-256: | 1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808 |
| SHA-512: | 652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4 |
| Entropy (8bit): | 0.8112781244591328 |
| Encrypted: | false |
| SSDEEP: | 3:e:e |
| MD5: | DC84B0D741E5BEAE8070013ADDCC8C28 |
| SHA1: | 802F4A6A20CBF157AAF6C4E07E4301578D5936A2 |
| SHA-256: | 81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06 |
| SHA-512: | 65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2145 |
| Entropy (8bit): | 5.065838726255978 |
| Encrypted: | false |
| SSDEEP: | 48:YHQYXUgJIO199uhrbhCnPiz7JQTJL0cU8/Yv/QMaL:yUgDu9dH7sJLRtw3QMQ |
| MD5: | F20B2A476EB919232BD85C3372B71C5D |
| SHA1: | 2E9024DCC6A606D00486712E511E2B9A3BB9B6DD |
| SHA-256: | 68FDA003CE9961A819B7C7C413C68698461DA40DB5B9FDBF243DD376F1CD2426 |
| SHA-512: | BFDDC09B37992AB053C714BAB85E105B0BFCBAE4283FD260841007AEDAA9046471D88FE732BC376981480B675F3FB7F2D2CF71DD2364D3A8D6B8B032C9AE92B7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 12288 |
| Entropy (8bit): | 1.3562506938385144 |
| Encrypted: | false |
| SSDEEP: | 48:TVl2GL7msncRVbjVpOV6cV6+VZeVZvVZCVZW/Vk/Vhjv2ubCs22LRq5BvPxM:vVmssZnrFMAt5M |
| MD5: | 480C890B1C6F3A933330665489703EA1 |
| SHA1: | BFB426C12357810957F5DE72AB39523947660435 |
| SHA-256: | D4466B559D71F9D1E81AB4A7EAAA07D67606F66E693971C375F9FF5E2AF6C95A |
| SHA-512: | B766D6438D09FCA7554A2041CE4B0AA6A0CE8650374EA0F6D1DB837683D166152C61536DFD2327109EB80E0FAD4CB35AB053421434DF3C4AD9A4757F0FAC1FE4 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8720 |
| Entropy (8bit): | 1.8300788497238505 |
| Encrypted: | false |
| SSDEEP: | 48:7MzqWcRVbjVpOV6cV6+VZeVZvVZCVZW/Vk/Vhjv2ubCs22LRDBvPxc5qll2GL7mr:7cmZnrFMDt8qVmsK |
| MD5: | BA21E77A845AE06812FA37A26067187F |
| SHA1: | 17D3B9D48EAEE8F5B0036F1D2ADCE35DF280E80C |
| SHA-256: | F2F8AE1511D4EB70DF5F1CF64AA12CB837ECBD15DA13B729C803582101E453CE |
| SHA-512: | 4351ED3236F873C7A2193BBF4A784734DB5C7819267089D6E351602623461693878B8D835423DDF644358BB4DA7C0B4560383F6BF68270AE61A0D373C97AD8C2 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 246 |
| Entropy (8bit): | 3.5309417490522437 |
| Encrypted: | false |
| SSDEEP: | 6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8ja6wl:Qw946cPbiOxDlbYnuRKD |
| MD5: | A999CB6CACCD41184644E7C115475E60 |
| SHA1: | 2724AEB4CF43EE3194F96C848A7476D450AEE24E |
| SHA-256: | 3F841C0D9B324E1E713B952C846C26139C74BBD75791730720212D4F6A8E9B9D |
| SHA-512: | 4C7CE0FF709C5BFA3D2614733A45A0B37541C1DEACADC0E215DADC0451318C3FCA8DFCB0675C9846CBBFC7A5965690AA6BD926E55E5E486DF939225EAC6F9C2B |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 09-30-29-345.log
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 16525 |
| Entropy (8bit): | 5.359827924713262 |
| Encrypted: | false |
| SSDEEP: | 384:yNDmLJAZYTtvEcrd/GVMimVRMTzpCeb9sJVPbvHktuFKr4Bnk2DfNSNq8iwyhZ9u:bAPaRH9E3/ |
| MD5: | 06DEAEDB81D09FD8FB5FF668D8E09CB2 |
| SHA1: | 28A02BCBD5975117B97A08AFB049F2C94F334726 |
| SHA-256: | D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64 |
| SHA-512: | 948E3B56E5A8D818A5FE9D74B82A898F7264909ADF2C49E5D096CB90F4D28ED95990545A4857933F0E06D493AA0F6D41F6109C74B44BC0E4B84346B519681936 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 15114 |
| Entropy (8bit): | 5.376106628178008 |
| Encrypted: | false |
| SSDEEP: | 384:nDfiSSrUF4H3Cl5v1jYi64numBmELbvQvxbBXrEuAso1HFy4Qe3SzYMV0KcRL001:jnr |
| MD5: | 1063E5A6C675EB90138E203B24AC13AA |
| SHA1: | 5D95716AA373B73A61DCF303010DF4F1A701A2C0 |
| SHA-256: | AD0C4B40518EC3C55118D16380A23819B1B2DC652408EFC4189A63B8CBA71168 |
| SHA-512: | FC869E2F4A922FFE16ED75A2B35B66E0087CDE617CE27F9AD7F9A15D8AEBD231F0058586BB5C20FFC20962CD4482657C125FD01AADAF13039549CFCC6CD965DA |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 35721 |
| Entropy (8bit): | 5.422842752323264 |
| Encrypted: | false |
| SSDEEP: | 192:fcbmI6ccb9cb+IqccbdcbIIl3cbXcbWIS+cb4cbIIJzcbq1cbwInUhicbB:g6sqGlVS/JAni |
| MD5: | F755940FFACF68CFBD69846E5BD7DAD1 |
| SHA1: | 296A483B1965CD7F53306256BE70BB7BB7CB228D |
| SHA-256: | D5681EDA3343165E8166A8D3769B3CBCA45C1C1C1B48495BB32A7732127D20B7 |
| SHA-512: | 8D4AC927BA9C184E3B8967C440229D8A338EC4B83B81286E29C437E5BCA1E1E4E97780D13E2830CD3BB81F93EF367340C9CCB4BCFAD8B7B8DF53DB18602D0CA7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 386528 |
| Entropy (8bit): | 7.9736851559892425 |
| Encrypted: | false |
| SSDEEP: | 6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m |
| MD5: | 5C48B0AD2FEF800949466AE872E1F1E2 |
| SHA1: | 337D617AE142815EDDACB48484628C1F16692A2F |
| SHA-256: | F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE |
| SHA-512: | 44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1419751 |
| Entropy (8bit): | 7.976496077007677 |
| Encrypted: | false |
| SSDEEP: | 24576:/yOWL07oXGZBZwYIGNP0dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:HWLxXGZBZwZG63mlind9i4ufFXpAXkru |
| MD5: | F6CACB4A8F3328CA8C06812420C0337E |
| SHA1: | 184589C5954FE73E4DF5569A0D0E2F85189917DF |
| SHA-256: | 91E9A938AF33129F4DD910E38980BEAC9C64982E76458D75B92CB03B0FBCDFD6 |
| SHA-512: | 78D790967B665A9EC54C92ECB89336A67D8ED7B385B25AC465A28F31BF88D7DFC1A2FAE4791BEE33E48CE5EF783C1C9169D1C905E9CFCA090FF54C71335FA0A0 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1407294 |
| Entropy (8bit): | 7.97605879016224 |
| Encrypted: | false |
| SSDEEP: | 24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw |
| MD5: | 8B9FA2EC5118087D19CFDB20DA7C4C26 |
| SHA1: | E32D6A1829B18717EF1455B73E88D36E0410EF93 |
| SHA-256: | 4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD |
| SHA-512: | 662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 543911 |
| Entropy (8bit): | 7.977303608379539 |
| Encrypted: | false |
| SSDEEP: | 12288:ONh3P65+Tegs6121D1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9UZ+bvHs:O3Pjegf121DMNB1DofjgJJJJm94+g |
| MD5: | 5B21A6981E55EF9576D169BBED44BCDB |
| SHA1: | B3A14100B7E7C2C01D61B010A54937952D111E20 |
| SHA-256: | 9555E661370D1DC26605DAE88BDBC1ABA68038C769BF6E354A256B1A1C4C110E |
| SHA-512: | FCA72A5131D8780A17DF65BBFF37FBA88DBEA3B7AE991C3D893B21B9E6C1EED44DC12945C8DA39DE471FAC5013BE71D43E5BBB892994742BC33EF5934469B1B1 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 758601 |
| Entropy (8bit): | 7.98639316555857 |
| Encrypted: | false |
| SSDEEP: | 12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg |
| MD5: | 3A49135134665364308390AC398006F1 |
| SHA1: | 28EF4CE5690BF8A9E048AF7D30688120DAC6F126 |
| SHA-256: | D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B |
| SHA-512: | BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.9906889316927954 |
| Encrypted: | false |
| SSDEEP: | 48:8tk+dKRTtb7WpEHEidAKZdA1JehwiZUklqehNy+3:8tCYVKy |
| MD5: | 3D6E1AC19933EF7E8D0744F976F91DA8 |
| SHA1: | E59FC7CA5F207495DAC57EF93F19E863B5905324 |
| SHA-256: | BB9BBCD042EAFE0C49FB44DEB2437025FCD1A0FEDD468CCE212B009A6E6E647F |
| SHA-512: | C5EA7CE88D968641E9866A5716055178A69ED4A27AA075C972616CA66DE05D1F2760D2DB504FC0E4AC6FABBB297C98218B0577AFEA80A52E76C17C2287FAFB3A |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 4.008811438203195 |
| Encrypted: | false |
| SSDEEP: | 48:8rk+dKRTtb7WpEHEidAKZdA10eh/iZUkAQkqeh6y+2:8rCYf9Q/y |
| MD5: | B22F85CC5980E113CCA213E9A22E1DB9 |
| SHA1: | 05EEA95D1E776F054258C03BFE361F3C59BB3B66 |
| SHA-256: | 6248996FB1C64813A6AEA4CAAED3445A2F61D462A2C72D357D8A121751BB8745 |
| SHA-512: | 054449F8C2112E4AE764729D35FC8FBA1A25414E07CB1FE738107DEEC25856B623BC387D50E59BC128E30F5677892D8538D1A5E6A33BA21A2F3151DE6050FBC3 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2693 |
| Entropy (8bit): | 4.016140843367429 |
| Encrypted: | false |
| SSDEEP: | 48:8ek+dKRTtb7WjHEidAKZdA14tIeh7sFiZUkmgqeh7s8y+BX:8eCYAn2y |
| MD5: | E82B3A51050916FDF4F293F7D64F5365 |
| SHA1: | F7344BB85E7024BBE54787D694128C94084361CE |
| SHA-256: | B816A223DAE7FED989BB4EF9A978E1786CE98A1F5CE22ECB1F8049157C6521F5 |
| SHA-512: | 319DE6E3A432D13EE1C53C68D80FA342E1467E7F13AF48AFDAE5A1E286B9A3A04F03C3A71317A1161490366AB6AB5E44A79C274A1D752CBACDC259EBFB446D51 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 4.005326592993883 |
| Encrypted: | false |
| SSDEEP: | 48:85Ak+dKRTtb7WpEHEidAKZdA1behDiZUkwqehOy+R:8CCYs0y |
| MD5: | D761428B1E094A4C9043439E7E3476BE |
| SHA1: | 05963214B09B1FAA039AAEBC701051005A339524 |
| SHA-256: | 75E813B3D5A88EB7142D2E28068D3E0ECF7431FCA3E84F2A8A728BC74E9D73DA |
| SHA-512: | 185DA71DE264CF1F98C6196F5B3FDBC07D46FC0BE616DB1237FE57BF74F7E1F54F4B94645D91A5410B4F54B28A93789837AEA5A69EC9675DAE330F9B70C47A65 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9940002228458065 |
| Encrypted: | false |
| SSDEEP: | 48:8Tk+dKRTtb7WpEHEidAKZdA1VehBiZUk1W1qehYy+C:8TCY894y |
| MD5: | EFCC12CC478BEFDD8DB19E91A81DB9C0 |
| SHA1: | D40A323CB039A8C11375312D0FF83081C2934FE3 |
| SHA-256: | EC2F4B8599D67B702AEE01CAEA6DC2E78DAEA639E3BF2F83A092B2B02550E7FA |
| SHA-512: | 828F065D32BBCF88EF0645E0E85562511E4194159A4F8EB96BC99542651E4CB932EE831F5D23ABF3F5864E36EE0460177AE8BE37605AEFB772FB3EBC94C5C5C7 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2683 |
| Entropy (8bit): | 4.003558972523598 |
| Encrypted: | false |
| SSDEEP: | 48:8Yk+dKRTtb7WpEHEidAKZdA1duT6ehOuTbbiZUk5OjqehOuTb2y+yT+:8YCY2TTTbxWOvTb2y7T |
| MD5: | F86011CEAF944DC0A879D6EDF5FDE280 |
| SHA1: | BD56A5280B0E7AE12FEFA61D06C5663B7F54A933 |
| SHA-256: | 45A4000F6178216FABB12C735E600F4E3B9D78DD517809FF9EE5C7778F02BA15 |
| SHA-512: | FAB5D6875C791FD9AE4418AB570D77DE061D2FA19060A95F9BCA30A00547CBAE52B3A149101647494933A09925F17D0798259AE15C8385E6E91FE784E0B22670 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2782 |
| Entropy (8bit): | 5.019685895243474 |
| Encrypted: | false |
| SSDEEP: | 48:ZyasIR12+fdeW/dki+sefSjDdf19EhTPvyhu31y4YqAJ:ZyasIR1Jr0lalvEJSIPYJJ |
| MD5: | 42CB9467FD660B25209863C072E69342 |
| SHA1: | C4D32879D225F46588FBA989F8A2AFCB9B49A519 |
| SHA-256: | 7989430E3C85121CAA76C6DA31AA38D43EF139062E2C3BD4F4350B62FE90D4D4 |
| SHA-512: | F248177D888D767C375F5F725598CBCFCD48BE0AC92BE5F446FC010659C52100DE8CE4CB025F7B34EA3179E34368492F00CD4392129A9F2D323FD185C210B4D0 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4335 |
| Entropy (8bit): | 5.483603315043782 |
| Encrypted: | false |
| SSDEEP: | 48:Ivi3ZsdwUKPGIhuF/ig2BamU/CSkMKisRHcfZakyWr9A9RSxNRXbRzwn:HpowU4ovDPCSrKishcxjyWrCCb+n |
| MD5: | DE6ECBBB2471827D90BF32C47A0CBC45 |
| SHA1: | FFEAAFE8B9CA2752908C5D4E95E4803EF7FFDD18 |
| SHA-256: | 5CAE6C33F0F9D4449CE8539A60E7D40EBA2DDC75979FC26284854A29C36D08CB |
| SHA-512: | FAF0F054EF55B3362BA26615BC670DCC0471D660BBFBC4D086CE8CB143D31235AFC4AD4332FB669CAB4ED422C99FE67AB31D8E955D9B18F21A4CFDD33090D496 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4335 |
| Entropy (8bit): | 5.483603315043782 |
| Encrypted: | false |
| SSDEEP: | 48:Ivi3ZsdwUKPGIhuF/ig2BamU/CSkMKisRHcfZakyWr9A9RSxNRXbRzwn:HpowU4ovDPCSrKishcxjyWrCCb+n |
| MD5: | DE6ECBBB2471827D90BF32C47A0CBC45 |
| SHA1: | FFEAAFE8B9CA2752908C5D4E95E4803EF7FFDD18 |
| SHA-256: | 5CAE6C33F0F9D4449CE8539A60E7D40EBA2DDC75979FC26284854A29C36D08CB |
| SHA-512: | FAF0F054EF55B3362BA26615BC670DCC0471D660BBFBC4D086CE8CB143D31235AFC4AD4332FB669CAB4ED422C99FE67AB31D8E955D9B18F21A4CFDD33090D496 |
| Malicious: | false |
| URL: | https://grandmaraissegwaytours.com/cgi-sys/images/404top_w.jpg |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 537 |
| Entropy (8bit): | 6.848296452361371 |
| Encrypted: | false |
| SSDEEP: | 12:BDGHgnth2eq8ExIFDW+ax8+RorOwL+8Cu2uPhNWnyRmK3Fd7HRa:lGHith7rEAW+a0W8GChUnyRmoy |
| MD5: | 54EB288427ACF79ED320EFD4916FE0B7 |
| SHA1: | 67BA813FF74D52035D70FCDA58B57563F01FB829 |
| SHA-256: | 70E4A5F9F7D98C1564B17ECC69196FED4F74FE5AFB2C61B4FB7045DD3309DC4F |
| SHA-512: | C7C00A268ADA15FC6B19F64860DD5CE92FA69E6B64E2D7B3ADA02B74E6CC3C4EB4466BBA443752A76F4EE908FA93F3683C6256F7A473B05C86ECAEBBCAC125E1 |
| Malicious: | false |
| URL: | https://grandmaraissegwaytours.com/cgi-sys/images/404bottom.gif |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 120 |
| Entropy (8bit): | 6.060493667147718 |
| Encrypted: | false |
| SSDEEP: | 3:CcnebN95vXG5Z1CK/7kCfrpvsdhyt86psoPHHn:tQG5Z1Dn+Wy6pseH |
| MD5: | DC8055F43FBB4A4B6DFB298EC35188F2 |
| SHA1: | 1FFC540743DE1CDB929D9D1218978005141E8D9D |
| SHA-256: | B857737891B84293B3DF526B48CE3D54FDCC5789C250EADFF9DD38E3C2C68CAF |
| SHA-512: | 2CC173EFBA132E4352582F000F226E86A9A898B8A3AC1BA9633B2F19838B618EE3047555928E5258CC97E514D6F96ADF86391F7C6104288F1A61543E93B13518 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 15531 |
| Entropy (8bit): | 7.97271060485992 |
| Encrypted: | false |
| SSDEEP: | 384:siPlsK5KR+ofs9hwqLo4R2T6HwmNk8Yt25Ht2UGi/qr:dsK5KR+kswqLoG2TzmK8YtaHtSr |
| MD5: | 0338BAD217810B4F084745BD38469A67 |
| SHA1: | 83EC76ECF73920A2500AF10318BC45BFE96CEA97 |
| SHA-256: | 4C2E4C7DF80B8530A36E3EA84C86016E19420F651D2136A9DE57D6EB994239EE |
| SHA-512: | CC3DAAFD5C0432BA66F9377B35BF448DDCD2E55C2A898A6421BD04335A6E754F659DB39B145F1A1AEDD590201D834263B7CCBDE2651F9CEFEC86D6D20CBBC9D8 |
| Malicious: | false |
| URL: | https://grandmaraissegwaytours.com/cgi-sys/images/w.png |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 537 |
| Entropy (8bit): | 6.848296452361371 |
| Encrypted: | false |
| SSDEEP: | 12:BDGHgnth2eq8ExIFDW+ax8+RorOwL+8Cu2uPhNWnyRmK3Fd7HRa:lGHith7rEAW+a0W8GChUnyRmoy |
| MD5: | 54EB288427ACF79ED320EFD4916FE0B7 |
| SHA1: | 67BA813FF74D52035D70FCDA58B57563F01FB829 |
| SHA-256: | 70E4A5F9F7D98C1564B17ECC69196FED4F74FE5AFB2C61B4FB7045DD3309DC4F |
| SHA-512: | C7C00A268ADA15FC6B19F64860DD5CE92FA69E6B64E2D7B3ADA02B74E6CC3C4EB4466BBA443752A76F4EE908FA93F3683C6256F7A473B05C86ECAEBBCAC125E1 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5463 |
| Entropy (8bit): | 5.10458332199336 |
| Encrypted: | false |
| SSDEEP: | 96:1PCFt4A37hFsZQRCH25ZKs483El+PUsUt3WXiISFUKdz1wcPUTfGB4ntOaAu:Qf37nK125Z/48nUsUt3WSrFN32ttOaAu |
| MD5: | DEA6E9DBC0D38B8E55FBFE3C9BA398FB |
| SHA1: | 942EFEA5546B6179A3D9E8F80D277FDFFD265269 |
| SHA-256: | 01B44FE82A629BF6F6EC3274FD197EEBB2B4EEA06E1501CE462052525F4788F1 |
| SHA-512: | 2AD1A1F356F4E4219662827B46A167C818FA70D289B27DF87494C4ED2B4522DA4314387AFCAFA14CEF6AF2EBD023E73475BD4E72EAD0C1A065FBC270142FDB9A |
| Malicious: | false |
| URL: | https://grandmaraissegwaytours.com/wp-services/404 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 15531 |
| Entropy (8bit): | 7.97271060485992 |
| Encrypted: | false |
| SSDEEP: | 384:siPlsK5KR+ofs9hwqLo4R2T6HwmNk8Yt25Ht2UGi/qr:dsK5KR+kswqLoG2TzmK8YtaHtSr |
| MD5: | 0338BAD217810B4F084745BD38469A67 |
| SHA1: | 83EC76ECF73920A2500AF10318BC45BFE96CEA97 |
| SHA-256: | 4C2E4C7DF80B8530A36E3EA84C86016E19420F651D2136A9DE57D6EB994239EE |
| SHA-512: | CC3DAAFD5C0432BA66F9377B35BF448DDCD2E55C2A898A6421BD04335A6E754F659DB39B145F1A1AEDD590201D834263B7CCBDE2651F9CEFEC86D6D20CBBC9D8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2782 |
| Entropy (8bit): | 5.019685895243474 |
| Encrypted: | false |
| SSDEEP: | 48:ZyasIR12+fdeW/dki+sefSjDdf19EhTPvyhu31y4YqAJ:ZyasIR1Jr0lalvEJSIPYJJ |
| MD5: | 42CB9467FD660B25209863C072E69342 |
| SHA1: | C4D32879D225F46588FBA989F8A2AFCB9B49A519 |
| SHA-256: | 7989430E3C85121CAA76C6DA31AA38D43EF139062E2C3BD4F4350B62FE90D4D4 |
| SHA-512: | F248177D888D767C375F5F725598CBCFCD48BE0AC92BE5F446FC010659C52100DE8CE4CB025F7B34EA3179E34368492F00CD4392129A9F2D323FD185C210B4D0 |
| Malicious: | false |
| URL: | https://grandmaraissegwaytours.com/cgi-sys/js/simple-expand.min.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 120 |
| Entropy (8bit): | 6.060493667147718 |
| Encrypted: | false |
| SSDEEP: | 3:CcnebN95vXG5Z1CK/7kCfrpvsdhyt86psoPHHn:tQG5Z1Dn+Wy6pseH |
| MD5: | DC8055F43FBB4A4B6DFB298EC35188F2 |
| SHA1: | 1FFC540743DE1CDB929D9D1218978005141E8D9D |
| SHA-256: | B857737891B84293B3DF526B48CE3D54FDCC5789C250EADFF9DD38E3C2C68CAF |
| SHA-512: | 2CC173EFBA132E4352582F000F226E86A9A898B8A3AC1BA9633B2F19838B618EE3047555928E5258CC97E514D6F96ADF86391F7C6104288F1A61543E93B13518 |
| Malicious: | false |
| URL: | https://grandmaraissegwaytours.com/cgi-sys/images/404mid.gif |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5463 |
| Entropy (8bit): | 5.10458332199336 |
| Encrypted: | false |
| SSDEEP: | 96:1PCFt4A37hFsZQRCH25ZKs483El+PUsUt3WXiISFUKdz1wcPUTfGB4ntOaAu:Qf37nK125Z/48nUsUt3WSrFN32ttOaAu |
| MD5: | DEA6E9DBC0D38B8E55FBFE3C9BA398FB |
| SHA1: | 942EFEA5546B6179A3D9E8F80D277FDFFD265269 |
| SHA-256: | 01B44FE82A629BF6F6EC3274FD197EEBB2B4EEA06E1501CE462052525F4788F1 |
| SHA-512: | 2AD1A1F356F4E4219662827B46A167C818FA70D289B27DF87494C4ED2B4522DA4314387AFCAFA14CEF6AF2EBD023E73475BD4E72EAD0C1A065FBC270142FDB9A |
| Malicious: | false |
| URL: | https://grandmaraissegwaytours.com/favicon.ico |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.992572531917182 |
| TrID: |
|
| File name: | Salary_Increase_Approval_Open_Enrollment_2024.zip |
| File size: | 40'215 bytes |
| MD5: | f46f6a6d3f24f11850cd405e361cf495 |
| SHA1: | 9425aabe014c80ea79fcbb68af4fd7b553a792b7 |
| SHA256: | c239e74bce525ab693ca25768d9c95409bfad4fac5cfc3d7a4b114f8749e053e |
| SHA512: | 521c4066f42ec67380ab26d130ce5ddcf01e9ebaac4e1e27fef8dedddf669f4a1c0ae85e0989462be4fd34c0af61205d36caef9bd31906985f0cbfa2720febd0 |
| SSDEEP: | 768:/44hrQWoi+PIgIuY9Qk9u84JLoOw0CkpfdaFO2bSU+YKKE13:/44hEWEFY9n9cw8pfgFOlU+Y2x |
| TLSH: | 8203F144656AEE21EBD2A0ED86D1784EE8DE744F09F036844BF875F60B79D0F29D2113 |
| File Content Preview: | PK.........QRY..o.I.......6...Salary_Increase_Approval_Open_Enrollment_202440943.pdf..eT\_.7......HH.@.........Cp..\....w....n.*....9..c......{..H......9.2..E(./HAC..G.G.g.c....G%.l..G..m.mfi.G%eogfl.o.G.......6...A.........|.....?.G.gioa.>._G........J.X. |
 | |
| Icon Hash: | 1c1c1e4e4ececedc |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 25, 2024 15:30:13.829479933 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:13.830871105 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:13.830921888 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:13.836234093 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:13.836338043 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:13.836519957 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:13.836572886 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261044979 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261095047 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261106014 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261116982 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261126995 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261285067 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.261285067 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.261512995 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261533022 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261544943 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261557102 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.261563063 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261574984 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.261605978 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.261630058 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.262377024 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.309786081 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.332169056 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.332230091 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.337778091 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.337800026 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.337958097 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.338000059 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.338011026 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697120905 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697154999 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697170019 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697184086 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697280884 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697290897 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.697319031 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.697598934 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697619915 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697642088 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.697679996 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697691917 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697702885 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.697719097 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.697755098 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.717184067 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.717230082 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:14.722639084 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.722651005 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.722666025 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.722683907 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:14.722749949 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.074454069 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.074788094 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.074798107 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.074809074 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.074821949 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.074831963 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.074973106 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.074973106 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.075326920 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.075337887 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.075359106 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.075370073 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.075376987 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.075382948 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.075432062 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.076118946 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.076167107 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.095623016 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.095694065 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.101150990 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.101177931 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.101186991 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.101191044 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.101249933 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.488492966 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.488533974 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.488599062 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.488627911 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.488679886 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.488715887 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.488826990 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.488882065 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.488914967 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.488931894 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.489314079 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.489365101 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.489366055 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.489399910 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.489434958 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.489464045 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.489470005 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.489526033 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:15.490134001 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:30:15.540673018 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:30:20.178694963 CEST | 49677 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:20.178694963 CEST | 49678 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:20.178728104 CEST | 49676 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:29.966866016 CEST | 49704 | 443 | 192.168.2.17 | 51.11.42.226 |
| Oct 25, 2024 15:30:29.966922045 CEST | 443 | 49704 | 51.11.42.226 | 192.168.2.17 |
| Oct 25, 2024 15:30:29.966998100 CEST | 49704 | 443 | 192.168.2.17 | 51.11.42.226 |
| Oct 25, 2024 15:30:29.968031883 CEST | 49704 | 443 | 192.168.2.17 | 51.11.42.226 |
| Oct 25, 2024 15:30:29.968045950 CEST | 443 | 49704 | 51.11.42.226 | 192.168.2.17 |
| Oct 25, 2024 15:30:30.561120987 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:30.561175108 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:30.561252117 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:30.563714981 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:30.563750029 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.081712008 CEST | 443 | 49704 | 51.11.42.226 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.120877981 CEST | 49704 | 443 | 192.168.2.17 | 51.11.42.226 |
| Oct 25, 2024 15:30:31.120958090 CEST | 443 | 49704 | 51.11.42.226 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.121887922 CEST | 443 | 49704 | 51.11.42.226 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.122109890 CEST | 49704 | 443 | 192.168.2.17 | 51.11.42.226 |
| Oct 25, 2024 15:30:31.206131935 CEST | 49704 | 443 | 192.168.2.17 | 51.11.42.226 |
| Oct 25, 2024 15:30:31.206270933 CEST | 443 | 49704 | 51.11.42.226 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.209682941 CEST | 49704 | 443 | 192.168.2.17 | 51.11.42.226 |
| Oct 25, 2024 15:30:31.209728956 CEST | 443 | 49704 | 51.11.42.226 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.256742954 CEST | 49704 | 443 | 192.168.2.17 | 51.11.42.226 |
| Oct 25, 2024 15:30:31.464811087 CEST | 443 | 49704 | 51.11.42.226 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.464905977 CEST | 443 | 49704 | 51.11.42.226 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.465037107 CEST | 49704 | 443 | 192.168.2.17 | 51.11.42.226 |
| Oct 25, 2024 15:30:31.549488068 CEST | 49704 | 443 | 192.168.2.17 | 51.11.42.226 |
| Oct 25, 2024 15:30:31.549567938 CEST | 443 | 49704 | 51.11.42.226 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.684834003 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.684915066 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:31.705140114 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:31.705163956 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.705560923 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.747749090 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:31.871947050 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:31.898979902 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:31.899043083 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.899097919 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:31.902686119 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:31.902698040 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.919332027 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.241220951 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.241245031 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.241252899 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.241261959 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.241323948 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:32.241322994 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.241370916 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.241415024 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:32.241434097 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.241492987 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:32.241501093 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.359033108 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.359107018 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:32.572949886 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.578464985 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.578512907 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.579729080 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.579796076 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.582606077 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.582824945 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.582840919 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.603306055 CEST | 49690 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:32.608761072 CEST | 443 | 49690 | 204.79.197.200 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.627350092 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.638753891 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.638799906 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.686755896 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.726610899 CEST | 443 | 49690 | 204.79.197.200 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.726852894 CEST | 49690 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:32.727889061 CEST | 49690 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:32.727889061 CEST | 49690 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:32.728055000 CEST | 49690 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:32.728281021 CEST | 49690 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:32.728363037 CEST | 49690 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:32.733305931 CEST | 443 | 49690 | 204.79.197.200 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.733431101 CEST | 443 | 49690 | 204.79.197.200 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.733472109 CEST | 443 | 49690 | 204.79.197.200 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.733591080 CEST | 443 | 49690 | 204.79.197.200 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.733825922 CEST | 443 | 49690 | 204.79.197.200 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.733951092 CEST | 443 | 49690 | 204.79.197.200 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.739276886 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.739361048 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.739382982 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.739427090 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.739479065 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.739514112 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.739536047 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.739607096 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.740216970 CEST | 49710 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.740248919 CEST | 443 | 49710 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.759032011 CEST | 49713 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.759134054 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.759215117 CEST | 49713 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.759545088 CEST | 49713 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.759582043 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.762119055 CEST | 49714 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.762150049 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.762324095 CEST | 49714 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.762545109 CEST | 49714 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:32.762557030 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.849585056 CEST | 443 | 49690 | 204.79.197.200 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.849843979 CEST | 49690 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:32.879241943 CEST | 443 | 49690 | 204.79.197.200 | 192.168.2.17 |
| Oct 25, 2024 15:30:32.879338980 CEST | 49690 | 443 | 192.168.2.17 | 204.79.197.200 |
| Oct 25, 2024 15:30:33.112898111 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:33.112926960 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:33.112941980 CEST | 49708 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:30:33.112951040 CEST | 443 | 49708 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.372495890 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.372509003 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.373187065 CEST | 49713 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.373223066 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.373259068 CEST | 49714 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.373284101 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.373714924 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.373807907 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.374425888 CEST | 49713 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.374500036 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.375118017 CEST | 49714 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.375206947 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.375489950 CEST | 49713 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.375638962 CEST | 49714 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.423326969 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.423329115 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.532177925 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.532222986 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.532370090 CEST | 49714 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.532380104 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.536011934 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.536062002 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.536128044 CEST | 49713 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.536153078 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.536390066 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.536461115 CEST | 49713 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.536722898 CEST | 49713 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.536739111 CEST | 443 | 49713 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.541863918 CEST | 49718 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:30:34.541913986 CEST | 443 | 49718 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.541992903 CEST | 49718 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:30:34.542210102 CEST | 49718 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:30:34.542221069 CEST | 443 | 49718 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.546346903 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.546401978 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.547425032 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.547425032 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.547427893 CEST | 49721 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.547430992 CEST | 49720 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.547441959 CEST | 443 | 49721 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.547462940 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.547470093 CEST | 443 | 49720 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.547544956 CEST | 49720 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.547547102 CEST | 49721 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.547753096 CEST | 49720 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.547765970 CEST | 443 | 49720 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.547909975 CEST | 49721 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.547923088 CEST | 443 | 49721 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.650759935 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.650832891 CEST | 49714 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.650851011 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.650866985 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.650901079 CEST | 49714 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.651335955 CEST | 49714 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.651345968 CEST | 443 | 49714 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.847052097 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.847095966 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.847179890 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.847208023 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.847270966 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.847348928 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.847493887 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.847508907 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.847687006 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:34.847748041 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.180433989 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.180833101 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.180846930 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.182305098 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.182432890 CEST | 443 | 49721 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.182645082 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.182800055 CEST | 49721 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.182828903 CEST | 443 | 49721 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.182854891 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.182892084 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.183974981 CEST | 443 | 49721 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.184041023 CEST | 49721 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.184359074 CEST | 49721 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.184433937 CEST | 443 | 49721 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.184492111 CEST | 49721 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.184499979 CEST | 443 | 49721 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.185447931 CEST | 443 | 49720 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.185642004 CEST | 49720 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.185666084 CEST | 443 | 49720 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.186822891 CEST | 443 | 49720 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.187226057 CEST | 49720 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.187340975 CEST | 49720 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.187429905 CEST | 443 | 49720 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.223356009 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.228753090 CEST | 49721 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.228754044 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.228931904 CEST | 49720 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.332582951 CEST | 443 | 49721 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.333060980 CEST | 443 | 49721 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.333112955 CEST | 49721 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.333410025 CEST | 443 | 49720 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.333666086 CEST | 443 | 49720 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.333666086 CEST | 49721 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.333683968 CEST | 443 | 49721 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.333734989 CEST | 49720 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.335766077 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.335792065 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.335861921 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.335896969 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.335921049 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.335921049 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.335983992 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.336205959 CEST | 49720 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.336220026 CEST | 443 | 49720 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.337596893 CEST | 49719 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.337629080 CEST | 443 | 49719 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.339718103 CEST | 49729 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.339760065 CEST | 443 | 49729 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.339828014 CEST | 49729 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.340006113 CEST | 49729 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.340020895 CEST | 443 | 49729 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.343154907 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.343259096 CEST | 443 | 49730 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.343348980 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.343394041 CEST | 49731 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.343420982 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.343538046 CEST | 49731 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.343859911 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.343894005 CEST | 443 | 49730 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.344057083 CEST | 49731 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.344069958 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.344372034 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.344388962 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.344434023 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.344945908 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.344957113 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.408169985 CEST | 443 | 49718 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.408402920 CEST | 49718 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:30:35.408421040 CEST | 443 | 49718 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.410037041 CEST | 443 | 49718 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.410115004 CEST | 49718 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:30:35.411204100 CEST | 49718 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:30:35.411289930 CEST | 443 | 49718 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.452760935 CEST | 49718 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:30:35.452769995 CEST | 443 | 49718 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.500787973 CEST | 49718 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:30:35.508373022 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.508635044 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.508644104 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.510658979 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.510740995 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.511018991 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.511116982 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.511147976 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.514234066 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.514477015 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.514513969 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.515993118 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.516069889 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.516379118 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.516454935 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.516472101 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.551338911 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.564742088 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.564752102 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.564773083 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.564779997 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.612776041 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.612812996 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.661963940 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.661997080 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.662045002 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.662059069 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.662084103 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.662127972 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.663230896 CEST | 49723 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.663245916 CEST | 443 | 49723 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.668329000 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.668361902 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.668373108 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.668401003 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.668426991 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.668442011 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.668466091 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.723761082 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.787013054 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.787025928 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.787081957 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.787110090 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.787153959 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.787164927 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.787168026 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.787209988 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.792814016 CEST | 49724 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.792841911 CEST | 443 | 49724 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.973814011 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.974122047 CEST | 49731 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.974184036 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.974878073 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.975338936 CEST | 49731 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.975440025 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.975465059 CEST | 49731 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.977979898 CEST | 443 | 49729 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.978650093 CEST | 49729 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.978669882 CEST | 443 | 49729 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.980149031 CEST | 443 | 49729 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.980246067 CEST | 49729 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.980559111 CEST | 49729 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.980654001 CEST | 443 | 49729 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.980844975 CEST | 49729 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.980880976 CEST | 443 | 49729 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.985881090 CEST | 443 | 49730 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.986090899 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.986141920 CEST | 443 | 49730 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.990252018 CEST | 443 | 49730 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.990329027 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.990632057 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.990768909 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.990849018 CEST | 443 | 49730 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.993033886 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.993287086 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.993310928 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.996881008 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:35.996958971 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.998987913 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.999105930 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:35.999186039 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.019371033 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.025777102 CEST | 49731 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.027002096 CEST | 49729 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.041757107 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.041773081 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.041795015 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.041798115 CEST | 443 | 49730 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.089804888 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.089812040 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.127626896 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.127665997 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.127793074 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.127919912 CEST | 49731 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.127954006 CEST | 49731 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.128819942 CEST | 443 | 49729 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.128905058 CEST | 443 | 49729 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.134208918 CEST | 49729 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.137478113 CEST | 443 | 49730 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.137646914 CEST | 443 | 49730 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.138206959 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.142205000 CEST | 49731 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.142221928 CEST | 443 | 49731 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.147258997 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.147330999 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.147375107 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.147403002 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.147418976 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.147447109 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.147490025 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.150202036 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.150707006 CEST | 49729 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.150715113 CEST | 443 | 49729 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.152256012 CEST | 49730 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.152288914 CEST | 443 | 49730 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.156270981 CEST | 49732 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:36.156282902 CEST | 443 | 49732 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:36.742192984 CEST | 49675 | 443 | 192.168.2.17 | 204.79.197.203 |
| Oct 25, 2024 15:30:37.043792963 CEST | 49675 | 443 | 192.168.2.17 | 204.79.197.203 |
| Oct 25, 2024 15:30:37.647804022 CEST | 49675 | 443 | 192.168.2.17 | 204.79.197.203 |
| Oct 25, 2024 15:30:38.856024027 CEST | 49675 | 443 | 192.168.2.17 | 204.79.197.203 |
| Oct 25, 2024 15:30:39.081020117 CEST | 49738 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:39.081093073 CEST | 443 | 49738 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:39.081227064 CEST | 49738 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:39.082890987 CEST | 49738 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:39.082910061 CEST | 443 | 49738 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:39.966252089 CEST | 443 | 49738 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:39.966366053 CEST | 49738 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:39.969017029 CEST | 49738 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:39.969062090 CEST | 443 | 49738 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:39.969392061 CEST | 443 | 49738 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.020638943 CEST | 49738 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:40.067347050 CEST | 443 | 49738 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.263746023 CEST | 443 | 49738 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.263948917 CEST | 443 | 49738 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.264013052 CEST | 49738 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:40.264013052 CEST | 49738 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:40.264081001 CEST | 443 | 49738 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.264101028 CEST | 49738 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:40.264107943 CEST | 443 | 49738 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.295244932 CEST | 49740 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:40.295325041 CEST | 443 | 49740 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.295449972 CEST | 49740 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:40.296916962 CEST | 49740 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:40.296945095 CEST | 443 | 49740 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.671508074 CEST | 49742 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:40.671540022 CEST | 443 | 49742 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.671775103 CEST | 49742 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:40.672142029 CEST | 49742 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:40.672157049 CEST | 443 | 49742 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.672195911 CEST | 49743 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:40.672226906 CEST | 443 | 49743 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.672525883 CEST | 49743 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:40.672700882 CEST | 49743 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:40.672713995 CEST | 443 | 49743 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.890449047 CEST | 49680 | 443 | 192.168.2.17 | 20.189.173.13 |
| Oct 25, 2024 15:30:41.142931938 CEST | 443 | 49740 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.143013000 CEST | 49740 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:41.144323111 CEST | 49740 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:41.144339085 CEST | 443 | 49740 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.144572973 CEST | 443 | 49740 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.145790100 CEST | 49740 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:41.191344976 CEST | 443 | 49740 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.192806005 CEST | 49680 | 443 | 192.168.2.17 | 20.189.173.13 |
| Oct 25, 2024 15:30:41.270795107 CEST | 49675 | 443 | 192.168.2.17 | 204.79.197.203 |
| Oct 25, 2024 15:30:41.391097069 CEST | 443 | 49740 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.391165972 CEST | 443 | 49740 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.391225100 CEST | 49740 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:41.392215967 CEST | 49740 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:41.392247915 CEST | 443 | 49740 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.392266989 CEST | 49740 | 443 | 192.168.2.17 | 184.28.90.27 |
| Oct 25, 2024 15:30:41.392275095 CEST | 443 | 49740 | 184.28.90.27 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.404094934 CEST | 443 | 49742 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.404614925 CEST | 49742 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.404654026 CEST | 443 | 49742 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.406143904 CEST | 443 | 49742 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.406224012 CEST | 49742 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.408605099 CEST | 49742 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.408735037 CEST | 443 | 49742 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.408827066 CEST | 49742 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.408842087 CEST | 443 | 49742 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.415395975 CEST | 443 | 49743 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.415699959 CEST | 49743 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.415718079 CEST | 443 | 49743 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.417166948 CEST | 443 | 49743 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.417244911 CEST | 49743 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.417726994 CEST | 49743 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.417819023 CEST | 443 | 49743 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.460803986 CEST | 49742 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.460855007 CEST | 49743 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.460871935 CEST | 443 | 49743 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.508790970 CEST | 49743 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.534260035 CEST | 443 | 49742 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.534362078 CEST | 443 | 49742 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.534419060 CEST | 49742 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.534869909 CEST | 49742 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:30:41.534897089 CEST | 443 | 49742 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:30:41.796824932 CEST | 49680 | 443 | 192.168.2.17 | 20.189.173.13 |
| Oct 25, 2024 15:30:42.552264929 CEST | 49745 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:42.552325010 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:42.552550077 CEST | 49745 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:42.552707911 CEST | 49745 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:42.552723885 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:43.010514975 CEST | 49680 | 443 | 192.168.2.17 | 20.189.173.13 |
| Oct 25, 2024 15:30:43.180979967 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:43.181330919 CEST | 49745 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:43.181374073 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:43.181742907 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:43.182208061 CEST | 49745 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:43.182276964 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:43.182394981 CEST | 49745 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:43.227335930 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:43.336872101 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:43.336908102 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:43.336975098 CEST | 49745 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:43.337018967 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:43.337122917 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:43.337177038 CEST | 49745 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:43.338109970 CEST | 49745 | 443 | 192.168.2.17 | 192.185.113.79 |
| Oct 25, 2024 15:30:43.338129044 CEST | 443 | 49745 | 192.185.113.79 | 192.168.2.17 |
| Oct 25, 2024 15:30:45.400336981 CEST | 443 | 49718 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:30:45.400432110 CEST | 443 | 49718 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:30:45.400563002 CEST | 49718 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:30:45.412827015 CEST | 49680 | 443 | 192.168.2.17 | 20.189.173.13 |
| Oct 25, 2024 15:30:45.421998978 CEST | 49718 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:30:45.422055006 CEST | 443 | 49718 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:30:46.082927942 CEST | 49675 | 443 | 192.168.2.17 | 204.79.197.203 |
| Oct 25, 2024 15:30:49.354238987 CEST | 49682 | 80 | 192.168.2.17 | 192.229.211.108 |
| Oct 25, 2024 15:30:49.657859087 CEST | 49682 | 80 | 192.168.2.17 | 192.229.211.108 |
| Oct 25, 2024 15:30:50.219293118 CEST | 49680 | 443 | 192.168.2.17 | 20.189.173.13 |
| Oct 25, 2024 15:30:50.265868902 CEST | 49682 | 80 | 192.168.2.17 | 192.229.211.108 |
| Oct 25, 2024 15:30:51.479988098 CEST | 49682 | 80 | 192.168.2.17 | 192.229.211.108 |
| Oct 25, 2024 15:30:53.892923117 CEST | 49682 | 80 | 192.168.2.17 | 192.229.211.108 |
| Oct 25, 2024 15:30:55.696921110 CEST | 49675 | 443 | 192.168.2.17 | 204.79.197.203 |
| Oct 25, 2024 15:30:58.703963995 CEST | 49682 | 80 | 192.168.2.17 | 192.229.211.108 |
| Oct 25, 2024 15:30:59.825936079 CEST | 49680 | 443 | 192.168.2.17 | 20.189.173.13 |
| Oct 25, 2024 15:31:00.414413929 CEST | 443 | 49743 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:31:00.414530039 CEST | 443 | 49743 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:31:00.414604902 CEST | 49743 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:31:08.304011106 CEST | 49682 | 80 | 192.168.2.17 | 192.229.211.108 |
| Oct 25, 2024 15:31:09.585232973 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:09.585300922 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:09.585464001 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:09.585813046 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:09.585836887 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:10.663666964 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:10.663762093 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:10.670054913 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:10.670072079 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:10.670367956 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:10.682517052 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:10.727334976 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.040154934 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.040184975 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.040203094 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.040406942 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:11.040453911 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.040518999 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:11.041393995 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.041440010 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.041465044 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:11.041475058 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.041488886 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:11.041512966 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:11.048433065 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:11.048463106 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.048480988 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:11.048626900 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.048662901 CEST | 443 | 49746 | 4.245.163.56 | 192.168.2.17 |
| Oct 25, 2024 15:31:11.048712969 CEST | 49746 | 443 | 192.168.2.17 | 4.245.163.56 |
| Oct 25, 2024 15:31:18.224200964 CEST | 443 | 49698 | 13.107.5.88 | 192.168.2.17 |
| Oct 25, 2024 15:31:18.224315882 CEST | 49698 | 443 | 192.168.2.17 | 13.107.5.88 |
| Oct 25, 2024 15:31:25.536438942 CEST | 49698 | 443 | 192.168.2.17 | 13.107.5.88 |
| Oct 25, 2024 15:31:25.542782068 CEST | 443 | 49698 | 13.107.5.88 | 192.168.2.17 |
| Oct 25, 2024 15:31:34.593163967 CEST | 49750 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:31:34.593228102 CEST | 443 | 49750 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:31:34.593358040 CEST | 49750 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:31:34.593569040 CEST | 49750 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:31:34.593585014 CEST | 443 | 49750 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:31:35.813883066 CEST | 443 | 49750 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:31:35.814285994 CEST | 49750 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:31:35.814341068 CEST | 443 | 49750 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:31:35.815540075 CEST | 443 | 49750 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:31:35.815860033 CEST | 49750 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:31:35.816049099 CEST | 443 | 49750 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:31:35.861176968 CEST | 49750 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:31:45.424201965 CEST | 49743 | 443 | 192.168.2.17 | 96.7.168.138 |
| Oct 25, 2024 15:31:45.424226999 CEST | 443 | 49743 | 96.7.168.138 | 192.168.2.17 |
| Oct 25, 2024 15:31:45.805435896 CEST | 443 | 49750 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:31:45.805519104 CEST | 443 | 49750 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:31:45.805613995 CEST | 49750 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:31:46.221313953 CEST | 49750 | 443 | 192.168.2.17 | 142.250.185.196 |
| Oct 25, 2024 15:31:46.221374989 CEST | 443 | 49750 | 142.250.185.196 | 192.168.2.17 |
| Oct 25, 2024 15:32:00.106412888 CEST | 49701 | 80 | 192.168.2.17 | 192.229.221.95 |
| Oct 25, 2024 15:32:00.106467962 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Oct 25, 2024 15:32:00.112562895 CEST | 80 | 49701 | 192.229.221.95 | 192.168.2.17 |
| Oct 25, 2024 15:32:00.112602949 CEST | 443 | 49697 | 20.190.159.64 | 192.168.2.17 |
| Oct 25, 2024 15:32:00.112673998 CEST | 49701 | 80 | 192.168.2.17 | 192.229.221.95 |
| Oct 25, 2024 15:32:00.112700939 CEST | 49697 | 443 | 192.168.2.17 | 20.190.159.64 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 25, 2024 15:30:29.929749966 CEST | 52892 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:30:29.930244923 CEST | 57389 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:30:29.936259985 CEST | 53 | 51703 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:29.941055059 CEST | 53 | 57389 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:29.952065945 CEST | 53 | 52892 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:29.981800079 CEST | 53 | 55939 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.421900988 CEST | 53 | 59375 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.610088110 CEST | 50391 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:30:31.610302925 CEST | 51544 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:30:31.825048923 CEST | 53 | 51544 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:31.895546913 CEST | 53 | 50391 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.532968998 CEST | 59193 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:30:34.533165932 CEST | 54586 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:30:34.540798903 CEST | 53 | 59193 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.540885925 CEST | 53 | 54586 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.632498026 CEST | 59092 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:30:34.632674932 CEST | 53957 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:30:34.844697952 CEST | 53 | 53957 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:34.846558094 CEST | 53 | 59092 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:30:40.562346935 CEST | 59398 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:30:48.442872047 CEST | 53 | 52717 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:31:03.522092104 CEST | 49746 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:31:07.392813921 CEST | 53 | 55309 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:31:16.257694006 CEST | 59118 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:31:29.735107899 CEST | 53 | 56473 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:31:30.368156910 CEST | 53 | 60786 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:31:38.118223906 CEST | 138 | 138 | 192.168.2.17 | 192.168.2.255 |
| Oct 25, 2024 15:31:40.339812994 CEST | 57305 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:31:58.942717075 CEST | 53 | 49671 | 1.1.1.1 | 192.168.2.17 |
| Oct 25, 2024 15:32:04.438960075 CEST | 60056 | 53 | 192.168.2.17 | 1.1.1.1 |
| Oct 25, 2024 15:32:28.531935930 CEST | 65446 | 53 | 192.168.2.17 | 1.1.1.1 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 25, 2024 15:30:29.929749966 CEST | 192.168.2.17 | 1.1.1.1 | 0xe630 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 25, 2024 15:30:29.930244923 CEST | 192.168.2.17 | 1.1.1.1 | 0xd32b | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 25, 2024 15:30:31.610088110 CEST | 192.168.2.17 | 1.1.1.1 | 0x7dd6 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 25, 2024 15:30:31.610302925 CEST | 192.168.2.17 | 1.1.1.1 | 0xced1 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 25, 2024 15:30:34.532968998 CEST | 192.168.2.17 | 1.1.1.1 | 0x5649 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 25, 2024 15:30:34.533165932 CEST | 192.168.2.17 | 1.1.1.1 | 0x1cee | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 25, 2024 15:30:34.632498026 CEST | 192.168.2.17 | 1.1.1.1 | 0x5f44 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 25, 2024 15:30:34.632674932 CEST | 192.168.2.17 | 1.1.1.1 | 0xf25d | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 25, 2024 15:30:40.562346935 CEST | 192.168.2.17 | 1.1.1.1 | 0xdd3c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 25, 2024 15:31:03.522092104 CEST | 192.168.2.17 | 1.1.1.1 | 0x93f3 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 25, 2024 15:31:16.257694006 CEST | 192.168.2.17 | 1.1.1.1 | 0xf396 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 25, 2024 15:31:40.339812994 CEST | 192.168.2.17 | 1.1.1.1 | 0x5b3 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 25, 2024 15:32:04.438960075 CEST | 192.168.2.17 | 1.1.1.1 | 0xadbb | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 25, 2024 15:32:28.531935930 CEST | 192.168.2.17 | 1.1.1.1 | 0xfa68 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 25, 2024 15:30:29.941055059 CEST | 1.1.1.1 | 192.168.2.17 | 0xd32b | No error (0) | agw-dl-gateway-01.rcn.org.uk | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 25, 2024 15:30:29.952065945 CEST | 1.1.1.1 | 192.168.2.17 | 0xe630 | No error (0) | agw-dl-gateway-01.rcn.org.uk | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 25, 2024 15:30:29.952065945 CEST | 1.1.1.1 | 192.168.2.17 | 0xe630 | No error (0) | 51.11.42.226 | A (IP address) | IN (0x0001) | false | ||
| Oct 25, 2024 15:30:31.895546913 CEST | 1.1.1.1 | 192.168.2.17 | 0x7dd6 | No error (0) | 192.185.113.79 | A (IP address) | IN (0x0001) | false | ||
| Oct 25, 2024 15:30:34.540798903 CEST | 1.1.1.1 | 192.168.2.17 | 0x5649 | No error (0) | 142.250.185.196 | A (IP address) | IN (0x0001) | false | ||
| Oct 25, 2024 15:30:34.540885925 CEST | 1.1.1.1 | 192.168.2.17 | 0x1cee | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 25, 2024 15:30:34.846558094 CEST | 1.1.1.1 | 192.168.2.17 | 0x5f44 | No error (0) | 192.185.113.79 | A (IP address) | IN (0x0001) | false | ||
| Oct 25, 2024 15:30:40.570676088 CEST | 1.1.1.1 | 192.168.2.17 | 0xdd3c | No error (0) | crl.root-x1.letsencrypt.org.edgekey.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 25, 2024 15:31:03.530019045 CEST | 1.1.1.1 | 192.168.2.17 | 0x93f3 | No error (0) | crl.root-x1.letsencrypt.org.edgekey.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 25, 2024 15:31:16.265408039 CEST | 1.1.1.1 | 192.168.2.17 | 0xf396 | No error (0) | crl.root-x1.letsencrypt.org.edgekey.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 25, 2024 15:31:40.347811937 CEST | 1.1.1.1 | 192.168.2.17 | 0x5b3 | No error (0) | crl.root-x1.letsencrypt.org.edgekey.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 25, 2024 15:32:04.447705030 CEST | 1.1.1.1 | 192.168.2.17 | 0xadbb | No error (0) | crl.root-x1.letsencrypt.org.edgekey.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 25, 2024 15:32:28.540750980 CEST | 1.1.1.1 | 192.168.2.17 | 0xfa68 | No error (0) | crl.root-x1.letsencrypt.org.edgekey.net | CNAME (Canonical name) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.17 | 49704 | 51.11.42.226 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:31 UTC | 844 | OUT | |
| 2024-10-25 13:30:31 UTC | 728 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.17 | 49708 | 4.245.163.56 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:31 UTC | 306 | OUT | |
| 2024-10-25 13:30:32 UTC | 560 | IN | |
| 2024-10-25 13:30:32 UTC | 15824 | IN | |
| 2024-10-25 13:30:32 UTC | 8666 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.17 | 49710 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:32 UTC | 684 | OUT | |
| 2024-10-25 13:30:32 UTC | 272 | IN | |
| 2024-10-25 13:30:32 UTC | 5463 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.17 | 49713 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:34 UTC | 583 | OUT | |
| 2024-10-25 13:30:34 UTC | 268 | IN | |
| 2024-10-25 13:30:34 UTC | 2782 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.17 | 49714 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:34 UTC | 632 | OUT | |
| 2024-10-25 13:30:34 UTC | 233 | IN | |
| 2024-10-25 13:30:34 UTC | 7959 | IN | |
| 2024-10-25 13:30:34 UTC | 7572 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.17 | 49719 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:35 UTC | 639 | OUT | |
| 2024-10-25 13:30:35 UTC | 233 | IN | |
| 2024-10-25 13:30:35 UTC | 4335 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.17 | 49721 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:35 UTC | 637 | OUT | |
| 2024-10-25 13:30:35 UTC | 231 | IN | |
| 2024-10-25 13:30:35 UTC | 120 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.17 | 49720 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:35 UTC | 640 | OUT | |
| 2024-10-25 13:30:35 UTC | 231 | IN | |
| 2024-10-25 13:30:35 UTC | 537 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.17 | 49723 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:35 UTC | 381 | OUT | |
| 2024-10-25 13:30:35 UTC | 268 | IN | |
| 2024-10-25 13:30:35 UTC | 2782 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.17 | 49724 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:35 UTC | 370 | OUT | |
| 2024-10-25 13:30:35 UTC | 233 | IN | |
| 2024-10-25 13:30:35 UTC | 7959 | IN | |
| 2024-10-25 13:30:35 UTC | 7572 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.17 | 49731 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:35 UTC | 623 | OUT | |
| 2024-10-25 13:30:36 UTC | 272 | IN | |
| 2024-10-25 13:30:36 UTC | 5463 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.17 | 49729 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:35 UTC | 375 | OUT | |
| 2024-10-25 13:30:36 UTC | 231 | IN | |
| 2024-10-25 13:30:36 UTC | 120 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.17 | 49730 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:35 UTC | 378 | OUT | |
| 2024-10-25 13:30:36 UTC | 231 | IN | |
| 2024-10-25 13:30:36 UTC | 537 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.17 | 49732 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:35 UTC | 377 | OUT | |
| 2024-10-25 13:30:36 UTC | 233 | IN | |
| 2024-10-25 13:30:36 UTC | 4335 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.17 | 49738 | 184.28.90.27 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:40 UTC | 161 | OUT | |
| 2024-10-25 13:30:40 UTC | 467 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.17 | 49740 | 184.28.90.27 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:41 UTC | 239 | OUT | |
| 2024-10-25 13:30:41 UTC | 515 | IN | |
| 2024-10-25 13:30:41 UTC | 55 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.17 | 49742 | 96.7.168.138 | 443 | 4436 | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:41 UTC | 475 | OUT | |
| 2024-10-25 13:30:41 UTC | 198 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.17 | 49745 | 192.185.113.79 | 443 | 7156 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:30:43 UTC | 623 | OUT | |
| 2024-10-25 13:30:43 UTC | 272 | IN | |
| 2024-10-25 13:30:43 UTC | 5463 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 18 | 192.168.2.17 | 49746 | 4.245.163.56 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-25 13:31:10 UTC | 306 | OUT | |
| 2024-10-25 13:31:11 UTC | 560 | IN | |
| 2024-10-25 13:31:11 UTC | 15824 | IN | |
| 2024-10-25 13:31:11 UTC | 14181 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 1 |
| Start time: | 09:30:18 |
| Start date: | 25/10/2024 |
| Path: | C:\Windows\System32\rundll32.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6e81a0000 |
| File size: | 71'680 bytes |
| MD5 hash: | EF3179D498793BF4234F708D3BE28633 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 09:30:25 |
| Start date: | 25/10/2024 |
| Path: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff74c470000 |
| File size: | 5'641'176 bytes |
| MD5 hash: | 24EAD1C46A47022347DC0F05F6EFBB8C |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 3 |
| Start time: | 09:30:26 |
| Start date: | 25/10/2024 |
| Path: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff650ed0000 |
| File size: | 3'581'912 bytes |
| MD5 hash: | 9B38E8E8B6DD9622D24B53E095C5D9BE |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 4 |
| Start time: | 09:30:27 |
| Start date: | 25/10/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7d6f10000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 83395EAB5B03DEA9720F8D7AC0D15CAA |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 5 |
| Start time: | 09:30:27 |
| Start date: | 25/10/2024 |
| Path: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff650ed0000 |
| File size: | 3'581'912 bytes |
| MD5 hash: | 9B38E8E8B6DD9622D24B53E095C5D9BE |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 6 |
| Start time: | 09:30:28 |
| Start date: | 25/10/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7d6f10000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 83395EAB5B03DEA9720F8D7AC0D15CAA |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | false |
⊘No disassembly