HawkEye blue team ctf

At what time was the first packet captured?

What is the duration of the capture?

What is the most active computer at the link level?

Manufacturer of the NIC of the most active system at the link level?

Where is the headquarter of the company that manufactured the NIC of the most active computer at the link level?

The organization works with private addressing and netmask /24. How many computers in the organization are involved in the capture?

What is the name of the most active computer at the network level?

What is the IP of the organization's DNS server?

What domain is the victim asking about in packet 204?

What is the IP of the domain in the previous question?

Indicate the country to which the IP in the previous section belongs.

What operating system does the victim's computer run?

What is the name of the malicious file downloaded by the accountant?

What is the md5 hash of the downloaded file?

What is the name of the malware according to Malwarebytes?

What software runs the webserver that hosts the malware?

What is the public IP of the victim's computer?

In which country is the email server to which the stolen information is sent?

What is the domain's creation date to which the information is exfiltrated?

Analyzing the first extraction of information. What software runs the email server to which the stolen data is sent?

To which email account is the stolen information sent?

What is the password used by the malware to send the email?

Which malware variant exfiltrated the data?

What are the bankofamerica access credentials? (username:password)

Every how many minutes does the collected data get exfiltrated?