Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1523038 |
| MD5: | 93847e39e6beb5fef14983e436a58dbd |
| SHA1: | bb656458c1419f8ade2af5528af162b9a321f59b |
| SHA256: | bd7999eeec5f99abdab2fc9ef13ee82334827064dd6a50e6d445b4121724e7b4 |
| Tags: | exeuser-Bitsight |
| Infos: | |
 | |
Detection
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Uses taskkill to terminate processes
Classification
- System is w10x64
file.exe (PID: 7416 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 93847E39E6BEB5FEF14983E436A58DBD) 
taskkill.exe (PID: 7432 cmdline: taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) 
conhost.exe (PID: 7440 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
chrome.exe (PID: 7584 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ap p="https:/ /youtube.c om/account ?=https:// accounts.g oogle.com/ v3/signin/ challenge/ pwd" --sta rt-fullscr een --no-f irst-run - -disable-s ession-cra shed-bubbl e --disabl e-features =CrashReco very MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7796 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2080 --fi eld-trial- handle=196 0,i,346156 1876009071 434,163953 3031015912 6953,26214 4 --disabl e-features =CrashReco very /pref etch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 3276 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=55 40 --field -trial-han dle=1960,i ,346156187 6009071434 ,163953303 1015912695 3,262144 - -disable-f eatures=Cr ashRecover y /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 3280 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5612 --f ield-trial -handle=19 60,i,34615 6187600907 1434,16395 3303101591 26953,2621 44 --disab le-feature s=CrashRec overy /pre fetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00E3DBBE | |
| Source: | Code function: | 0_2_00E0C2A2 | |
| Source: | Code function: | 0_2_00E468EE | |
| Source: | Code function: | 0_2_00E4698F | |
| Source: | Code function: | 0_2_00E3D076 | |
| Source: | Code function: | 0_2_00E3D3A9 | |
| Source: | Code function: | 0_2_00E49642 | |
| Source: | Code function: | 0_2_00E4979D | |
| Source: | Code function: | 0_2_00E49B2B | |
| Source: | Code function: | 0_2_00E45C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_00E4CE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00E4EAFF | |
| Source: | Code function: | 0_2_00E4ED6A | |
| Source: | Code function: | 0_2_00E4EAFF | |
| Source: | Code function: | 0_2_00E3AA57 | |
| Source: | Code function: | 0_2_00E69576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_0fb2a797-1 | |
| Source: | String found in binary or memory: | memstr_d75fd40a-b | |
| Source: | String found in binary or memory: | memstr_860c045c-d | |
| Source: | String found in binary or memory: | memstr_a7e4fb35-0 | |
| Source: | Code function: | 0_2_00E3D5EB | |
| Source: | Code function: | 0_2_00E31201 | |
| Source: | Code function: | 0_2_00E3E8F6 | |
| Source: | Code function: | 0_2_00DDBF40 | |
| Source: | Code function: | 0_2_00E42046 | |
| Source: | Code function: | 0_2_00DD8060 | |
| Source: | Code function: | 0_2_00E38298 | |
| Source: | Code function: | 0_2_00E0E4FF | |
| Source: | Code function: | 0_2_00E0676B | |
| Source: | Code function: | 0_2_00E64873 | |
| Source: | Code function: | 0_2_00DDCAF0 | |
| Source: | Code function: | 0_2_00DFCAA0 | |
| Source: | Code function: | 0_2_00DECC39 | |
| Source: | Code function: | 0_2_00E06DD9 | |
| Source: | Code function: | 0_2_00DD91C0 | |
| Source: | Code function: | 0_2_00DEB119 | |
| Source: | Code function: | 0_2_00DF1394 | |
| Source: | Code function: | 0_2_00DF1706 | |
| Source: | Code function: | 0_2_00DF781B | |
| Source: | Code function: | 0_2_00DF19B0 | |
| Source: | Code function: | 0_2_00DE997D | |
| Source: | Code function: | 0_2_00DD7920 | |
| Source: | Code function: | 0_2_00DF7A4A | |
| Source: | Code function: | 0_2_00DF7CA7 | |
| Source: | Code function: | 0_2_00DF1C77 | |
| Source: | Code function: | 0_2_00E09EEE | |
| Source: | Code function: | 0_2_00E5BE44 | |
| Source: | Code function: | 0_2_00DF1F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00E437B5 | |
| Source: | Code function: | 0_2_00E310BF | |
| Source: | Code function: | 0_2_00E316C3 | |
| Source: | Code function: | 0_2_00E451CD | |
| Source: | Code function: | 0_2_00E5A67C | |
| Source: | Code function: | 0_2_00E4648E | |
| Source: | Code function: | 0_2_00DD42A2 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00DD42DE | |
| Source: | Code function: | 0_2_00DF0A89 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00DEF98E | |
| Source: | Code function: | 0_2_00E61C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-95042 | ||
| Source: | API coverage: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_00E3DBBE | |
| Source: | Code function: | 0_2_00E0C2A2 | |
| Source: | Code function: | 0_2_00E468EE | |
| Source: | Code function: | 0_2_00E4698F | |
| Source: | Code function: | 0_2_00E3D076 | |
| Source: | Code function: | 0_2_00E3D3A9 | |
| Source: | Code function: | 0_2_00E49642 | |
| Source: | Code function: | 0_2_00E4979D | |
| Source: | Code function: | 0_2_00E49B2B | |
| Source: | Code function: | 0_2_00E45C97 | |
| Source: | Code function: | 0_2_00DD42DE | |
| Source: | Code function: | 0_2_00E4EAA2 | |
| Source: | Code function: | 0_2_00E02622 | |
| Source: | Code function: | 0_2_00DD42DE | |
| Source: | Code function: | 0_2_00DF4CE8 | |
| Source: | Code function: | 0_2_00E30B62 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_00E02622 | |
| Source: | Code function: | 0_2_00DF083F | |
| Source: | Code function: | 0_2_00DF09D5 | |
| Source: | Code function: | 0_2_00DF0C21 | |
| Source: | Code function: | 0_2_00E31201 | |
| Source: | Code function: | 0_2_00E12BA5 | |
| Source: | Code function: | 0_2_00E3B226 | |
| Source: | Code function: | 0_2_00E522DA | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00E30B62 | |
| Source: | Code function: | 0_2_00E31663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00DF0698 | |
| Source: | Code function: | 0_2_00E48195 | |
| Source: | Code function: | 0_2_00E2D27A | |
| Source: | Code function: | 0_2_00E0B952 | |
| Source: | Code function: | 0_2_00DD42DE | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00E51204 | |
| Source: | Code function: | 0_2_00E51806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 2 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 16 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 1 Masquerading | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Virtualization/Sandbox Evasion | DCSync | 2 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 21 Access Token Manipulation | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 2 Process Injection | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 13% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.186.46 | true | false | unknown | |
| www3.l.google.com | 172.217.16.142 | true | false | unknown | |
| play.google.com | 172.217.18.14 | true | false | unknown | |
| www.google.com | 216.58.212.164 | true | false | unknown | |
| youtube.com | 216.58.206.78 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.186.46 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 216.58.212.164 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.16.206 | unknown | United States | 15169 | GOOGLEUS | false | |
| 172.217.18.14 | play.google.com | United States | 15169 | GOOGLEUS | false | |
| 216.58.206.78 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 172.217.16.142 | www3.l.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.8 |
| 192.168.2.6 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1523038 |
| Start date and time: | 2024-10-01 00:41:06 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 57s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 16 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal64.evad.winEXE@31/38@12/9 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.185.131, 142.250.184.238, 66.102.1.84, 34.104.35.123, 142.250.181.227, 142.250.186.35, 172.217.16.202, 216.58.206.42, 142.250.186.74, 142.250.186.42, 216.58.212.170, 142.250.74.202, 216.58.206.74, 142.250.185.106, 142.250.186.170, 172.217.23.106, 142.250.184.202, 172.217.18.10, 142.250.186.138, 142.250.181.234, 142.250.185.74, 142.250.186.106, 192.229.221.95, 216.58.212.138, 142.250.185.138, 142.250.185.170, 142.250.185.202, 172.217.18.106, 142.250.185.163, 142.250.186.174
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 1138de370e523e824bbca92d049a3777 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.9781108324261654 |
| Encrypted: | false |
| SSDEEP: | 48:8ew0dYTcYAHKidAKZdA1oehwiZUklqehQy+3:8vHvovy |
| MD5: | EB8F29D8D3533D03FDD0FF392FF60BC0 |
| SHA1: | 58603F277E0B738DD98E4736781F4498B60792A8 |
| SHA-256: | 105304121BEAE6AF296C89C59D790A731975C35BCD585FE5CDC8BB7065455309 |
| SHA-512: | A47E7C26BC0D9AE660C3417856CF709A15AB0AF358D69DF38D396FC6B57F703F0FCC895F44E33FD35485C4D8F0F2D7343D79AF21ED6EEEC8FE39F1B243BD260B |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9919946505824435 |
| Encrypted: | false |
| SSDEEP: | 48:80w0dYTcYAHKidAKZdA1leh/iZUkAQkqehfy+2:85HvC9QWy |
| MD5: | 009CF82501CE14177D55B11E8E6F5ADC |
| SHA1: | 55F6913F9EAEFF8EF46EBA9F6EDC1A4CF1A59DAA |
| SHA-256: | E6778C5343ED8550BD336F1CBE13BD725C81D404508177E5CAF126D0EF875B30 |
| SHA-512: | 3A927BD0F65067ACA72D3E960720F7F028BE657C98318038AE0DA8400E04D2F14A08B6B3A52A96C5A3E4889F608A0F076CB00B9FF8D09B09F04C4E92AFCDE3C9 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2693 |
| Entropy (8bit): | 4.005613010052517 |
| Encrypted: | false |
| SSDEEP: | 48:8Aw0dYTcYbHKidAKZdA14t5eh7sFiZUkmgqeh7sVy+BX:8tHvvnjy |
| MD5: | BE202AD485C6FEE2D89D0F53D08A6648 |
| SHA1: | 05AFF6E0857F6BDF567F2805FE1D0A5DE9CD34BA |
| SHA-256: | 76A78D6B41F319D2EF74B7280361BD9C4EA73457607FC269F7A57E738B62DB50 |
| SHA-512: | D8E4C47D81627C856403CA9615479A49B70F4A810DA55E0A6C886EEC8A804ED27E6A6A2103458646C93C01811B0E75DBAC8EF09ED1B9C9F00C16A67FAC954A60 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.993305191230751 |
| Encrypted: | false |
| SSDEEP: | 48:8aw0dYTcYAHKidAKZdA16ehDiZUkwqehLy+R:8jHvZdy |
| MD5: | 5D7C5BFD989313A37F36313B190B99A2 |
| SHA1: | 7318C7EDAFA6C140ACE0A2AA93CE940A7FFBB6A9 |
| SHA-256: | 9A010458361DC200E6929835C847F894C6D5B55033BE03ED6CB34BFB2A5E9F3C |
| SHA-512: | 40E4D41B66BF7C294601DE07C461B4B96AC9945B3D16A4C582366E46D9729332988FA936B0B0E1330AE647B97223F351ACD9779FAAB197276E776E1A338099DF |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9809607012948147 |
| Encrypted: | false |
| SSDEEP: | 48:89w0dYTcYAHKidAKZdA1UehBiZUk1W1qehJy+C:8KHvJ9py |
| MD5: | 1D32A8F916F3F47F3012CF14F0B95E73 |
| SHA1: | 34B5F2A6591B10FB6B8CCD69A3F51825D093F747 |
| SHA-256: | 267F8A049CC4175C0F475B339D6F98DBDE10AD7C8D550AD0BD32FC318B1A3C10 |
| SHA-512: | 82544E3C9E191AEB1B1BF5A77CDA280806D559617FAB73830845C3CF57E7F641DB798DD2AC1BA5AA7D8963B4479270DC8D760B873AAB51A68780831DB4C71605 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2683 |
| Entropy (8bit): | 3.9931572183694004 |
| Encrypted: | false |
| SSDEEP: | 48:8Ww0dYTcYAHKidAKZdA1duTrehOuTbbiZUk5OjqehOuTbjy+yT+:8HHv2TYTbxWOvTbjy7T |
| MD5: | EA6BD35ACF62BE26D518404A46CFE453 |
| SHA1: | 43B6817C76F9979CDBA1BA99D1CFC6A8441E22D5 |
| SHA-256: | 201DF935478F13E3C58EDC971268D287960C422A4E2B7B841AF1A496C287380C |
| SHA-512: | 7D481BEE656D318A31C382300FFEE9054DBE171A62F1D5CE1B51A91A6DAEDBB47C43BDF02181A97C19FDDBFB458AD428A068776F60D235DBCD76B2C97C0DE13B |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1652 |
| Entropy (8bit): | 5.296387798840289 |
| Encrypted: | false |
| SSDEEP: | 48:o7YNJvl3WlDQENrpB3stYCIgMxILNH/wf7DVTBpdQrw:o5fpB8iDwYlGw |
| MD5: | F18EA2D35027D6173E2864B5863CB6E3 |
| SHA1: | 1979174E786593DAFD2B23084F26332AB929216C |
| SHA-256: | 547E151C2D842255451D651B749239B28DED9F803B524A77BD1E14D878BDAF58 |
| SHA-512: | A031A439A99BCA557951A75234766033145E7D05E8453A4FE9BC0EA091E49BA59AF1479850D1E896B2D114575A80CCE111A787E7EEA9A7F288C78AD325436C18 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,NwH0H,OmgaI,gychg,w9hDv,EEDORb,Mlhmy,ZfAoz,kWgXee,ovKuLd,yDVVkb,ebZ3mb,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.3750044852869046 |
| Encrypted: | false |
| SSDEEP: | 48:o7zfN/cD498xdg+Y5jNQ8js6npwk0OmNAEZbpMzR4EQBcW5QcHj9KWfGAeFKRrw:oCD9dA5jOEGh+EFqR4rhqUhzff9w |
| MD5: | 39693D34EE3D1829DBB1627C4FC6687B |
| SHA1: | A03303C2F027F3749B48D5134D1F8FB3E495C6E9 |
| SHA-256: | 03B0C1B4E402E0BCF75D530DD9085B25357EEFD09E238453DE1F3A042542C076 |
| SHA-512: | AC0749EDC33DA0EC0E40470388DD797B6528AD08B8FAC1C2AC42F85198131052BA1B533E90409D35DA237607E8B07D591FA6BA580B6A90B0D0AB2282A01F7585 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22827 |
| Entropy (8bit): | 5.420322672717721 |
| Encrypted: | false |
| SSDEEP: | 384:/jqdWXWfyA20UUjDE8BSUxDJs16KHvSN34kaHaN+587SaXD2mLR0H:/jqdWXAUUjDE84Wi6KPSKjHaN+58+0J2 |
| MD5: | 2B29741A316862EE788996DD29116DD5 |
| SHA1: | 9D5551916D4452E977C39B8D69CF88DF2AAA462B |
| SHA-256: | 62955C853976B722EFBB4C116A10DB3FF54580EDD7495D280177550B8F4289AB |
| SHA-512: | 6E37C3258F07F29909763728DADE0CD40A3602D55D9099F78B37756926FCF2A50008B82876B518FEAF3E56617F0F7D1D37A73C346A99A58E6AD8BCD6689E9B15 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 358292 |
| Entropy (8bit): | 5.622523467644739 |
| Encrypted: | false |
| SSDEEP: | 3072:sy/lJpABa9hEP2iyjV5ygVLdh3YB4qyhLD6Crjyp3Sm5pnrjtuo0MpLEKusgI8sw:TyTNoygVWyhoDAMpL5gI8seqfhP3p+L |
| MD5: | 14049A4F8FB34A2FA52A0358C72B2F2E |
| SHA1: | 680985BDBE3FA830B31A9F02D40AFE925C12E70E |
| SHA-256: | 56C112F31C6F61735FE5EBD188AD0928406F04454AFEC139297328D3EE6540B4 |
| SHA-512: | 5637742A7E2936540D957BA8A09991478EF0D4C28A3DA92D5260C7D5DA7BFD20811AFA26C0B53DD88D4A536B3C40A21ACA3310EFC17508A1C806B76ACB320631 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,EFQ78c,EIOG1e,GwYlN,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,y5vRwf,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 603951 |
| Entropy (8bit): | 5.789948381047936 |
| Encrypted: | false |
| SSDEEP: | 3072:W0pApkygA62bwwdnO2YflNYhFGOizdGj008PpVVM96C5bMEPQUhts6FV8eKqtVAT:WlgNmwwdnOsF98oNGuQRAYqXsI1+ |
| MD5: | A97373CC3F8795654F3C8C6B57066AE7 |
| SHA1: | F7BECFDDE230EF537E8745B598DCED737C490C3C |
| SHA-256: | A1B0568D555DC4B4AF4CC5A6C41E838B702816445C04FF002C8A13058387F311 |
| SHA-512: | 47C76D26F4F9F206F93186800E06D3DBE1FDD0A1BA23FB9A3556390DE7F86C1FFB2C78FE307FB944C690475BFBAE9738C38233E00FDDFA9775A3B2030081D7F1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEQAz5EZnBR6fK6LIn1v8ILsATM3g/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.3872171131917925 |
| Encrypted: | false |
| SSDEEP: | 192:FK/pAzN7GZ068Hqhqu6DQaVapzYjgKItwdiwUsYRTi1j1t9bRl9:FqI7GZ04dRYjghtgisYYbt9ll9 |
| MD5: | AB70454DE18E1CE16E61EAC290FC304D |
| SHA1: | 68532B5E8B262D7E14B8F4507AA69A61146B3C18 |
| SHA-256: | B32D746867CC4FA21FD39437502F401D952D0A3E8DC708DFB7D58B85F256C0F1 |
| SHA-512: | A123C517380BEF0B47F23A5A6E1D16650FE39D9C701F9FA5ADD79294973C118E8EA3A7BA32CB63C3DFC0CE0F843FB86BFFCAA2AAE987629E7DFF84F176DEBB98 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32499 |
| Entropy (8bit): | 5.361345284201954 |
| Encrypted: | false |
| SSDEEP: | 768:mLX1O+aL6fgyIiREM4RKmh90toLoTswtF3ATcbDR6kIsnJd9DPyMv/FI:U2M4oltoLoTswtFoc/tIsnXFLI |
| MD5: | D5C3FB8EAE24AB7E40009338B5078496 |
| SHA1: | 5638BF5986A6445A88CD79A9B690B744B126BEC2 |
| SHA-256: | 597C14D360D690BCFDC2B8D315E6BB8879AEF33DE6C30D274743079BDB63C6B0 |
| SHA-512: | 6AE434850D473BEF15AA694AB4862596982CDDA6BD3991991D3ADD8F4A5F61DFBF8756D0DA98B72EF083909D68CF7B6B148A6488E9381F92FBF15CCB20176A0E |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 339369 |
| Entropy (8bit): | 5.533022690974177 |
| Encrypted: | false |
| SSDEEP: | 3072:9hFx8tVGv15Iyr4t4s2GvgHVTYDh+rvVvurtVEWzcLmLyszIm8j2kzU:9NlvE+zTYDh+rvh8cLMijFg |
| MD5: | FF16B667178352EFDF164CE3F16A8F55 |
| SHA1: | E9B1BC661337502E31306B5E7AE37D93C0551455 |
| SHA-256: | 625EC33FBA1BFF3734490AC15C8430CDB5850E9159B80F607E093BB73B7F243B |
| SHA-512: | F197393CB05F94BCEDA0FE3176842E09CFCFC2348DE22C9815DD8369D5D333038E8F93F426994482E2E9731A859FA9B6B6062BAD4AA3BFD3C0730281C4CCADB9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.253939888205379 |
| Encrypted: | false |
| SSDEEP: | 48:o7BNJfeFb8L3A6FHqIy5Z+d70OCzSfvi/3fM/r8ZQzRrw:oFuILhFHrVCz0vLZz9w |
| MD5: | 10FF6F99E3228E96AFD6E2C30EF97C0A |
| SHA1: | 4AE3DCB8D1F5A0C302D5BAD9DFF5050A7A5E8130 |
| SHA-256: | 95E5546E1C7F311D07BB5050CC456A973E43BCC4777BA6014757376016537679 |
| SHA-512: | 116C0B1CAC98A27044100005545AB66BE5F4801D75DC259093A9F145B3A4ACD8DC1C360AF525F6DC8421CD54B675A78023D2ED8B57F5946A3969543758C673C9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1416 |
| Entropy (8bit): | 5.299417038163051 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7JqrxsNL90YIzFK/Hb5eNhz1uktdDuvKKKGbLZ99GbSSF/ZR8OkdnprGJ:o7JopFN+ASCKKGbF99GbSS3RY7rw |
| MD5: | 6AEAE74D22F7C2D9658B057EA5D85069 |
| SHA1: | 2F4644F53FB4E8EC4AFD49A31C55853F062D284C |
| SHA-256: | EBFE7B5A1020808B9A02667ECC0E7E460643CBDE84F0B9C410C70A91C9726667 |
| SHA-512: | C43F067D649CBC3091B9878715F718E47CD753C860EBEB20CD387C325640C2EF3CA9556D0689852CEF667C8E83BF42568BEF33C8A92BC07FDB91CB7EA608162D |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3471 |
| Entropy (8bit): | 5.5174491302699495 |
| Encrypted: | false |
| SSDEEP: | 96:ojAmjTJ/fJgpIcB7Fd2tilGBEMO/A6VxV08w:vUTJpgDJXM0ApJ |
| MD5: | 2D999C87DD54C7FE6400D267C33FBB23 |
| SHA1: | 414C3A329C2760325EDBACBD7A221D7F8DBFEEE8 |
| SHA-256: | 76D55A1AFC1D39CB04D60EB04E45A538A0E75EE2871561C84CC89B1C13596BCC |
| SHA-512: | 72D923BB71DD147139962FF8E2BD0E336E0F6409C212AC2F25387D0F3B4FC9365F5A6D40E2980BB1065534888362C97D6B7663E362D29166B5915D2A9DA7D238 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5049 |
| Entropy (8bit): | 5.317800104741948 |
| Encrypted: | false |
| SSDEEP: | 96:oHX9gPiPrfnHhsB0TR6kg1oDPJzLmM18Vh1z2fEZ54TZtnqj6w:EtEAr6BmPZtOeEvW/ncP |
| MD5: | CE53EF566B68CCF2D62FA044CFB0D138 |
| SHA1: | F48EC60289F2B55E8B388601206888F8295B1EB1 |
| SHA-256: | E6CC5114D92811D5DE0663266D4B63F367834AFA0FC3BAFA54F707038C59D010 |
| SHA-512: | 20B434881DE971E263669E6096C01665D4D35B0FBFF47D312A4A442645EE962A8CE6AD7E68246D4EE9691BD30D9B1DDCF7059226492E1B58CD3191B63B001E4D |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,FCpbqb,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WhJNk,WpP9Yc,Wt6vjf,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,hhhU8,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4070 |
| Entropy (8bit): | 5.362700670482359 |
| Encrypted: | false |
| SSDEEP: | 96:GUpT+TmXtdW1qsHFcn7t7CnyWYvNTcLaQOw:lpT+qXW1PFcn7tGnyWY1TGb |
| MD5: | ED368A20CB303C0E7C6A3E6E43C2E14F |
| SHA1: | 429A5C538B45221F80405163D1F87912DD73C05A |
| SHA-256: | 93BA77AD4B11E0A70C0D36576F0DF24E27F50001EA02BAA6D357E034532D97F2 |
| SHA-512: | DE74BBADE910475DD245FFEFD4E1FD10137DE710B1C920D33BA52554911496E1339EF3C1F6D9D315CBC98A60ABE5687A3E7D8BEE483708E18D25722E794BDBE9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.579675855847615 |
| TrID: |
|
| File name: | file.exe |
| File size: | 917'504 bytes |
| MD5: | 93847e39e6beb5fef14983e436a58dbd |
| SHA1: | bb656458c1419f8ade2af5528af162b9a321f59b |
| SHA256: | bd7999eeec5f99abdab2fc9ef13ee82334827064dd6a50e6d445b4121724e7b4 |
| SHA512: | 20b393ed1180aaf95e945b411b18f152fe083f8834558c3f5c48df9fe280efa3f82a2d06f165f099b0c5ea749ed647bc67e0ce7495a5d048e6b881f52534ceb5 |
| SSDEEP: | 12288:6qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDganTH:6qDEvCTbMWu7rQYlBQcBiT6rprG8aTH |
| TLSH: | 7E159E0273D1C062FF9B92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FB28CD [Mon Sep 30 22:40:13 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F5FB0C96393h |
| jmp 00007F5FB0C95C9Fh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F5FB0C95E7Dh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F5FB0C95E4Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F5FB0C98A3Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F5FB0C98A88h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F5FB0C98A71h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9548 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9548 | 0x9600 | feb6cb0d0a0b6ce094eb9e57911afe63 | False | 0.2833072916666667 | data | 5.1660807891532805 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0x80e | data | 1.0053346265761396 | ||
| RT_GROUP_ICON | 0xdcfc8 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd040 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd054 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd068 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd07c | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd158 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 00:41:56.068274975 CEST | 49673 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:41:56.380897999 CEST | 49672 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:41:56.990221024 CEST | 49676 | 443 | 192.168.2.8 | 52.182.143.211 |
| Oct 1, 2024 00:41:58.255745888 CEST | 49671 | 443 | 192.168.2.8 | 204.79.197.203 |
| Oct 1, 2024 00:41:58.599464893 CEST | 49677 | 80 | 192.168.2.8 | 192.229.211.108 |
| Oct 1, 2024 00:42:05.677822113 CEST | 49673 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:42:05.986066103 CEST | 49672 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:42:06.599466085 CEST | 49676 | 443 | 192.168.2.8 | 52.182.143.211 |
| Oct 1, 2024 00:42:07.603468895 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:07.603523016 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:07.603605986 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:07.605135918 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:07.605148077 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:07.669285059 CEST | 443 | 49704 | 23.206.229.226 | 192.168.2.8 |
| Oct 1, 2024 00:42:07.669365883 CEST | 49704 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:42:08.242799997 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.243100882 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:08.243119001 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.243534088 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.243597031 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:08.244826078 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.244884968 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:08.246792078 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:08.246881008 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.247064114 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:08.247072935 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.295713902 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:08.523191929 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.523279905 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.523485899 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:08.524153948 CEST | 49705 | 443 | 192.168.2.8 | 216.58.206.78 |
| Oct 1, 2024 00:42:08.524174929 CEST | 443 | 49705 | 216.58.206.78 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.533891916 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:08.533924103 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.533989906 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:08.534312963 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:08.534327984 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:09.231703043 CEST | 49677 | 80 | 192.168.2.8 | 192.229.211.108 |
| Oct 1, 2024 00:42:09.279109001 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:09.281512022 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:09.281533957 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:09.281940937 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:09.282011032 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:09.282639980 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:09.282694101 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:09.283593893 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:09.283653975 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:09.283755064 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:09.283763885 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:09.327738047 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:09.589543104 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:09.589561939 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:09.589638948 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:09.589649916 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:09.589688063 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:09.618587971 CEST | 49711 | 443 | 192.168.2.8 | 142.250.186.46 |
| Oct 1, 2024 00:42:09.618607044 CEST | 443 | 49711 | 142.250.186.46 | 192.168.2.8 |
| Oct 1, 2024 00:42:11.540513039 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:11.540549994 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:11.540626049 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:11.540824890 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:11.540843010 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:12.194679022 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:12.214620113 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:12.214634895 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:12.215848923 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:12.215924978 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:12.219268084 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:12.219357967 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:12.264857054 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:12.264883995 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:12.311749935 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:12.376576900 CEST | 49717 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:12.376630068 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:12.376715899 CEST | 49717 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:12.378201962 CEST | 49717 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:12.378227949 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:13.035137892 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:13.035238981 CEST | 49717 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:13.039793015 CEST | 49717 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:13.039809942 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:13.040060997 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:13.076411963 CEST | 49717 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:13.119404078 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:13.309946060 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:13.310005903 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:13.310050964 CEST | 49717 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:13.310137033 CEST | 49717 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:13.310153961 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:13.310164928 CEST | 49717 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:13.310169935 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:13.363502026 CEST | 49720 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:13.363562107 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:13.363650084 CEST | 49720 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:13.363977909 CEST | 49720 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:13.364007950 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:14.079252005 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:14.079435110 CEST | 49720 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:14.080713034 CEST | 49720 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:14.080735922 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:14.080975056 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:14.083923101 CEST | 49720 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:14.127413034 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:14.357136011 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:14.357203007 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:14.357553959 CEST | 49720 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:14.359491110 CEST | 49720 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:14.359491110 CEST | 49720 | 443 | 192.168.2.8 | 184.28.90.27 |
| Oct 1, 2024 00:42:14.359503031 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:14.359513044 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.8 |
| Oct 1, 2024 00:42:16.189616919 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:16.189651966 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:16.189810991 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:16.190924883 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:16.190943003 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:16.629081964 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:16.629106045 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:16.629185915 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:16.629580975 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:16.629591942 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:16.898721933 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:16.898808956 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:16.900815010 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:16.900830984 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:16.901082993 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:16.950632095 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:17.206077099 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:17.247415066 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.261395931 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.261693001 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.261714935 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.262073040 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.262125015 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.262756109 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.262811899 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.264338970 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.264394045 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.264828920 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.264834881 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.312004089 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.443491936 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.443512917 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.443521023 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.443535089 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.443562031 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.443582058 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:17.443608046 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.443625927 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:17.443654060 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:17.444490910 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.444566965 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.444576979 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:17.444621086 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:17.455945015 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:17.455966949 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.455982924 CEST | 49732 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:17.455991983 CEST | 443 | 49732 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.577101946 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.577363014 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.577413082 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.577430964 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.577441931 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.577466011 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.582287073 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.582328081 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.582336903 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.588634968 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.588663101 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.588675022 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.588680983 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.588710070 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.595442057 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.595491886 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.601229906 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.601264000 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.601293087 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.601300955 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.601337910 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.663777113 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.663845062 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.663903952 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.663949013 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.666820049 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.666872025 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.672935009 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.672970057 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.672986031 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.672998905 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.673037052 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.679344893 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.679399967 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.685532093 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.685597897 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.685611963 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.691939116 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.691989899 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.692006111 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.698272943 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.698321104 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.698331118 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.698539972 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:17.698565006 CEST | 443 | 49733 | 172.217.16.142 | 192.168.2.8 |
| Oct 1, 2024 00:42:17.698610067 CEST | 49733 | 443 | 192.168.2.8 | 172.217.16.142 |
| Oct 1, 2024 00:42:18.082967997 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.083029985 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.083105087 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.100368977 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.100425959 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.100487947 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.101547003 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.101563931 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.101867914 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.101881027 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.761852026 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.762178898 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.762206078 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.762594938 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.762664080 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.763303041 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.763370991 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.766204119 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.766294003 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.766930103 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.766946077 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.766958952 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.767183065 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.767193079 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.767584085 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.767640114 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.768311024 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.768358946 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.768527031 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.768594980 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.768660069 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.768666983 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.812179089 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:18.812351942 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.008404970 CEST | 49704 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:42:19.008404970 CEST | 49704 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:42:19.010988951 CEST | 49744 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:42:19.011032104 CEST | 443 | 49744 | 23.206.229.226 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.011725903 CEST | 49744 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:42:19.012094975 CEST | 49744 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:42:19.012109995 CEST | 443 | 49744 | 23.206.229.226 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.013222933 CEST | 443 | 49704 | 23.206.229.226 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.013236046 CEST | 443 | 49704 | 23.206.229.226 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.041254997 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:19.061743975 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.062196970 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.062262058 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.062340021 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.062365055 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.062376022 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.062458038 CEST | 49738 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.063375950 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.063429117 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.063568115 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.064171076 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.064194918 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.069086075 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.069569111 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.069577932 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.069602966 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.069624901 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.069647074 CEST | 49737 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.070535898 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.070578098 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.070766926 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.071074963 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.071098089 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.087404966 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.308070898 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.308124065 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.308160067 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.308191061 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.308207989 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:19.308233023 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.308248043 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:19.308605909 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.308649063 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:19.309978008 CEST | 49716 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:42:19.309992075 CEST | 443 | 49716 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.614692926 CEST | 443 | 49744 | 23.206.229.226 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.616889954 CEST | 49744 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:42:19.697918892 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.700330019 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.700347900 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.700716019 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.700764894 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.701422930 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.701472998 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.703742981 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.703795910 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.704216003 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.704222918 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.704236031 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.722331047 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.722796917 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.722807884 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.723172903 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.723226070 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.723915100 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.723957062 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.723963976 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.724307060 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.724363089 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.724452019 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.724458933 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.724471092 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.751394987 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.767393112 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.911396980 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.911436081 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.919394016 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.921058893 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.921998978 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.922069073 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.922785044 CEST | 49745 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.922796011 CEST | 443 | 49745 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.941029072 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.941145897 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:19.941262007 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.942399979 CEST | 49746 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:19.942406893 CEST | 443 | 49746 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:25.687402964 CEST | 49752 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:25.687446117 CEST | 443 | 49752 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:25.687633038 CEST | 49752 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:25.688021898 CEST | 49752 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:25.688040018 CEST | 443 | 49752 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:26.322479963 CEST | 443 | 49752 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:26.322798014 CEST | 49752 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:26.322829962 CEST | 443 | 49752 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:26.323554039 CEST | 443 | 49752 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:26.323865891 CEST | 49752 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:26.323930025 CEST | 443 | 49752 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:26.324003935 CEST | 49752 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:26.324024916 CEST | 49752 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:26.324295044 CEST | 443 | 49752 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:26.645560026 CEST | 443 | 49752 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:26.646450996 CEST | 443 | 49752 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:26.646579981 CEST | 49752 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:26.648255110 CEST | 49752 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:26.648277998 CEST | 443 | 49752 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:38.830509901 CEST | 443 | 49744 | 23.206.229.226 | 192.168.2.8 |
| Oct 1, 2024 00:42:38.830651045 CEST | 49744 | 443 | 192.168.2.8 | 23.206.229.226 |
| Oct 1, 2024 00:42:47.660985947 CEST | 49703 | 80 | 192.168.2.8 | 88.221.110.106 |
| Oct 1, 2024 00:42:47.666039944 CEST | 80 | 49703 | 88.221.110.106 | 192.168.2.8 |
| Oct 1, 2024 00:42:47.666208029 CEST | 49703 | 80 | 192.168.2.8 | 88.221.110.106 |
| Oct 1, 2024 00:42:48.078686953 CEST | 49753 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:48.078738928 CEST | 443 | 49753 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:48.078835964 CEST | 49753 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:48.079134941 CEST | 49753 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:48.079149008 CEST | 443 | 49753 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:48.713633060 CEST | 443 | 49753 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:48.714939117 CEST | 49753 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:48.714971066 CEST | 443 | 49753 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:48.715501070 CEST | 443 | 49753 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:48.724627018 CEST | 49754 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:48.724680901 CEST | 443 | 49754 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:48.724745035 CEST | 49754 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:48.725014925 CEST | 49753 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:48.725137949 CEST | 443 | 49753 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:48.725236893 CEST | 49754 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:48.725245953 CEST | 443 | 49754 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:48.725649118 CEST | 49753 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:48.725692034 CEST | 49753 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:48.725766897 CEST | 443 | 49753 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.019063950 CEST | 443 | 49753 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.033883095 CEST | 443 | 49753 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.033945084 CEST | 49753 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.034238100 CEST | 49753 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.034257889 CEST | 443 | 49753 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.384845972 CEST | 443 | 49754 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.385179043 CEST | 49754 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.385193110 CEST | 443 | 49754 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.385560036 CEST | 443 | 49754 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.385852098 CEST | 49754 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.385910034 CEST | 443 | 49754 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.386002064 CEST | 49754 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.386013985 CEST | 49754 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.386027098 CEST | 443 | 49754 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.619733095 CEST | 443 | 49754 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.620721102 CEST | 443 | 49754 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.620800018 CEST | 49754 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.621104956 CEST | 49754 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.621121883 CEST | 443 | 49754 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.688347101 CEST | 49755 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.688399076 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:49.688507080 CEST | 49755 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.688834906 CEST | 49755 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:49.688855886 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:50.349726915 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:50.350117922 CEST | 49755 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:50.350145102 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:50.350735903 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:50.351038933 CEST | 49755 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:50.351111889 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:50.351197004 CEST | 49755 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:50.351197004 CEST | 49755 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:50.351233006 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:50.658056974 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:50.658657074 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:50.658751011 CEST | 49755 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:50.659121990 CEST | 49755 | 443 | 192.168.2.8 | 172.217.18.14 |
| Oct 1, 2024 00:42:50.659142017 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.8 |
| Oct 1, 2024 00:42:54.426877022 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:54.426930904 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:54.427009106 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:54.427390099 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:54.427402973 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.344896078 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.345036030 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:55.346421003 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:55.346430063 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.346683025 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.348014116 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:55.395394087 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.613289118 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.613308907 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.613322973 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.613430977 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:55.613460064 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.613509893 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:55.614888906 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.614924908 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.614979982 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:55.614986897 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.614998102 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.615003109 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:55.615053892 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:55.616410017 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:55.616425991 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:42:55.616483927 CEST | 49756 | 443 | 192.168.2.8 | 13.85.23.86 |
| Oct 1, 2024 00:42:55.616488934 CEST | 443 | 49756 | 13.85.23.86 | 192.168.2.8 |
| Oct 1, 2024 00:43:11.594083071 CEST | 49758 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:43:11.594197989 CEST | 443 | 49758 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:43:11.594301939 CEST | 49758 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:43:11.594527006 CEST | 49758 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:43:11.594564915 CEST | 443 | 49758 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:43:12.225831985 CEST | 443 | 49758 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:43:12.226250887 CEST | 49758 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:43:12.226284027 CEST | 443 | 49758 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:43:12.226643085 CEST | 443 | 49758 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:43:12.226952076 CEST | 49758 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:43:12.227013111 CEST | 443 | 49758 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:43:12.279603958 CEST | 49758 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:43:18.711415052 CEST | 49760 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:18.711462975 CEST | 443 | 49760 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:18.711528063 CEST | 49760 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:18.711760998 CEST | 49760 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:18.711781025 CEST | 443 | 49760 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:19.353879929 CEST | 443 | 49760 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:19.354409933 CEST | 49760 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:19.354444027 CEST | 443 | 49760 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:19.354815960 CEST | 443 | 49760 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:19.355120897 CEST | 49760 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:19.355180979 CEST | 443 | 49760 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:19.355264902 CEST | 49760 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:19.355281115 CEST | 49760 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:19.355329990 CEST | 443 | 49760 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:19.652640104 CEST | 443 | 49760 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:19.653388977 CEST | 443 | 49760 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:19.653455973 CEST | 49760 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:19.653765917 CEST | 49760 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:19.653805017 CEST | 443 | 49760 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:20.127486944 CEST | 49761 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:20.127536058 CEST | 443 | 49761 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:20.127619028 CEST | 49761 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:20.127854109 CEST | 49761 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:20.127871990 CEST | 443 | 49761 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:20.772108078 CEST | 443 | 49761 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:20.772414923 CEST | 49761 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:20.772453070 CEST | 443 | 49761 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:20.772847891 CEST | 443 | 49761 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:20.773164988 CEST | 49761 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:20.773241043 CEST | 443 | 49761 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:20.773349047 CEST | 49761 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:20.773370028 CEST | 49761 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:20.773427010 CEST | 443 | 49761 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:21.076561928 CEST | 443 | 49761 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:21.076711893 CEST | 443 | 49761 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:21.076767921 CEST | 49761 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:21.077122927 CEST | 49761 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:21.077143908 CEST | 443 | 49761 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:22.146648884 CEST | 443 | 49758 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:43:22.146727085 CEST | 443 | 49758 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:43:22.146898031 CEST | 49758 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:43:35.093278885 CEST | 49758 | 443 | 192.168.2.8 | 216.58.212.164 |
| Oct 1, 2024 00:43:35.093321085 CEST | 443 | 49758 | 216.58.212.164 | 192.168.2.8 |
| Oct 1, 2024 00:43:48.987345934 CEST | 49763 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:48.987410069 CEST | 443 | 49763 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:48.987478971 CEST | 49763 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:48.987925053 CEST | 49763 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:48.987940073 CEST | 443 | 49763 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:49.625931978 CEST | 443 | 49763 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:49.626305103 CEST | 49763 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:49.626317024 CEST | 443 | 49763 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:49.626691103 CEST | 443 | 49763 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:49.627321005 CEST | 49763 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:49.627321005 CEST | 49763 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:49.627334118 CEST | 443 | 49763 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:49.627342939 CEST | 49763 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:49.627396107 CEST | 443 | 49763 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:49.670056105 CEST | 49763 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:49.965579987 CEST | 443 | 49763 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:49.975028038 CEST | 443 | 49763 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:49.975178957 CEST | 49763 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:49.975301981 CEST | 49763 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:49.975313902 CEST | 443 | 49763 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:52.813699961 CEST | 49764 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:52.813755035 CEST | 443 | 49764 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:52.813831091 CEST | 49764 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:52.814133883 CEST | 49764 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:52.814148903 CEST | 443 | 49764 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:53.456413984 CEST | 443 | 49764 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:53.462527990 CEST | 49764 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:53.462554932 CEST | 443 | 49764 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:53.463007927 CEST | 443 | 49764 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:53.463426113 CEST | 49764 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:53.463491917 CEST | 443 | 49764 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:53.463608980 CEST | 49764 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:53.463640928 CEST | 49764 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:53.463644981 CEST | 443 | 49764 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:53.783107996 CEST | 443 | 49764 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:53.783551931 CEST | 443 | 49764 | 172.217.16.206 | 192.168.2.8 |
| Oct 1, 2024 00:43:53.783629894 CEST | 49764 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:53.841902971 CEST | 49764 | 443 | 192.168.2.8 | 172.217.16.206 |
| Oct 1, 2024 00:43:53.841928959 CEST | 443 | 49764 | 172.217.16.206 | 192.168.2.8 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 00:42:07.571696997 CEST | 56869 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:42:07.572052002 CEST | 64722 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:42:07.576004982 CEST | 53 | 60433 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:07.578457117 CEST | 53 | 56869 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:07.578587055 CEST | 53 | 64722 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:07.628971100 CEST | 53 | 54248 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.526659966 CEST | 63951 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:42:08.526792049 CEST | 60657 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:42:08.533257961 CEST | 53 | 60657 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.533375025 CEST | 53 | 63951 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:08.632432938 CEST | 53 | 49662 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:11.529303074 CEST | 50762 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:42:11.529479027 CEST | 63164 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:42:11.539580107 CEST | 53 | 50762 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:11.539702892 CEST | 53 | 63164 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:14.360042095 CEST | 53 | 50185 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:16.619080067 CEST | 51447 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:42:16.619254112 CEST | 49525 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:42:16.628284931 CEST | 53 | 51447 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:16.628313065 CEST | 53 | 49525 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.066764116 CEST | 55486 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:42:18.066982031 CEST | 61081 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:42:18.073348999 CEST | 53 | 55486 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:18.073559999 CEST | 53 | 61081 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:20.304791927 CEST | 53 | 55276 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:25.768177032 CEST | 53 | 64680 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:45.371045113 CEST | 53 | 53923 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:42:47.409873962 CEST | 138 | 138 | 192.168.2.8 | 192.168.2.255 |
| Oct 1, 2024 00:43:07.178234100 CEST | 53 | 61930 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:43:07.493385077 CEST | 53 | 65171 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:43:18.700274944 CEST | 53 | 58149 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:43:18.703459024 CEST | 57840 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:43:18.703627110 CEST | 55585 | 53 | 192.168.2.8 | 1.1.1.1 |
| Oct 1, 2024 00:43:18.710208893 CEST | 53 | 57840 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:43:18.711046934 CEST | 53 | 55585 | 1.1.1.1 | 192.168.2.8 |
| Oct 1, 2024 00:43:35.101459980 CEST | 53 | 64566 | 1.1.1.1 | 192.168.2.8 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 00:42:07.571696997 CEST | 192.168.2.8 | 1.1.1.1 | 0x726 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 00:42:07.572052002 CEST | 192.168.2.8 | 1.1.1.1 | 0x8cc5 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 00:42:08.526659966 CEST | 192.168.2.8 | 1.1.1.1 | 0xce18 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 00:42:08.526792049 CEST | 192.168.2.8 | 1.1.1.1 | 0xbc2e | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 00:42:11.529303074 CEST | 192.168.2.8 | 1.1.1.1 | 0x51ad | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 00:42:11.529479027 CEST | 192.168.2.8 | 1.1.1.1 | 0x92a2 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 00:42:16.619080067 CEST | 192.168.2.8 | 1.1.1.1 | 0xe3a1 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 00:42:16.619254112 CEST | 192.168.2.8 | 1.1.1.1 | 0x47dc | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 00:42:18.066764116 CEST | 192.168.2.8 | 1.1.1.1 | 0x4f2f | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 00:42:18.066982031 CEST | 192.168.2.8 | 1.1.1.1 | 0x6020 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 00:43:18.703459024 CEST | 192.168.2.8 | 1.1.1.1 | 0x855 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 00:43:18.703627110 CEST | 192.168.2.8 | 1.1.1.1 | 0xc7d7 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 00:42:07.578457117 CEST | 1.1.1.1 | 192.168.2.8 | 0x726 | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:07.578587055 CEST | 1.1.1.1 | 192.168.2.8 | 0x8cc5 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 00:42:08.533257961 CEST | 1.1.1.1 | 192.168.2.8 | 0xbc2e | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533257961 CEST | 1.1.1.1 | 192.168.2.8 | 0xbc2e | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:08.533375025 CEST | 1.1.1.1 | 192.168.2.8 | 0xce18 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:11.539580107 CEST | 1.1.1.1 | 192.168.2.8 | 0x51ad | No error (0) | 216.58.212.164 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:11.539702892 CEST | 1.1.1.1 | 192.168.2.8 | 0x92a2 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 00:42:16.628284931 CEST | 1.1.1.1 | 192.168.2.8 | 0xe3a1 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:16.628284931 CEST | 1.1.1.1 | 192.168.2.8 | 0xe3a1 | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:16.628313065 CEST | 1.1.1.1 | 192.168.2.8 | 0x47dc | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 00:42:18.073348999 CEST | 1.1.1.1 | 192.168.2.8 | 0x4f2f | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 00:43:18.710208893 CEST | 1.1.1.1 | 192.168.2.8 | 0x855 | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.8 | 49705 | 216.58.206.78 | 443 | 7796 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-30 22:42:08 UTC | 847 | OUT | |
| 2024-09-30 22:42:08 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.8 | 49711 | 142.250.186.46 | 443 | 7796 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-30 22:42:09 UTC | 865 | OUT | |
| 2024-09-30 22:42:09 UTC | 2634 | IN |