Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1523122 |
| MD5: | 01c227c31afb774df17ea789878018a4 |
| SHA1: | 9db323a49e28f69730ca0bdbc31c3d7058342737 |
| SHA256: | ef8f1aec6f7dccd1d1a39f575a341e4b12981337ea3ac39c8cb00c22acfdc0a5 |
| Tags: | exeuser-Bitsight |
| Infos: | |
 | |
Detection
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
file.exe (PID: 7288 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 01C227C31AFB774DF17EA789878018A4) 
chrome.exe (PID: 7304 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ap p="https:/ /youtube.c om/account ?=https:// accounts.g oogle.com/ v3/signin/ challenge/ pwd" --sta rt-fullscr een --no-f irst-run - -disable-s ession-cra shed-bubbl e --disabl e-features =CrashReco very MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7548 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2104 --fi eld-trial- handle=200 0,i,975313 8536552679 466,130783 6382780113 3179,26214 4 --disabl e-features =CrashReco very /pref etch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 8148 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=55 72 --field -trial-han dle=2000,i ,975313853 6552679466 ,130783638 2780113317 9,262144 - -disable-f eatures=Cr ashRecover y /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6604 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=4596 --f ield-trial -handle=20 00,i,97531 3853655267 9466,13078 3638278011 33179,2621 44 --disab le-feature s=CrashRec overy /pre fetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_006EDBBE | |
| Source: | Code function: | 0_2_006BC2A2 | |
| Source: | Code function: | 0_2_006F68EE | |
| Source: | Code function: | 0_2_006F698F | |
| Source: | Code function: | 0_2_006ED076 | |
| Source: | Code function: | 0_2_006ED3A9 | |
| Source: | Code function: | 0_2_006F9642 | |
| Source: | Code function: | 0_2_006F979D | |
| Source: | Code function: | 0_2_006F9B2B | |
| Source: | Code function: | 0_2_006F5C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_006FCE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_006FEAFF | |
| Source: | Code function: | 0_2_006FED6A | |
| Source: | Code function: | 0_2_006FEAFF | |
| Source: | Code function: | 0_2_006EAA57 | |
| Source: | Code function: | 0_2_00719576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_2412378f-d | |
| Source: | String found in binary or memory: | memstr_def99581-4 | |
| Source: | String found in binary or memory: | memstr_d54255f1-0 | |
| Source: | String found in binary or memory: | memstr_76478aa4-0 | |
| Source: | Code function: | 0_2_006ED5EB | |
| Source: | Code function: | 0_2_006E1201 | |
| Source: | Code function: | 0_2_006EE8F6 | |
| Source: | Code function: | 0_2_0068BF40 | |
| Source: | Code function: | 0_2_00688060 | |
| Source: | Code function: | 0_2_006F2046 | |
| Source: | Code function: | 0_2_006E8298 | |
| Source: | Code function: | 0_2_006BE4FF | |
| Source: | Code function: | 0_2_006B676B | |
| Source: | Code function: | 0_2_00714873 | |
| Source: | Code function: | 0_2_0068CAF0 | |
| Source: | Code function: | 0_2_006ACAA0 | |
| Source: | Code function: | 0_2_0069CC39 | |
| Source: | Code function: | 0_2_006B6DD9 | |
| Source: | Code function: | 0_2_0069D07D | |
| Source: | Code function: | 0_2_0069B119 | |
| Source: | Code function: | 0_2_006891C0 | |
| Source: | Code function: | 0_2_006A1394 | |
| Source: | Code function: | 0_2_006A1706 | |
| Source: | Code function: | 0_2_006A781B | |
| Source: | Code function: | 0_2_0069997D | |
| Source: | Code function: | 0_2_00687920 | |
| Source: | Code function: | 0_2_006A19B0 | |
| Source: | Code function: | 0_2_006A7A4A | |
| Source: | Code function: | 0_2_006A1C77 | |
| Source: | Code function: | 0_2_006A7CA7 | |
| Source: | Code function: | 0_2_0070BE44 | |
| Source: | Code function: | 0_2_006B9EEE | |
| Source: | Code function: | 0_2_006A1F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_006F37B5 | |
| Source: | Code function: | 0_2_006E10BF | |
| Source: | Code function: | 0_2_006E16C3 | |
| Source: | Code function: | 0_2_006F51CD | |
| Source: | Code function: | 0_2_006ED4DC | |
| Source: | Code function: | 0_2_006F648E | |
| Source: | Code function: | 0_2_006842A2 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_006842DE | |
| Source: | Code function: | 0_2_006A22FC | |
| Source: | Code function: | 0_2_006A0A89 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_0069F98E | |
| Source: | Code function: | 0_2_00711C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-95835 | ||
| Source: | API coverage: | ||
| Source: | Code function: | 0_2_006EDBBE | |
| Source: | Code function: | 0_2_006BC2A2 | |
| Source: | Code function: | 0_2_006F68EE | |
| Source: | Code function: | 0_2_006F698F | |
| Source: | Code function: | 0_2_006ED076 | |
| Source: | Code function: | 0_2_006ED3A9 | |
| Source: | Code function: | 0_2_006F9642 | |
| Source: | Code function: | 0_2_006F979D | |
| Source: | Code function: | 0_2_006F9B2B | |
| Source: | Code function: | 0_2_006F5C97 | |
| Source: | Code function: | 0_2_006842DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_006FEAA2 | |
| Source: | Code function: | 0_2_006B2622 | |
| Source: | Code function: | 0_2_006842DE | |
| Source: | Code function: | 0_2_006A4CE8 | |
| Source: | Code function: | 0_2_006E0B62 | |
| Source: | Code function: | 0_2_006B2622 | |
| Source: | Code function: | 0_2_006A083F | |
| Source: | Code function: | 0_2_006A09D5 | |
| Source: | Code function: | 0_2_006A0C21 | |
| Source: | Code function: | 0_2_006E1201 | |
| Source: | Code function: | 0_2_006C2BA5 | |
| Source: | Code function: | 0_2_006EB226 | |
| Source: | Code function: | 0_2_007022DA | |
| Source: | Code function: | 0_2_006E0B62 | |
| Source: | Code function: | 0_2_006E1663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_006A0698 | |
| Source: | Code function: | 0_2_006F8195 | |
| Source: | Code function: | 0_2_006DD27A | |
| Source: | Code function: | 0_2_006BB952 | |
| Source: | Code function: | 0_2_006842DE | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00701204 | |
| Source: | Code function: | 0_2_00701806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 15 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 1 Masquerading | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Virtualization/Sandbox Evasion | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 21 Access Token Manipulation | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 2 Process Injection | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 13% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 1% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.185.110 | true | false |
| unknown |
| www3.l.google.com | 172.217.16.142 | true | false |
| unknown |
| play.google.com | 172.217.16.142 | true | false |
| unknown |
| www.google.com | 142.250.186.164 | true | false |
| unknown |
| youtube.com | 142.250.185.78 | true | false |
| unknown |
| accounts.youtube.com | unknown | unknown | false |
| unknown |
| www.youtube.com | unknown | unknown | false |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.185.78 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.110 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.186.164 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.184.228 | unknown | United States | 15169 | GOOGLEUS | false | |
| 172.217.16.142 | www3.l.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.5 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1523122 |
| Start date and time: | 2024-10-01 06:16:07 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 35s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 10 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal64.evad.winEXE@31/36@13/7 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.186.142, 74.125.133.84, 142.250.184.227, 34.104.35.123, 142.250.186.170, 142.250.185.202, 142.250.186.42, 142.250.185.74, 142.250.181.234, 142.250.184.234, 142.250.185.138, 216.58.206.42, 142.250.186.74, 172.217.16.202, 142.250.186.106, 172.217.18.10, 142.250.185.170, 142.250.185.234, 142.250.185.106, 142.250.184.202, 172.217.18.3, 216.58.212.138, 216.58.212.170, 199.232.214.172, 192.229.221.95, 172.217.16.195, 142.251.5.84, 142.250.184.206
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | HTMLPhisher | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.973107534883377 |
| Encrypted: | false |
| SSDEEP: | 48:8VdnjTLTdfH5idAKZdA19ehwiZUklqehQy+3:8/jDdz/y |
| MD5: | 4031A8C4065ABA9F34C42538A2C0B022 |
| SHA1: | 895F07EE6F9CBCC12F9E7B70B70E44C8981F7CEC |
| SHA-256: | A767DA0EC8D6F57DA01E009866FBB4F0EEE807696BCF762394A1C8B28449205F |
| SHA-512: | BFE82925003555D1D24DF4E545074354FDB9307B3ACC74B8398D8D68D7CD3F41DB54EF808B04F1B4D2A9CE1AD319FCB50EFB42187374D341E36AD037DCC48A1D |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9915915736755836 |
| Encrypted: | false |
| SSDEEP: | 48:8ldnjTLTdfH5idAKZdA1weh/iZUkAQkqehvy+2:8vjDdB9QWy |
| MD5: | 6E17F5886A2F8FBBC2705D9EBF39AC8B |
| SHA1: | B5185DBE4355E1BE8B3D6A3E848F6A1570A1CA45 |
| SHA-256: | 598FF34F0BDEC4B609DD487C1733D9961B2C007A8A1B1C75D621BD4326C76B0E |
| SHA-512: | 5876CA0BCA417554A9D475AD883E3E7C721251736F5349126DA544BA403F98EF136363D02F9F7022C5309B3AAA499CB28C8FB47489020AF48E8F52072575A939 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2693 |
| Entropy (8bit): | 4.003164598438365 |
| Encrypted: | false |
| SSDEEP: | 48:8xMdnjTLTsH5idAKZdA14tseh7sFiZUkmgqeh7sdy+BX:8xgjDYnLy |
| MD5: | 1A781CDFAE62884CD68EEBA134C9C4E5 |
| SHA1: | F4E1C7976DB5F0C78FADAD872E60916FDE22BE7D |
| SHA-256: | 40B4DC5954BEE9DCB4884E1D5B91400D84607B728BF41FFB51658EE9573C59C8 |
| SHA-512: | B53D1830D30E6958879A7400B49476FB81E5B723B376923D2521BF7CF14D4A89B063A88F6178BDA43657A195C7161A15550759B0B0CF8F0E0CD1B19C1257A442 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9920520151611965 |
| Encrypted: | false |
| SSDEEP: | 48:8AdnjTLTdfH5idAKZdA1vehDiZUkwqehjy+R:8EjDdiVy |
| MD5: | A106B9AE5A0392F11FA5947C551A4AB6 |
| SHA1: | 5DC8548877774FC952048D784FD06E50614B8281 |
| SHA-256: | 7622CA6AC1A6B73DC1B5C3E49CA37412EBD245DC3D07F82FC2C6F9CAB7D5A3CC |
| SHA-512: | F6D76BD9211E218A7F8E94265C934C0D3EC152631F385C3F605E174FF22E5701BC6A6FFE33EF389C3103F55C06CC0E2351DA8E601DDEA6267FCEB4E1E6E5B2A7 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9809035011998803 |
| Encrypted: | false |
| SSDEEP: | 48:8TdnjTLTdfH5idAKZdA1hehBiZUk1W1qehJy+C:81jDdS9py |
| MD5: | 8BF99209ED2A5A2BF8D6010605AA3C5B |
| SHA1: | 66D9D7BC7DDAF51A910BC0954EF82E8916C9CB28 |
| SHA-256: | BECE39ECCCDC0D579F7519D0D61E4999BC15D65BE0598599DF039CB8857E60C0 |
| SHA-512: | DB22CA3A56E71DA65E6BFBA413C103D4E6C6F02B7F570F6D7778EB5B942EF80E2E3DFC59B12D80AE1CB9F6B2D8186C06C069858B42AC288F86C390C5A27B6CA1 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2683 |
| Entropy (8bit): | 3.9876281893727277 |
| Encrypted: | false |
| SSDEEP: | 48:8TdnjTLTdfH5idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:81jDdMT/TbxWOvTbLy7T |
| MD5: | 13492FDC1657527D228FE34737BBB034 |
| SHA1: | DD5F36A3C16158EB5E0C2B5A327D4777A8EE6733 |
| SHA-256: | F7A4850EB3D56337748FAA9A6367C8793AEE0228CED401C8EE08F02EC98B595F |
| SHA-512: | BE91D8E4B4C646336BB200EE5DEC5E6C29EC5980A02E24F03E61FB52CA673B8CF9476ABFEAF7BD343C46939C75601B7D5C92D5CE42AA7535F22D1F62B0317E92 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22827 |
| Entropy (8bit): | 5.420322672717721 |
| Encrypted: | false |
| SSDEEP: | 384:/jqdWXWfyA20UUjDE8BSUxDJs16KHvSN34kaHaN+587SaXD2mLR0H:/jqdWXAUUjDE84Wi6KPSKjHaN+58+0J2 |
| MD5: | 2B29741A316862EE788996DD29116DD5 |
| SHA1: | 9D5551916D4452E977C39B8D69CF88DF2AAA462B |
| SHA-256: | 62955C853976B722EFBB4C116A10DB3FF54580EDD7495D280177550B8F4289AB |
| SHA-512: | 6E37C3258F07F29909763728DADE0CD40A3602D55D9099F78B37756926FCF2A50008B82876B518FEAF3E56617F0F7D1D37A73C346A99A58E6AD8BCD6689E9B15 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5049 |
| Entropy (8bit): | 5.317800104741948 |
| Encrypted: | false |
| SSDEEP: | 96:oHX9gPiPrfnHhsB0TR6kg1oDPJzLmM18Vh1z2fEZ54TZtnqj6w:EtEAr6BmPZtOeEvW/ncP |
| MD5: | CE53EF566B68CCF2D62FA044CFB0D138 |
| SHA1: | F48EC60289F2B55E8B388601206888F8295B1EB1 |
| SHA-256: | E6CC5114D92811D5DE0663266D4B63F367834AFA0FC3BAFA54F707038C59D010 |
| SHA-512: | 20B434881DE971E263669E6096C01665D4D35B0FBFF47D312A4A442645EE962A8CE6AD7E68246D4EE9691BD30D9B1DDCF7059226492E1B58CD3191B63B001E4D |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 603951 |
| Entropy (8bit): | 5.789949489744101 |
| Encrypted: | false |
| SSDEEP: | 3072:x0pApkygA62bwwdnO2YflNYhFGOizdGj008PpVVM96C5bMEPQUhts6FV8eKqtVAT:xlgNmwwdnOsF98oNGuQRAYqXsI1+ |
| MD5: | 036BC6CEC1912EAA63C716C2A7494AFC |
| SHA1: | C32891F55B0D7A86DCE1BDBB7B84DB21C2A09F4F |
| SHA-256: | 1A6181C3DFAEE5919CE57152DCFFCDC4B151C5FB2969CFD62168C1711FF202CF |
| SHA-512: | 0AAA2285D109114921B5FD8A15F9A3D1F218AF8C61054B3925965E6753F8A49B45798326EA986C4A6B6180B6C36292A4652E2BA730C7505684DAAA4B5C314675 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGsNipZrCRRMFQh1-tVmHSsIDzQTA/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.316515499943097 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DduJqrxsNL90YIzFK/Hb5eNhz1uktdDuvKKKGbLZ99GbSSF/ZR8OkdnprGJ:o7DQJopFN+ASCKKGbF99GbSS3RY7rw |
| MD5: | D97AB4594FC610665FF2763A650EE6A8 |
| SHA1: | 5C7459CA838D27BE45745571D8D96D156F4B9F8D |
| SHA-256: | 767D778369623FD8F5FB98D3BCC3130D05D02CBE0B9B88DD226F43281B14E9AF |
| SHA-512: | CE4941B41C3A8CC983C1BBCC87EF682823CB9DB24EA7A570E35BBF832046340D433F7D47211384B61FA38F3527CC35C195A6068CCB24B48E1F492C5B4D4192A1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.3872171131917925 |
| Encrypted: | false |
| SSDEEP: | 192:FK/pAzN7GZ068Hqhqu6DQaVapzYjgKItwdiwUsYRTi1j1t9bRl9:FqI7GZ04dRYjghtgisYYbt9ll9 |
| MD5: | AB70454DE18E1CE16E61EAC290FC304D |
| SHA1: | 68532B5E8B262D7E14B8F4507AA69A61146B3C18 |
| SHA-256: | B32D746867CC4FA21FD39437502F401D952D0A3E8DC708DFB7D58B85F256C0F1 |
| SHA-512: | A123C517380BEF0B47F23A5A6E1D16650FE39D9C701F9FA5ADD79294973C118E8EA3A7BA32CB63C3DFC0CE0F843FB86BFFCAA2AAE987629E7DFF84F176DEBB98 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.3750044852869046 |
| Encrypted: | false |
| SSDEEP: | 48:o7zfN/cD498xdg+Y5jNQ8js6npwk0OmNAEZbpMzR4EQBcW5QcHj9KWfGAeFKRrw:oCD9dA5jOEGh+EFqR4rhqUhzff9w |
| MD5: | 39693D34EE3D1829DBB1627C4FC6687B |
| SHA1: | A03303C2F027F3749B48D5134D1F8FB3E495C6E9 |
| SHA-256: | 03B0C1B4E402E0BCF75D530DD9085B25357EEFD09E238453DE1F3A042542C076 |
| SHA-512: | AC0749EDC33DA0EC0E40470388DD797B6528AD08B8FAC1C2AC42F85198131052BA1B533E90409D35DA237607E8B07D591FA6BA580B6A90B0D0AB2282A01F7585 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32499 |
| Entropy (8bit): | 5.361345284201954 |
| Encrypted: | false |
| SSDEEP: | 768:mLX1O+aL6fgyIiREM4RKmh90toLoTswtF3ATcbDR6kIsnJd9DPyMv/FI:U2M4oltoLoTswtFoc/tIsnXFLI |
| MD5: | D5C3FB8EAE24AB7E40009338B5078496 |
| SHA1: | 5638BF5986A6445A88CD79A9B690B744B126BEC2 |
| SHA-256: | 597C14D360D690BCFDC2B8D315E6BB8879AEF33DE6C30D274743079BDB63C6B0 |
| SHA-512: | 6AE434850D473BEF15AA694AB4862596982CDDA6BD3991991D3ADD8F4A5F61DFBF8756D0DA98B72EF083909D68CF7B6B148A6488E9381F92FBF15CCB20176A0E |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.280977407061266 |
| Encrypted: | false |
| SSDEEP: | 48:o7YNJvl3WlENrpB3stYCIgMxILNH/wf7DVTBpdQrw:oApB8iDwYlGw |
| MD5: | 4FB66582D37D04933F00E49C2FBA34D4 |
| SHA1: | 3DB09C53BBEB1EEB045A001356E498D8EF30915D |
| SHA-256: | A97DAC01ABFE3EB75C7C97D504E21BDDDADDB6EBE0B56B6A9A10CD3700CAB41B |
| SHA-512: | 2AEB3A6CFFBF6EFA626EBDC9E11ACBAC04BFE986F98FBC050B2501898B289C67D392ED195D16ACC9565EF8784401ADA1E88188CDE3A7AB12D98BB5ED7D8A5711 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4070 |
| Entropy (8bit): | 5.362700670482359 |
| Encrypted: | false |
| SSDEEP: | 96:GUpT+TmXtdW1qsHFcn7t7CnyWYvNTcLaQOw:lpT+qXW1PFcn7tGnyWY1TGb |
| MD5: | ED368A20CB303C0E7C6A3E6E43C2E14F |
| SHA1: | 429A5C538B45221F80405163D1F87912DD73C05A |
| SHA-256: | 93BA77AD4B11E0A70C0D36576F0DF24E27F50001EA02BAA6D357E034532D97F2 |
| SHA-512: | DE74BBADE910475DD245FFEFD4E1FD10137DE710B1C920D33BA52554911496E1339EF3C1F6D9D315CBC98A60ABE5687A3E7D8BEE483708E18D25722E794BDBE9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 697429 |
| Entropy (8bit): | 5.593310312179182 |
| Encrypted: | false |
| SSDEEP: | 6144:TYNlxfbDTYDhzCTNoygVWyJb5eGpbL2Mp15gI8seqfh53p+rrvV7i:T25bDTYB+qeGB+Nu |
| MD5: | 92F0F5E28355D863ACB77313F1E675DE |
| SHA1: | 8AD6F9B535D5B8952A4ADCCC57E4A4E0723F1E8D |
| SHA-256: | F903AE346609A2872554A3D8FFBDB1836CB5C8B7AAAED4C3F8296B887E03D833 |
| SHA-512: | 0C81A6CD850C6ACDBE9CCCBA00BBA34CDE1E09E8572814AE8E55DBED3C2B56F0B020359841F8217843B3403847DF46FA1C82229684F762A73C8110CE45898DAF |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3471 |
| Entropy (8bit): | 5.5174491302699495 |
| Encrypted: | false |
| SSDEEP: | 96:ojAmjTJ/fJgpIcB7Fd2tilGBEMO/A6VxV08w:vUTJpgDJXM0ApJ |
| MD5: | 2D999C87DD54C7FE6400D267C33FBB23 |
| SHA1: | 414C3A329C2760325EDBACBD7A221D7F8DBFEEE8 |
| SHA-256: | 76D55A1AFC1D39CB04D60EB04E45A538A0E75EE2871561C84CC89B1C13596BCC |
| SHA-512: | 72D923BB71DD147139962FF8E2BD0E336E0F6409C212AC2F25387D0F3B4FC9365F5A6D40E2980BB1065534888362C97D6B7663E362D29166B5915D2A9DA7D238 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.253939888205379 |
| Encrypted: | false |
| SSDEEP: | 48:o7BNJfeFb8L3A6FHqIy5Z+d70OCzSfvi/3fM/r8ZQzRrw:oFuILhFHrVCz0vLZz9w |
| MD5: | 10FF6F99E3228E96AFD6E2C30EF97C0A |
| SHA1: | 4AE3DCB8D1F5A0C302D5BAD9DFF5050A7A5E8130 |
| SHA-256: | 95E5546E1C7F311D07BB5050CC456A973E43BCC4777BA6014757376016537679 |
| SHA-512: | 116C0B1CAC98A27044100005545AB66BE5F4801D75DC259093A9F145B3A4ACD8DC1C360AF525F6DC8421CD54B675A78023D2ED8B57F5946A3969543758C673C9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.579786707736145 |
| TrID: |
|
| File name: | file.exe |
| File size: | 917'504 bytes |
| MD5: | 01c227c31afb774df17ea789878018a4 |
| SHA1: | 9db323a49e28f69730ca0bdbc31c3d7058342737 |
| SHA256: | ef8f1aec6f7dccd1d1a39f575a341e4b12981337ea3ac39c8cb00c22acfdc0a5 |
| SHA512: | e29f9076f1039b2fd7e6e4d470a243f78e0aef03570b05740390ac8683adcc31924209398fc8b83316fa020a98f0de79b8aa8316d2dd5d7709eb9bd9e688e746 |
| SSDEEP: | 12288:FqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagTs:FqDEvCTbMWu7rQYlBQcBiT6rprG8a4s |
| TLSH: | F8159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FB7658 [Tue Oct 1 04:11:04 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F9851286C43h |
| jmp 00007F985128654Fh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F985128672Dh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F98512866FAh |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F98512892EDh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F9851289338h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F9851289321h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x95ac | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x95ac | 0x9600 | 5b025674bcfec55aa9cb6cbbd676e852 | False | 0.2860416666666667 | data | 5.163803617791762 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0x874 | data | 1.005083179297597 | ||
| RT_GROUP_ICON | 0xdd02c | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd0a4 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd0b8 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd0cc | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd0e0 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd1bc | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 06:16:52.606141090 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 06:16:52.606236935 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 06:16:52.715742111 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 06:16:57.109515905 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:57.109565020 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:57.109625101 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:57.109827995 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:57.109843016 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:57.840852976 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:57.841075897 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:57.841094017 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:57.841471910 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:57.841521978 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:57.842145920 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:57.842197895 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:57.843076944 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:57.843135118 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:57.843209028 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:57.843215942 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:57.882896900 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:58.128263950 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.128340006 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.128391027 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:58.129496098 CEST | 49709 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 06:16:58.129520893 CEST | 443 | 49709 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.141103029 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:58.141143084 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.141207933 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:58.141592026 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:58.141606092 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.866379976 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.866658926 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:58.866683006 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.867064953 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.867135048 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:58.867765903 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.867820978 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:58.868908882 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:58.868966103 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.869138002 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:58.911400080 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.912905931 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:58.912913084 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.959903002 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:59.171232939 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:59.171262980 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:59.171315908 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:59.171325922 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:16:59.171581030 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:59.175410986 CEST | 49712 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:16:59.175431013 CEST | 443 | 49712 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:17:01.516596079 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:01.516638041 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:01.516702890 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:01.516954899 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:01.516973019 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:01.615201950 CEST | 49718 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:01.615248919 CEST | 443 | 49718 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:01.615329027 CEST | 49718 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:01.616944075 CEST | 49718 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:01.616962910 CEST | 443 | 49718 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.151017904 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.151235104 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:02.151248932 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.152299881 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.152363062 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:02.153393030 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:02.153444052 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.194289923 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:02.194300890 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.209908962 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 06:17:02.209912062 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 06:17:02.241157055 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:02.276355028 CEST | 443 | 49718 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.276433945 CEST | 49718 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:02.279617071 CEST | 49718 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:02.279633045 CEST | 443 | 49718 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.279863119 CEST | 443 | 49718 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.319273949 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 06:17:02.327049017 CEST | 49718 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:02.367404938 CEST | 443 | 49718 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.552241087 CEST | 443 | 49718 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.552294016 CEST | 443 | 49718 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.552346945 CEST | 49718 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:02.728797913 CEST | 49718 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:02.728827000 CEST | 443 | 49718 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.728841066 CEST | 49718 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:02.728849888 CEST | 443 | 49718 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.807342052 CEST | 49723 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:02.807373047 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:02.807465076 CEST | 49723 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:02.807765007 CEST | 49723 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:02.807776928 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:03.440937996 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:03.441010952 CEST | 49723 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:03.443092108 CEST | 49723 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:03.443099976 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:03.443301916 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:03.444858074 CEST | 49723 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:03.487391949 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:03.717442989 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:03.717504978 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:03.717555046 CEST | 49723 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:03.734349012 CEST | 49723 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 06:17:03.734364986 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 06:17:03.991449118 CEST | 443 | 49705 | 23.1.237.91 | 192.168.2.5 |
| Oct 1, 2024 06:17:03.991563082 CEST | 49705 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 06:17:06.471497059 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:06.471519947 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:06.471597910 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:06.471899033 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:06.471913099 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.106292009 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.106585026 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.106600046 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.107925892 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.108002901 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.110404968 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.110531092 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.111535072 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.111706972 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.111712933 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.155404091 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.162448883 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.162455082 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.209306955 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.419507980 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.419708967 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.419801950 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.419816017 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.419828892 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.419874907 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.424387932 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.424465895 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.430751085 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.430843115 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.430846930 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.430871010 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.430890083 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.436933994 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.436990023 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.436997890 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.443197966 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.443262100 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.443269968 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.443289042 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.443345070 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.443353891 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.483469009 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.505475044 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.505573034 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.505580902 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.505605936 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.505659103 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.508097887 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.508172989 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.514806032 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.514872074 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.514893055 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.514942884 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.520761013 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.520840883 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.527721882 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.527793884 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.527806044 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.533267975 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.533497095 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.533508062 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.539895058 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.540225983 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.540297031 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.565732956 CEST | 49734 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.565751076 CEST | 443 | 49734 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.978759050 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.978801012 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.978908062 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.981014013 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.981029034 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.981628895 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.981659889 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.981729984 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.982017040 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:07.982031107 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.617628098 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.617873907 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.617894888 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.618218899 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.618275881 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.618534088 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.618678093 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.618705988 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.618825912 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.618870974 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.619231939 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.619287014 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.620268106 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.620323896 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.623958111 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.624017954 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.624063015 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.624161005 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.624422073 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.624433041 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.624562025 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.624572039 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.663959026 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.679310083 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.896135092 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.896147013 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.896197081 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.896342993 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.896554947 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.896589994 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.896625042 CEST | 443 | 49738 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.896646023 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.896672964 CEST | 49738 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.896990061 CEST | 49739 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.897002935 CEST | 443 | 49739 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.897691011 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.897701979 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.897756100 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.898361921 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.898385048 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.898442030 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.898663044 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.898675919 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:08.898932934 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:08.898946047 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.528664112 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.528836966 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.528850079 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.529341936 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.529407024 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.530342102 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.530422926 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.530550003 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.530625105 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.530663013 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.530687094 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.530692101 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.546911955 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.547106028 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.547116041 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.547472000 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.547529936 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.548141003 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.548192978 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.548305035 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.548369884 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.548432112 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.548440933 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.548463106 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.585650921 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.591519117 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.601264954 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.721041918 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.721131086 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.721180916 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.721818924 CEST | 49745 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.721829891 CEST | 443 | 49745 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.743423939 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.743597031 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.743653059 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.744427919 CEST | 49744 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:09.744446039 CEST | 443 | 49744 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:09.817713976 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:09.863395929 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:10.084307909 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:10.084367037 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:10.084400892 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:10.084413052 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:10.084430933 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:10.084470034 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:10.084475994 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:10.084799051 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:10.084841967 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:10.314193010 CEST | 49717 | 443 | 192.168.2.5 | 142.250.186.164 |
| Oct 1, 2024 06:17:10.314218998 CEST | 443 | 49717 | 142.250.186.164 | 192.168.2.5 |
| Oct 1, 2024 06:17:13.187714100 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:13.187774897 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:13.187962055 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:13.189024925 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:13.189042091 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:13.980659962 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:13.980761051 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:13.983285904 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:13.983298063 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:13.983535051 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.037830114 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:14.547168970 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:14.591438055 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.809020996 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.809046984 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.809053898 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.809082031 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.809092045 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.809098959 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.809101105 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:14.809124947 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.809151888 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:14.809169054 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:14.809879065 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.809952974 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:14.809962034 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.809973001 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:14.810033083 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:15.321425915 CEST | 49750 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:15.321445942 CEST | 443 | 49750 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:15.496612072 CEST | 49756 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:15.496637106 CEST | 443 | 49756 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:15.496736050 CEST | 49756 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:15.497268915 CEST | 49756 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:15.497283936 CEST | 443 | 49756 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:16.140922070 CEST | 443 | 49756 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:16.141143084 CEST | 49756 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:16.141160011 CEST | 443 | 49756 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:16.141470909 CEST | 443 | 49756 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:16.141789913 CEST | 49756 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:16.141845942 CEST | 443 | 49756 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:16.141952991 CEST | 49756 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:16.141968012 CEST | 49756 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:16.141982079 CEST | 443 | 49756 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:16.492566109 CEST | 443 | 49756 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:16.492682934 CEST | 443 | 49756 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:16.492892981 CEST | 49756 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:16.507467031 CEST | 49756 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:16.507478952 CEST | 443 | 49756 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.291541100 CEST | 49758 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.291608095 CEST | 443 | 49758 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.291698933 CEST | 49758 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.292377949 CEST | 49758 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.292418957 CEST | 443 | 49758 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.341053963 CEST | 49759 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.341093063 CEST | 443 | 49759 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.341222048 CEST | 49759 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.341955900 CEST | 49759 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.341969967 CEST | 443 | 49759 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.886146069 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.886183977 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.886285067 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.886831999 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.886843920 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.928756952 CEST | 443 | 49758 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.930095911 CEST | 49758 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.930125952 CEST | 443 | 49758 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.930668116 CEST | 443 | 49758 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.931237936 CEST | 49758 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.931334019 CEST | 443 | 49758 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.931437969 CEST | 49758 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.931477070 CEST | 49758 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.931555033 CEST | 443 | 49758 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.979221106 CEST | 443 | 49759 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.979549885 CEST | 49759 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.979568005 CEST | 443 | 49759 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.979882002 CEST | 443 | 49759 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.982692957 CEST | 49759 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.982749939 CEST | 443 | 49759 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:38.982934952 CEST | 49759 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.982964039 CEST | 49759 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:38.982970953 CEST | 443 | 49759 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.204119921 CEST | 443 | 49758 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.204462051 CEST | 443 | 49758 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.204663992 CEST | 49758 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:39.205490112 CEST | 49758 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:39.205519915 CEST | 443 | 49758 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.257702112 CEST | 443 | 49759 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.257806063 CEST | 443 | 49759 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.257903099 CEST | 49759 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:39.277671099 CEST | 49759 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:39.277692080 CEST | 443 | 49759 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.534224987 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.555346012 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:39.555372953 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.555790901 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.555870056 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:39.556471109 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.556530952 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:39.576257944 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:39.576327085 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.576881886 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:39.576894045 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.576905966 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:39.623439074 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:39.632077932 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:40.027688026 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:40.027817965 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:40.027983904 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:40.028868914 CEST | 49760 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 06:17:40.028881073 CEST | 443 | 49760 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 06:17:51.708013058 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:51.708095074 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:51.708197117 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:51.708617926 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:51.708655119 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.557073116 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.557174921 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.560909033 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.560933113 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.561191082 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.569855928 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.611428022 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.892352104 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.892405033 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.892466068 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.892482996 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.892513037 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.892550945 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.892574072 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.893286943 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.893358946 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.893368959 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.893410921 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.893440962 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.893819094 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.893901110 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.896802902 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.896826982 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:17:52.896857977 CEST | 49761 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 06:17:52.896872044 CEST | 443 | 49761 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 06:18:01.577991009 CEST | 49763 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:18:01.578020096 CEST | 443 | 49763 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:18:01.578097105 CEST | 49763 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:18:01.578347921 CEST | 49763 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:18:01.578361988 CEST | 443 | 49763 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:18:02.213010073 CEST | 443 | 49763 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:18:02.213591099 CEST | 49763 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:18:02.213603020 CEST | 443 | 49763 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:18:02.214413881 CEST | 443 | 49763 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:18:02.214795113 CEST | 49763 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:18:02.214853048 CEST | 443 | 49763 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:18:02.256143093 CEST | 49763 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:18:08.581578970 CEST | 49765 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:08.581608057 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:08.581705093 CEST | 49765 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:08.620153904 CEST | 49765 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:08.620166063 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:09.269187927 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:09.269495010 CEST | 49765 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:09.269507885 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:09.269824028 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:09.270128012 CEST | 49765 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:09.270181894 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:09.270284891 CEST | 49765 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:09.270296097 CEST | 49765 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:09.270307064 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:09.547879934 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:09.547998905 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:09.548048019 CEST | 49765 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:09.548644066 CEST | 49765 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:09.548656940 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:10.751950026 CEST | 49766 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:10.751983881 CEST | 443 | 49766 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:10.752054930 CEST | 49766 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:10.752315044 CEST | 49766 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:10.752327919 CEST | 443 | 49766 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:11.384074926 CEST | 443 | 49766 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:11.384377003 CEST | 49766 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:11.384390116 CEST | 443 | 49766 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:11.384766102 CEST | 443 | 49766 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:11.385060072 CEST | 49766 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:11.385121107 CEST | 443 | 49766 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:11.385220051 CEST | 49766 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:11.385236979 CEST | 49766 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:11.385257006 CEST | 443 | 49766 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:11.662928104 CEST | 443 | 49766 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:11.663048983 CEST | 443 | 49766 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:11.663223028 CEST | 49766 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:11.663604975 CEST | 49766 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:11.663626909 CEST | 443 | 49766 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:12.112483978 CEST | 443 | 49763 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:18:12.112633944 CEST | 443 | 49763 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:18:12.112731934 CEST | 49763 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:18:25.627935886 CEST | 49763 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:18:25.627974987 CEST | 443 | 49763 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:18:40.641295910 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:40.641412973 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:40.641510963 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:40.643014908 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:40.643053055 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.278549910 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.278945923 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:41.278996944 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.280303001 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.280699015 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:41.280869007 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:41.280881882 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.280927896 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.280932903 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:41.281045914 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.335691929 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:41.553452015 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.553754091 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.553839922 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:41.554219007 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:41.554254055 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.902659893 CEST | 49769 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:41.902709007 CEST | 443 | 49769 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:41.902785063 CEST | 49769 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:41.903120041 CEST | 49769 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:41.903131962 CEST | 443 | 49769 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:42.539999008 CEST | 443 | 49769 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:42.546449900 CEST | 49769 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:42.546471119 CEST | 443 | 49769 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:42.547760963 CEST | 443 | 49769 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:42.550735950 CEST | 49769 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:42.550921917 CEST | 443 | 49769 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:42.551050901 CEST | 49769 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:42.551074028 CEST | 49769 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:42.551091909 CEST | 443 | 49769 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:42.815849066 CEST | 443 | 49769 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:42.816209078 CEST | 443 | 49769 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:18:42.816379070 CEST | 49769 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:42.816379070 CEST | 49769 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:43.116209984 CEST | 49769 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 06:18:43.116240025 CEST | 443 | 49769 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 06:19:01.624525070 CEST | 49770 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:19:01.624566078 CEST | 443 | 49770 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:19:01.624635935 CEST | 49770 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:19:01.624953985 CEST | 49770 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:19:01.624969006 CEST | 443 | 49770 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:19:02.269514084 CEST | 443 | 49770 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:19:02.269957066 CEST | 49770 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:19:02.269970894 CEST | 443 | 49770 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:19:02.271034002 CEST | 443 | 49770 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:19:02.271358013 CEST | 49770 | 443 | 192.168.2.5 | 142.250.184.228 |
| Oct 1, 2024 06:19:02.271569967 CEST | 443 | 49770 | 142.250.184.228 | 192.168.2.5 |
| Oct 1, 2024 06:19:02.321369886 CEST | 49770 | 443 | 192.168.2.5 | 142.250.184.228 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 06:16:57.048484087 CEST | 61690 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:16:57.055115938 CEST | 53 | 61690 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:16:57.064608097 CEST | 53 | 58171 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:16:57.069905043 CEST | 53 | 58840 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.133677959 CEST | 50510 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:16:58.133865118 CEST | 50596 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:16:58.140511990 CEST | 53 | 50510 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.140559912 CEST | 53 | 50596 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:16:58.178622961 CEST | 53 | 51053 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:01.507951021 CEST | 58033 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:17:01.508085012 CEST | 55421 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:17:01.514691114 CEST | 53 | 55421 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:01.514761925 CEST | 53 | 58033 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:01.687019110 CEST | 53 | 65293 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:03.581034899 CEST | 53 | 61218 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:06.455954075 CEST | 50005 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:17:06.456084967 CEST | 49579 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:17:06.462953091 CEST | 53 | 50005 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:06.465639114 CEST | 53 | 49579 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.896588087 CEST | 63873 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:17:07.904109001 CEST | 53 | 63873 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:07.908488035 CEST | 60742 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:17:07.915707111 CEST | 53 | 60742 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:15.249279022 CEST | 53 | 50174 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:34.265075922 CEST | 53 | 55936 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:56.769604921 CEST | 53 | 61138 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:17:57.312975883 CEST | 53 | 55867 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:18:01.570199013 CEST | 64223 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:18:01.570374012 CEST | 49723 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:18:01.576921940 CEST | 53 | 64223 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:18:01.576942921 CEST | 53 | 49723 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:18:08.519373894 CEST | 53 | 49778 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:18:08.563380003 CEST | 64474 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:18:08.563558102 CEST | 57746 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 06:18:08.570512056 CEST | 53 | 64474 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:18:08.570519924 CEST | 53 | 57746 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 06:18:25.636562109 CEST | 53 | 62296 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 06:16:57.048484087 CEST | 192.168.2.5 | 1.1.1.1 | 0x8c34 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 06:16:58.133677959 CEST | 192.168.2.5 | 1.1.1.1 | 0x1ab0 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 06:16:58.133865118 CEST | 192.168.2.5 | 1.1.1.1 | 0x739f | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 06:17:01.507951021 CEST | 192.168.2.5 | 1.1.1.1 | 0xe5b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 06:17:01.508085012 CEST | 192.168.2.5 | 1.1.1.1 | 0x2687 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 06:17:06.455954075 CEST | 192.168.2.5 | 1.1.1.1 | 0xe274 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 06:17:06.456084967 CEST | 192.168.2.5 | 1.1.1.1 | 0x80bd | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 06:17:07.896588087 CEST | 192.168.2.5 | 1.1.1.1 | 0xc645 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 06:17:07.908488035 CEST | 192.168.2.5 | 1.1.1.1 | 0x9e59 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 06:18:01.570199013 CEST | 192.168.2.5 | 1.1.1.1 | 0xdc06 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 06:18:01.570374012 CEST | 192.168.2.5 | 1.1.1.1 | 0xd8b4 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 06:18:08.563380003 CEST | 192.168.2.5 | 1.1.1.1 | 0x3fa8 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 06:18:08.563558102 CEST | 192.168.2.5 | 1.1.1.1 | 0x2dfb | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 06:16:57.055115938 CEST | 1.1.1.1 | 192.168.2.5 | 0x8c34 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 216.58.212.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 172.217.23.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140511990 CEST | 1.1.1.1 | 192.168.2.5 | 0x1ab0 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140559912 CEST | 1.1.1.1 | 192.168.2.5 | 0x739f | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 06:16:58.140559912 CEST | 1.1.1.1 | 192.168.2.5 | 0x739f | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 06:17:01.514691114 CEST | 1.1.1.1 | 192.168.2.5 | 0x2687 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 06:17:01.514761925 CEST | 1.1.1.1 | 192.168.2.5 | 0xe5b | No error (0) | 142.250.186.164 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:17:06.462953091 CEST | 1.1.1.1 | 192.168.2.5 | 0xe274 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 06:17:06.462953091 CEST | 1.1.1.1 | 192.168.2.5 | 0xe274 | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:17:06.465639114 CEST | 1.1.1.1 | 192.168.2.5 | 0x80bd | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 06:17:07.904109001 CEST | 1.1.1.1 | 192.168.2.5 | 0xc645 | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:18:01.576921940 CEST | 1.1.1.1 | 192.168.2.5 | 0xdc06 | No error (0) | 142.250.184.228 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 06:18:01.576942921 CEST | 1.1.1.1 | 192.168.2.5 | 0xd8b4 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 06:18:08.570512056 CEST | 1.1.1.1 | 192.168.2.5 | 0x3fa8 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49709 | 142.250.185.78 | 443 | 7548 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 04:16:57 UTC | 859 | OUT | |
| 2024-10-01 04:16:58 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49712 | 142.250.185.110 | 443 | 7548 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 04:16:58 UTC | 877 | OUT | |
| 2024-10-01 04:16:59 UTC | 3014 | IN |