Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1523166 |
| MD5: | 1355f9171ec60527abde0294c9bc90fa |
| SHA1: | 15752f1a122b153511ddb621a7b8ebfb7fbb95d4 |
| SHA256: | a26901e9e1f370fe377918d1975fcf06ec58bd980cb33ef00c368c3a051ba61d |
| Tags: | exeuser-Bitsight |
| Infos: | |
 | |
Detection
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
file.exe (PID: 6456 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 1355F9171EC60527ABDE0294C9BC90FA) 
chrome.exe (PID: 6504 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ap p="https:/ /youtube.c om/account ?=https:// accounts.g oogle.com/ v3/signin/ challenge/ pwd" --sta rt-fullscr een --no-f irst-run - -disable-s ession-cra shed-bubbl e --disabl e-features =CrashReco very MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 7196 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2096 --fi eld-trial- handle=197 6,i,179725 7021522119 9124,13710 0398792402 88618,2621 44 --disab le-feature s=CrashRec overy /pre fetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 7544 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=53 24 --field -trial-han dle=1976,i ,179725702 1522119912 4,13710039 8792402886 18,262144 --disable- features=C rashRecove ry /prefet ch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 7776 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5404 --f ield-trial -handle=19 76,i,17972 5702152211 99124,1371 0039879240 288618,262 144 --disa ble-featur es=CrashRe covery /pr efetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_001DDBBE | |
| Source: | Code function: | 0_2_001AC2A2 | |
| Source: | Code function: | 0_2_001E68EE | |
| Source: | Code function: | 0_2_001E698F | |
| Source: | Code function: | 0_2_001DD076 | |
| Source: | Code function: | 0_2_001DD3A9 | |
| Source: | Code function: | 0_2_001E9642 | |
| Source: | Code function: | 0_2_001E979D | |
| Source: | Code function: | 0_2_001E9B2B | |
| Source: | Code function: | 0_2_001E5C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_001ECE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_001EEAFF | |
| Source: | Code function: | 0_2_001EED6A | |
| Source: | Code function: | 0_2_001EEAFF | |
| Source: | Code function: | 0_2_001DAA57 | |
| Source: | Code function: | 0_2_00209576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_64ce25fc-c | |
| Source: | String found in binary or memory: | memstr_b94042fa-a | |
| Source: | String found in binary or memory: | memstr_34910b57-c | |
| Source: | String found in binary or memory: | memstr_fee8d2d2-2 | |
| Source: | Code function: | 0_2_001DD5EB | |
| Source: | Code function: | 0_2_001D1201 | |
| Source: | Code function: | 0_2_001DE8F6 | |
| Source: | Code function: | 0_2_0017BF40 | |
| Source: | Code function: | 0_2_001E2046 | |
| Source: | Code function: | 0_2_00178060 | |
| Source: | Code function: | 0_2_001D8298 | |
| Source: | Code function: | 0_2_001AE4FF | |
| Source: | Code function: | 0_2_001A676B | |
| Source: | Code function: | 0_2_00204873 | |
| Source: | Code function: | 0_2_0019CAA0 | |
| Source: | Code function: | 0_2_0017CAF0 | |
| Source: | Code function: | 0_2_0018CC39 | |
| Source: | Code function: | 0_2_001A6DD9 | |
| Source: | Code function: | 0_2_0018B119 | |
| Source: | Code function: | 0_2_001791C0 | |
| Source: | Code function: | 0_2_00191394 | |
| Source: | Code function: | 0_2_00191706 | |
| Source: | Code function: | 0_2_0019781B | |
| Source: | Code function: | 0_2_00177920 | |
| Source: | Code function: | 0_2_0018997D | |
| Source: | Code function: | 0_2_001919B0 | |
| Source: | Code function: | 0_2_00197A4A | |
| Source: | Code function: | 0_2_00191C77 | |
| Source: | Code function: | 0_2_00197CA7 | |
| Source: | Code function: | 0_2_001FBE44 | |
| Source: | Code function: | 0_2_001A9EEE | |
| Source: | Code function: | 0_2_00191F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_001E37B5 | |
| Source: | Code function: | 0_2_001D10BF | |
| Source: | Code function: | 0_2_001D16C3 | |
| Source: | Code function: | 0_2_001E51CD | |
| Source: | Code function: | 0_2_001DD4DC | |
| Source: | Code function: | 0_2_001E648E | |
| Source: | Code function: | 0_2_001742A2 | |
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_001742DE | |
| Source: | Code function: | 0_2_00190A89 | |
| Source: | Code function: | 0_2_0018F98E | |
| Source: | Code function: | 0_2_00201C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-96792 | ||
| Source: | API coverage: | ||
| Source: | Code function: | 0_2_001DDBBE | |
| Source: | Code function: | 0_2_001AC2A2 | |
| Source: | Code function: | 0_2_001E68EE | |
| Source: | Code function: | 0_2_001E698F | |
| Source: | Code function: | 0_2_001DD076 | |
| Source: | Code function: | 0_2_001DD3A9 | |
| Source: | Code function: | 0_2_001E9642 | |
| Source: | Code function: | 0_2_001E979D | |
| Source: | Code function: | 0_2_001E9B2B | |
| Source: | Code function: | 0_2_001E5C97 | |
| Source: | Code function: | 0_2_001742DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_001EEAA2 | |
| Source: | Code function: | 0_2_001A2622 | |
| Source: | Code function: | 0_2_001742DE | |
| Source: | Code function: | 0_2_00194CE8 | |
| Source: | Code function: | 0_2_001D0B62 | |
| Source: | Code function: | 0_2_001A2622 | |
| Source: | Code function: | 0_2_0019083F | |
| Source: | Code function: | 0_2_001909D5 | |
| Source: | Code function: | 0_2_00190C21 | |
| Source: | Code function: | 0_2_001D1201 | |
| Source: | Code function: | 0_2_001B2BA5 | |
| Source: | Code function: | 0_2_001DB226 | |
| Source: | Code function: | 0_2_001F22DA | |
| Source: | Code function: | 0_2_001D0B62 | |
| Source: | Code function: | 0_2_001D1663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00190698 | |
| Source: | Code function: | 0_2_001E8195 | |
| Source: | Code function: | 0_2_001CD27A | |
| Source: | Code function: | 0_2_001AB952 | |
| Source: | Code function: | 0_2_001742DE | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_001F1204 | |
| Source: | Code function: | 0_2_001F1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 15 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 2 Valid Accounts | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Virtualization/Sandbox Evasion | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 21 Access Token Manipulation | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 2 Process Injection | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 13% | ReversingLabs | Win32.Trojan.Ludicrouz | ||
| 18% | Virustotal | Browse | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 1% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.186.110 | true | false |
| unknown |
| www3.l.google.com | 142.250.186.174 | true | false |
| unknown |
| play.google.com | 142.250.185.174 | true | false |
| unknown |
| www.google.com | 172.217.16.196 | true | false |
| unknown |
| youtube.com | 172.217.16.206 | true | false |
| unknown |
| accounts.youtube.com | unknown | unknown | false |
| unknown |
| www.youtube.com | unknown | unknown | false |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 172.217.16.206 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.174 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.174 | play.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.110 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.16.196 | www.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.7 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1523166 |
| Start date and time: | 2024-10-01 07:50:03 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 56s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 21 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal64.evad.winEXE@33/30@12/7 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.186.67, 142.250.186.46, 173.194.76.84, 34.104.35.123, 142.250.185.99, 142.250.185.163, 142.250.185.138, 142.250.186.42, 142.250.181.234, 216.58.206.42, 172.217.23.106, 142.250.186.74, 142.250.185.106, 172.217.16.138, 142.250.185.234, 142.250.184.234, 142.250.185.74, 172.217.18.10, 142.250.186.170, 142.250.185.202, 142.250.184.202, 142.250.185.170, 142.250.186.106, 216.58.206.74, 142.250.186.138, 172.217.16.202, 217.20.57.18, 74.125.71.84, 142.250.184.238
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
|
⊘No context
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5049 |
| Entropy (8bit): | 5.317800104741948 |
| Encrypted: | false |
| SSDEEP: | 96:oHX9gPiPrfnHhsB0TR6kg1oDPJzLmM18Vh1z2fEZ54TZtnqj6w:EtEAr6BmPZtOeEvW/ncP |
| MD5: | CE53EF566B68CCF2D62FA044CFB0D138 |
| SHA1: | F48EC60289F2B55E8B388601206888F8295B1EB1 |
| SHA-256: | E6CC5114D92811D5DE0663266D4B63F367834AFA0FC3BAFA54F707038C59D010 |
| SHA-512: | 20B434881DE971E263669E6096C01665D4D35B0FBFF47D312A4A442645EE962A8CE6AD7E68246D4EE9691BD30D9B1DDCF7059226492E1B58CD3191B63B001E4D |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 697429 |
| Entropy (8bit): | 5.593310312179182 |
| Encrypted: | false |
| SSDEEP: | 6144:TYNlxfbDTYDhzCTNoygVWyJb5eGpbL2Mp15gI8seqfh53p+rrvV7i:T25bDTYB+qeGB+Nu |
| MD5: | 92F0F5E28355D863ACB77313F1E675DE |
| SHA1: | 8AD6F9B535D5B8952A4ADCCC57E4A4E0723F1E8D |
| SHA-256: | F903AE346609A2872554A3D8FFBDB1836CB5C8B7AAAED4C3F8296B887E03D833 |
| SHA-512: | 0C81A6CD850C6ACDBE9CCCBA00BBA34CDE1E09E8572814AE8E55DBED3C2B56F0B020359841F8217843B3403847DF46FA1C82229684F762A73C8110CE45898DAF |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.253939888205379 |
| Encrypted: | false |
| SSDEEP: | 48:o7BNJfeFb8L3A6FHqIy5Z+d70OCzSfvi/3fM/r8ZQzRrw:oFuILhFHrVCz0vLZz9w |
| MD5: | 10FF6F99E3228E96AFD6E2C30EF97C0A |
| SHA1: | 4AE3DCB8D1F5A0C302D5BAD9DFF5050A7A5E8130 |
| SHA-256: | 95E5546E1C7F311D07BB5050CC456A973E43BCC4777BA6014757376016537679 |
| SHA-512: | 116C0B1CAC98A27044100005545AB66BE5F4801D75DC259093A9F145B3A4ACD8DC1C360AF525F6DC8421CD54B675A78023D2ED8B57F5946A3969543758C673C9 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22827 |
| Entropy (8bit): | 5.420322672717721 |
| Encrypted: | false |
| SSDEEP: | 384:/jqdWXWfyA20UUjDE8BSUxDJs16KHvSN34kaHaN+587SaXD2mLR0H:/jqdWXAUUjDE84Wi6KPSKjHaN+58+0J2 |
| MD5: | 2B29741A316862EE788996DD29116DD5 |
| SHA1: | 9D5551916D4452E977C39B8D69CF88DF2AAA462B |
| SHA-256: | 62955C853976B722EFBB4C116A10DB3FF54580EDD7495D280177550B8F4289AB |
| SHA-512: | 6E37C3258F07F29909763728DADE0CD40A3602D55D9099F78B37756926FCF2A50008B82876B518FEAF3E56617F0F7D1D37A73C346A99A58E6AD8BCD6689E9B15 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4070 |
| Entropy (8bit): | 5.362700670482359 |
| Encrypted: | false |
| SSDEEP: | 96:GUpT+TmXtdW1qsHFcn7t7CnyWYvNTcLaQOw:lpT+qXW1PFcn7tGnyWY1TGb |
| MD5: | ED368A20CB303C0E7C6A3E6E43C2E14F |
| SHA1: | 429A5C538B45221F80405163D1F87912DD73C05A |
| SHA-256: | 93BA77AD4B11E0A70C0D36576F0DF24E27F50001EA02BAA6D357E034532D97F2 |
| SHA-512: | DE74BBADE910475DD245FFEFD4E1FD10137DE710B1C920D33BA52554911496E1339EF3C1F6D9D315CBC98A60ABE5687A3E7D8BEE483708E18D25722E794BDBE9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 603951 |
| Entropy (8bit): | 5.789948381047936 |
| Encrypted: | false |
| SSDEEP: | 3072:W0pApkygA62bwwdnO2YflNYhFGOizdGj008PpVVM96C5bMEPQUhts6FV8eKqtVAT:WlgNmwwdnOsF98oNGuQRAYqXsI1+ |
| MD5: | A97373CC3F8795654F3C8C6B57066AE7 |
| SHA1: | F7BECFDDE230EF537E8745B598DCED737C490C3C |
| SHA-256: | A1B0568D555DC4B4AF4CC5A6C41E838B702816445C04FF002C8A13058387F311 |
| SHA-512: | 47C76D26F4F9F206F93186800E06D3DBE1FDD0A1BA23FB9A3556390DE7F86C1FFB2C78FE307FB944C690475BFBAE9738C38233E00FDDFA9775A3B2030081D7F1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEQAz5EZnBR6fK6LIn1v8ILsATM3g/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.3872171131917925 |
| Encrypted: | false |
| SSDEEP: | 192:FK/pAzN7GZ068Hqhqu6DQaVapzYjgKItwdiwUsYRTi1j1t9bRl9:FqI7GZ04dRYjghtgisYYbt9ll9 |
| MD5: | AB70454DE18E1CE16E61EAC290FC304D |
| SHA1: | 68532B5E8B262D7E14B8F4507AA69A61146B3C18 |
| SHA-256: | B32D746867CC4FA21FD39437502F401D952D0A3E8DC708DFB7D58B85F256C0F1 |
| SHA-512: | A123C517380BEF0B47F23A5A6E1D16650FE39D9C701F9FA5ADD79294973C118E8EA3A7BA32CB63C3DFC0CE0F843FB86BFFCAA2AAE987629E7DFF84F176DEBB98 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32499 |
| Entropy (8bit): | 5.361345284201954 |
| Encrypted: | false |
| SSDEEP: | 768:mLX1O+aL6fgyIiREM4RKmh90toLoTswtF3ATcbDR6kIsnJd9DPyMv/FI:U2M4oltoLoTswtFoc/tIsnXFLI |
| MD5: | D5C3FB8EAE24AB7E40009338B5078496 |
| SHA1: | 5638BF5986A6445A88CD79A9B690B744B126BEC2 |
| SHA-256: | 597C14D360D690BCFDC2B8D315E6BB8879AEF33DE6C30D274743079BDB63C6B0 |
| SHA-512: | 6AE434850D473BEF15AA694AB4862596982CDDA6BD3991991D3ADD8F4A5F61DFBF8756D0DA98B72EF083909D68CF7B6B148A6488E9381F92FBF15CCB20176A0E |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.3750044852869046 |
| Encrypted: | false |
| SSDEEP: | 48:o7zfN/cD498xdg+Y5jNQ8js6npwk0OmNAEZbpMzR4EQBcW5QcHj9KWfGAeFKRrw:oCD9dA5jOEGh+EFqR4rhqUhzff9w |
| MD5: | 39693D34EE3D1829DBB1627C4FC6687B |
| SHA1: | A03303C2F027F3749B48D5134D1F8FB3E495C6E9 |
| SHA-256: | 03B0C1B4E402E0BCF75D530DD9085B25357EEFD09E238453DE1F3A042542C076 |
| SHA-512: | AC0749EDC33DA0EC0E40470388DD797B6528AD08B8FAC1C2AC42F85198131052BA1B533E90409D35DA237607E8B07D591FA6BA580B6A90B0D0AB2282A01F7585 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3471 |
| Entropy (8bit): | 5.5174491302699495 |
| Encrypted: | false |
| SSDEEP: | 96:ojAmjTJ/fJgpIcB7Fd2tilGBEMO/A6VxV08w:vUTJpgDJXM0ApJ |
| MD5: | 2D999C87DD54C7FE6400D267C33FBB23 |
| SHA1: | 414C3A329C2760325EDBACBD7A221D7F8DBFEEE8 |
| SHA-256: | 76D55A1AFC1D39CB04D60EB04E45A538A0E75EE2871561C84CC89B1C13596BCC |
| SHA-512: | 72D923BB71DD147139962FF8E2BD0E336E0F6409C212AC2F25387D0F3B4FC9365F5A6D40E2980BB1065534888362C97D6B7663E362D29166B5915D2A9DA7D238 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.280977407061266 |
| Encrypted: | false |
| SSDEEP: | 48:o7YNJvl3WlENrpB3stYCIgMxILNH/wf7DVTBpdQrw:oApB8iDwYlGw |
| MD5: | 4FB66582D37D04933F00E49C2FBA34D4 |
| SHA1: | 3DB09C53BBEB1EEB045A001356E498D8EF30915D |
| SHA-256: | A97DAC01ABFE3EB75C7C97D504E21BDDDADDB6EBE0B56B6A9A10CD3700CAB41B |
| SHA-512: | 2AEB3A6CFFBF6EFA626EBDC9E11ACBAC04BFE986F98FBC050B2501898B289C67D392ED195D16ACC9565EF8784401ADA1E88188CDE3A7AB12D98BB5ED7D8A5711 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.316515499943097 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DduJqrxsNL90YIzFK/Hb5eNhz1uktdDuvKKKGbLZ99GbSSF/ZR8OkdnprGJ:o7DQJopFN+ASCKKGbF99GbSS3RY7rw |
| MD5: | D97AB4594FC610665FF2763A650EE6A8 |
| SHA1: | 5C7459CA838D27BE45745571D8D96D156F4B9F8D |
| SHA-256: | 767D778369623FD8F5FB98D3BCC3130D05D02CBE0B9B88DD226F43281B14E9AF |
| SHA-512: | CE4941B41C3A8CC983C1BBCC87EF682823CB9DB24EA7A570E35BBF832046340D433F7D47211384B61FA38F3527CC35C195A6068CCB24B48E1F492C5B4D4192A1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.579781779284129 |
| TrID: |
|
| File name: | file.exe |
| File size: | 917'504 bytes |
| MD5: | 1355f9171ec60527abde0294c9bc90fa |
| SHA1: | 15752f1a122b153511ddb621a7b8ebfb7fbb95d4 |
| SHA256: | a26901e9e1f370fe377918d1975fcf06ec58bd980cb33ef00c368c3a051ba61d |
| SHA512: | 2a5a7b069f7f26ecd58b0dded6bd529cff4d47a914817403ab58ae862028658eaf4e4b6bba215b51370105c3f743b8f71de8b1ff6fc969c5e954a66253d8d220 |
| SSDEEP: | 12288:9qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagT4:9qDEvCTbMWu7rQYlBQcBiT6rprG8a44 |
| TLSH: | 16159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FB87F1 [Tue Oct 1 05:26:09 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F8974D105B3h |
| jmp 00007F8974D0FEBFh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F8974D1009Dh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F8974D1006Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F8974D12C5Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F8974D12CA8h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F8974D12C91h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x95ac | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x95ac | 0x9600 | 0c80dab3b3cdd729b907330fe8c77020 | False | 0.2860416666666667 | data | 5.163985740645173 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0x874 | data | 1.005083179297597 | ||
| RT_GROUP_ICON | 0xdd02c | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd0a4 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd0b8 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd0cc | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd0e0 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd1bc | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 07:50:57.670461893 CEST | 49671 | 443 | 192.168.2.7 | 204.79.197.203 |
| Oct 1, 2024 07:50:57.967387915 CEST | 49674 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:50:57.968079090 CEST | 49675 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:50:58.140038013 CEST | 49672 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:51:01.688534975 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 1, 2024 07:51:02.061122894 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 1, 2024 07:51:02.482959986 CEST | 49671 | 443 | 192.168.2.7 | 204.79.197.203 |
| Oct 1, 2024 07:51:02.805504084 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 1, 2024 07:51:04.305815935 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 1, 2024 07:51:04.366306067 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:04.366353989 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:04.366400003 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:04.384074926 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:04.384094954 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.020091057 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.021991014 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:05.022015095 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.022396088 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.022450924 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:05.023416996 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.023493052 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:05.028362989 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:05.028418064 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.028832912 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:05.028841019 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.117264032 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:05.306814909 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.307246923 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.307851076 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:05.317440033 CEST | 49702 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 1, 2024 07:51:05.317459106 CEST | 443 | 49702 | 172.217.16.206 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.327476025 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:05.327497005 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.327610970 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:05.327816010 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:05.327822924 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.958511114 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.958803892 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:05.958817959 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.959199905 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.959362030 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:05.959939957 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.960052967 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:05.961250067 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:05.961250067 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:05.961263895 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.961308956 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:06.021231890 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:06.021241903 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:06.188488007 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:06.261338949 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:06.261364937 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:06.261420012 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:06.261429071 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:06.261532068 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:06.261678934 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:06.263660908 CEST | 49706 | 443 | 192.168.2.7 | 142.250.186.110 |
| Oct 1, 2024 07:51:06.263676882 CEST | 443 | 49706 | 142.250.186.110 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.101656914 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:07.101700068 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.101799965 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:07.102037907 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:07.102056026 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.295269966 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 1, 2024 07:51:07.576253891 CEST | 49674 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:51:07.576312065 CEST | 49675 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:51:07.735028982 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.735352039 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:07.735379934 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.736416101 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.736469030 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:07.737620115 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:07.737673998 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.748162031 CEST | 49672 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:51:07.779422998 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:07.779448986 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.826278925 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:09.633049965 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:09.633085012 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:09.633239985 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:09.634923935 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:09.634937048 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.213257074 CEST | 443 | 49699 | 104.98.116.138 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.213418961 CEST | 49699 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:51:10.283092976 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.283158064 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:10.288079977 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:10.288096905 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.288314104 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.342679024 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:10.344984055 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:10.391392946 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.556327105 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.556504965 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.556612015 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:10.559735060 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:10.559752941 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.559777975 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:10.559784889 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.609117985 CEST | 49719 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:10.609133005 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.609281063 CEST | 49719 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:10.609474897 CEST | 49719 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:10.609481096 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:11.246568918 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:11.246640921 CEST | 49719 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:11.248063087 CEST | 49719 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:11.248070955 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:11.248338938 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:11.252428055 CEST | 49719 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:11.299395084 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:11.523195028 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:11.523255110 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:11.523305893 CEST | 49719 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:11.524312973 CEST | 49719 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:11.524312973 CEST | 49719 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 1, 2024 07:51:11.524319887 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:11.524327993 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.7 |
| Oct 1, 2024 07:51:12.092011929 CEST | 49671 | 443 | 192.168.2.7 | 204.79.197.203 |
| Oct 1, 2024 07:51:13.241707087 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:13.241715908 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:13.241765976 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:13.242108107 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:13.242115021 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:13.253662109 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 1, 2024 07:51:13.866585016 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:13.868455887 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:13.868467093 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:13.868920088 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:13.868978024 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:13.869612932 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:13.869693995 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:13.870788097 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:13.870877028 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:13.871123075 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:13.871129990 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:13.920754910 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.190745115 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.190788984 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.190897942 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.193514109 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.193522930 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.194796085 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.196027040 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.196033001 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.201225042 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.201359034 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.205859900 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.205864906 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.207490921 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.209856033 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.209861994 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.209938049 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.211838007 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.211911917 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.213855982 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.213860989 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.214147091 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.273082018 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.273122072 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.273857117 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.273865938 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.276860952 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.277534008 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.277606010 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.282088995 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.282135963 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.282215118 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.282531977 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.289824009 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.289897919 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.296078920 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.296148062 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.296241045 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.301028013 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.301090956 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.301101923 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.307507038 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.307543993 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.307549000 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.307636976 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.307723999 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.737437010 CEST | 49727 | 443 | 192.168.2.7 | 142.250.186.174 |
| Oct 1, 2024 07:51:14.737462997 CEST | 443 | 49727 | 142.250.186.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.751214027 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:14.751241922 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.751322031 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:14.752528906 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:14.752551079 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.819559097 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:14.819607019 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.819699049 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:14.820091963 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:14.820101976 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.390024900 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.391407967 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.391422033 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.391757965 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.391825914 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.392427921 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.392477036 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.393582106 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.393635035 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.393841028 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.393847942 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.436223030 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.665740967 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.666143894 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.666161060 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.666527987 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.666598082 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.667222023 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.667274952 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.667417049 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.667463064 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.667787075 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.667792082 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.692958117 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.693547964 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.693558931 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.693571091 CEST | 443 | 49730 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.693609953 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.693638086 CEST | 49730 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.694562912 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.694607019 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.694664955 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.695041895 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.695059061 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.718614101 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.973666906 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.973995924 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.974092007 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.974236012 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.974261999 CEST | 443 | 49731 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.974287033 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.974335909 CEST | 49731 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.975193024 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.975244999 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:15.975320101 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.975881100 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:15.975893974 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.329936028 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.330166101 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.330183983 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.330576897 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.330636978 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.331275940 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.331320047 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.331454039 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.331657887 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.331666946 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.331682920 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.336736917 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.390912056 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.390932083 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.436310053 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.557435989 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.558408976 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.558490992 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.559350967 CEST | 49734 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.559370041 CEST | 443 | 49734 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.615866899 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.616360903 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.616384029 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.616741896 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.616806030 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.617434978 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.617481947 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.617631912 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.617688894 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.617856979 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.617863894 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.617881060 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.659400940 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.671128035 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.792884111 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:16.833867073 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.834609985 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.834670067 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.835416079 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:16.835498095 CEST | 49737 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:16.835517883 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:17.058984995 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:17.059029102 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:17.059056044 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:17.059079885 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:17.059124947 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:17.059139967 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:17.059156895 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:17.059391022 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:17.059444904 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:17.220333099 CEST | 49708 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:51:17.220367908 CEST | 443 | 49708 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:51:17.968605995 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:17.968640089 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:17.968709946 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:17.970613956 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:17.970623016 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:18.612071991 CEST | 49699 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:51:18.612775087 CEST | 49742 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:51:18.612802029 CEST | 443 | 49742 | 104.98.116.138 | 192.168.2.7 |
| Oct 1, 2024 07:51:18.613135099 CEST | 49742 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:51:18.615258932 CEST | 49742 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:51:18.615268946 CEST | 443 | 49742 | 104.98.116.138 | 192.168.2.7 |
| Oct 1, 2024 07:51:18.616906881 CEST | 443 | 49699 | 104.98.116.138 | 192.168.2.7 |
| Oct 1, 2024 07:51:18.790982008 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:18.791044950 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:18.794208050 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:18.794218063 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:18.794573069 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:18.842499018 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:19.794855118 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:19.839400053 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.062506914 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.062520981 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.062527895 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.062557936 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.062598944 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:20.062606096 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.062608957 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.062640905 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.062665939 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:20.062808037 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:20.062841892 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:20.063157082 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.063198090 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.063298941 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:20.833542109 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:20.833571911 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:20.833614111 CEST | 49739 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:20.833621025 CEST | 443 | 49739 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:22.246876001 CEST | 49748 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:22.246912003 CEST | 443 | 49748 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:22.247005939 CEST | 49748 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:22.247333050 CEST | 49748 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:22.247349977 CEST | 443 | 49748 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:22.894861937 CEST | 443 | 49748 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:22.901483059 CEST | 49748 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:22.901515007 CEST | 443 | 49748 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:22.901910067 CEST | 443 | 49748 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:22.908710003 CEST | 49748 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:22.908832073 CEST | 443 | 49748 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:22.909677029 CEST | 49748 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:22.909713984 CEST | 49748 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:22.909732103 CEST | 443 | 49748 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:23.379370928 CEST | 443 | 49748 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:23.379519939 CEST | 443 | 49748 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:23.380337000 CEST | 49748 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:23.380337000 CEST | 49748 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:23.686470985 CEST | 49748 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:23.686507940 CEST | 443 | 49748 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:25.170749903 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 1, 2024 07:51:45.270349979 CEST | 49751 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:45.270411968 CEST | 443 | 49751 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:45.270498991 CEST | 49751 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:45.270781040 CEST | 49751 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:45.270796061 CEST | 443 | 49751 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:45.877119064 CEST | 49752 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:45.877181053 CEST | 443 | 49752 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:45.877294064 CEST | 49752 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:45.877618074 CEST | 49752 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:45.877629995 CEST | 443 | 49752 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.171312094 CEST | 443 | 49751 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.173093081 CEST | 49751 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.173106909 CEST | 443 | 49751 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.173502922 CEST | 443 | 49751 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.173810005 CEST | 49751 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.173873901 CEST | 443 | 49751 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.173965931 CEST | 49751 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.173990011 CEST | 49751 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.173996925 CEST | 443 | 49751 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.472162008 CEST | 443 | 49751 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.472321033 CEST | 443 | 49751 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.472414017 CEST | 49751 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.478976011 CEST | 49751 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.479001045 CEST | 443 | 49751 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.490076065 CEST | 49753 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.490128994 CEST | 443 | 49753 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.490206003 CEST | 49753 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.490727901 CEST | 49753 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.490741014 CEST | 443 | 49753 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.853786945 CEST | 443 | 49752 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.854199886 CEST | 49752 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.854218960 CEST | 443 | 49752 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.854706049 CEST | 443 | 49752 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.855021954 CEST | 49752 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.855091095 CEST | 443 | 49752 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:46.855186939 CEST | 49752 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.855231047 CEST | 49752 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:46.855237961 CEST | 443 | 49752 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.163964987 CEST | 443 | 49753 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.164338112 CEST | 49753 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:47.164366007 CEST | 443 | 49753 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.164725065 CEST | 443 | 49753 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.165030956 CEST | 49753 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:47.165080070 CEST | 443 | 49753 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.165194035 CEST | 49753 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:47.165215015 CEST | 49753 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:47.165218115 CEST | 443 | 49753 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.168628931 CEST | 443 | 49752 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.169470072 CEST | 443 | 49752 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.169542074 CEST | 49752 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:47.169657946 CEST | 49752 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:47.169675112 CEST | 443 | 49752 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.382206917 CEST | 443 | 49753 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.382742882 CEST | 443 | 49753 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:47.382797003 CEST | 49753 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:47.382919073 CEST | 49753 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:51:47.382936954 CEST | 443 | 49753 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:51:57.268584013 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:57.268627882 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:57.268723011 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:57.269093990 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:57.269103050 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.058646917 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.058849096 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.062623024 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.062635899 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.062882900 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.068878889 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.115395069 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.395920038 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.395940065 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.395953894 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.396015882 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.396044016 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.396064997 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.396085024 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.396967888 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.397001982 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.397028923 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.397037029 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.397063017 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.397640944 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.397676945 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.466454029 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.466485023 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:51:58.466500998 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 1, 2024 07:51:58.466507912 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 1, 2024 07:52:01.696485043 CEST | 443 | 49742 | 104.98.116.138 | 192.168.2.7 |
| Oct 1, 2024 07:52:01.696542978 CEST | 49742 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 1, 2024 07:52:07.157546043 CEST | 49756 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:52:07.157596111 CEST | 443 | 49756 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:52:07.157720089 CEST | 49756 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:52:07.157927990 CEST | 49756 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:52:07.157939911 CEST | 443 | 49756 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:52:08.306802034 CEST | 443 | 49756 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:52:08.321680069 CEST | 49756 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:52:08.321696043 CEST | 443 | 49756 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:52:08.322082996 CEST | 443 | 49756 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:52:08.373577118 CEST | 49756 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:52:08.416570902 CEST | 49756 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:52:08.416707993 CEST | 443 | 49756 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:52:08.467413902 CEST | 49756 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:52:15.680794954 CEST | 49757 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:15.680850029 CEST | 443 | 49757 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:15.680905104 CEST | 49757 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:15.681417942 CEST | 49757 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:15.681437969 CEST | 443 | 49757 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:16.318305969 CEST | 443 | 49757 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:16.318559885 CEST | 49757 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:16.318592072 CEST | 443 | 49757 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:16.320039034 CEST | 443 | 49757 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:16.321218014 CEST | 49757 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:16.321399927 CEST | 443 | 49757 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:16.322029114 CEST | 49757 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:16.322139978 CEST | 49757 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:16.322148085 CEST | 443 | 49757 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:16.630193949 CEST | 443 | 49757 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:16.630865097 CEST | 443 | 49757 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:16.630934000 CEST | 49757 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:16.631135941 CEST | 49757 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:16.631155968 CEST | 443 | 49757 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:17.782835960 CEST | 49759 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:17.782895088 CEST | 443 | 49759 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:17.782977104 CEST | 49759 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:17.783390999 CEST | 49759 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:17.783401966 CEST | 443 | 49759 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:18.220922947 CEST | 443 | 49756 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:52:18.221009970 CEST | 443 | 49756 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:52:18.221046925 CEST | 49756 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:52:18.420229912 CEST | 443 | 49759 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:18.549452066 CEST | 49759 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:18.549499989 CEST | 443 | 49759 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:18.551165104 CEST | 443 | 49759 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:18.639230967 CEST | 49759 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:18.642353058 CEST | 49759 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:18.642529011 CEST | 443 | 49759 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:18.642899990 CEST | 49759 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:18.642937899 CEST | 49759 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:18.642947912 CEST | 443 | 49759 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:18.864027977 CEST | 443 | 49759 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:18.864634991 CEST | 443 | 49759 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:18.864695072 CEST | 49759 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:18.867655993 CEST | 49759 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:18.867681026 CEST | 443 | 49759 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:31.161591053 CEST | 49756 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:52:31.161618948 CEST | 443 | 49756 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:52:46.427293062 CEST | 49761 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:46.427340031 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:46.427438974 CEST | 49761 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:46.427879095 CEST | 49761 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:46.427894115 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:47.057477951 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:47.057981968 CEST | 49761 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:47.058060884 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:47.058465004 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:47.058773041 CEST | 49761 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:47.058847904 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:47.058957100 CEST | 49761 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:47.059015036 CEST | 49761 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:47.059027910 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:47.356210947 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:47.357346058 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:47.357417107 CEST | 49761 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:47.357520103 CEST | 49761 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:47.357539892 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:50.594880104 CEST | 49762 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:50.594945908 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:50.595052004 CEST | 49762 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:50.595360041 CEST | 49762 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:50.595376968 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:51.225128889 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:51.225411892 CEST | 49762 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:51.225441933 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:51.225821972 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:51.226095915 CEST | 49762 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:51.226145983 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:51.226254940 CEST | 49762 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:51.226272106 CEST | 49762 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:51.226277113 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:51.523094893 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:51.523659945 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:52:51.523737907 CEST | 49762 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:51.523840904 CEST | 49762 | 443 | 192.168.2.7 | 142.250.185.174 |
| Oct 1, 2024 07:52:51.523861885 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.7 |
| Oct 1, 2024 07:53:07.219397068 CEST | 49763 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:53:07.219440937 CEST | 443 | 49763 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:53:07.219588995 CEST | 49763 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:53:07.219917059 CEST | 49763 | 443 | 192.168.2.7 | 172.217.16.196 |
| Oct 1, 2024 07:53:07.219929934 CEST | 443 | 49763 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:53:07.868382931 CEST | 443 | 49763 | 172.217.16.196 | 192.168.2.7 |
| Oct 1, 2024 07:53:07.921124935 CEST | 49763 | 443 | 192.168.2.7 | 172.217.16.196 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 07:51:04.210196018 CEST | 61927 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:51:04.210361004 CEST | 51212 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:51:04.215989113 CEST | 53 | 50959 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:04.216881037 CEST | 53 | 61927 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:04.218278885 CEST | 53 | 51212 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:04.218631983 CEST | 53 | 52704 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.319766998 CEST | 56216 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:51:05.320005894 CEST | 56073 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:51:05.326322079 CEST | 53 | 56216 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.326978922 CEST | 53 | 56073 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:05.371014118 CEST | 53 | 60216 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.093318939 CEST | 65226 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:51:07.093400002 CEST | 54368 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:51:07.100291014 CEST | 53 | 65226 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.100307941 CEST | 53 | 54368 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:07.952447891 CEST | 123 | 123 | 192.168.2.7 | 13.95.65.251 |
| Oct 1, 2024 07:51:08.137028933 CEST | 123 | 123 | 13.95.65.251 | 192.168.2.7 |
| Oct 1, 2024 07:51:10.560928106 CEST | 53 | 60443 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:13.207657099 CEST | 65181 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:51:13.208031893 CEST | 55008 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:51:13.214989901 CEST | 53 | 55008 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:13.219799995 CEST | 53 | 65181 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.742449045 CEST | 53689 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:51:14.742728949 CEST | 61586 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:51:14.749135017 CEST | 53 | 53689 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:14.750086069 CEST | 53 | 61586 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:17.244951010 CEST | 53 | 54927 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:22.444931984 CEST | 53 | 63342 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:51:41.404077053 CEST | 53 | 64350 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:52:02.178462029 CEST | 138 | 138 | 192.168.2.7 | 192.168.2.255 |
| Oct 1, 2024 07:52:02.759990931 CEST | 53 | 59536 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:52:04.036067963 CEST | 53 | 60349 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:52:15.503221989 CEST | 53499 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:52:15.503403902 CEST | 58235 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 1, 2024 07:52:15.679996967 CEST | 53 | 54583 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:52:15.680140018 CEST | 53 | 58235 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:52:15.680183887 CEST | 53 | 53499 | 1.1.1.1 | 192.168.2.7 |
| Oct 1, 2024 07:52:31.169519901 CEST | 53 | 53967 | 1.1.1.1 | 192.168.2.7 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 07:51:04.210196018 CEST | 192.168.2.7 | 1.1.1.1 | 0x6c7f | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 07:51:04.210361004 CEST | 192.168.2.7 | 1.1.1.1 | 0xc796 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 07:51:05.319766998 CEST | 192.168.2.7 | 1.1.1.1 | 0xa7fd | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 07:51:05.320005894 CEST | 192.168.2.7 | 1.1.1.1 | 0xb6f2 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 07:51:07.093318939 CEST | 192.168.2.7 | 1.1.1.1 | 0x285 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 07:51:07.093400002 CEST | 192.168.2.7 | 1.1.1.1 | 0x4b5b | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 07:51:13.207657099 CEST | 192.168.2.7 | 1.1.1.1 | 0x1fbe | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 07:51:13.208031893 CEST | 192.168.2.7 | 1.1.1.1 | 0x3cf3 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 07:51:14.742449045 CEST | 192.168.2.7 | 1.1.1.1 | 0xa201 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 07:51:14.742728949 CEST | 192.168.2.7 | 1.1.1.1 | 0x12ed | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 07:52:15.503221989 CEST | 192.168.2.7 | 1.1.1.1 | 0xda62 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 07:52:15.503403902 CEST | 192.168.2.7 | 1.1.1.1 | 0x451b | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 07:51:04.216881037 CEST | 1.1.1.1 | 192.168.2.7 | 0x6c7f | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:04.218278885 CEST | 1.1.1.1 | 192.168.2.7 | 0xc796 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 216.58.212.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326322079 CEST | 1.1.1.1 | 192.168.2.7 | 0xa7fd | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326978922 CEST | 1.1.1.1 | 192.168.2.7 | 0xb6f2 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:05.326978922 CEST | 1.1.1.1 | 192.168.2.7 | 0xb6f2 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 07:51:07.100291014 CEST | 1.1.1.1 | 192.168.2.7 | 0x285 | No error (0) | 172.217.16.196 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:07.100307941 CEST | 1.1.1.1 | 192.168.2.7 | 0x4b5b | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 07:51:13.214989901 CEST | 1.1.1.1 | 192.168.2.7 | 0x3cf3 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:13.219799995 CEST | 1.1.1.1 | 192.168.2.7 | 0x1fbe | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:13.219799995 CEST | 1.1.1.1 | 192.168.2.7 | 0x1fbe | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:51:14.749135017 CEST | 1.1.1.1 | 192.168.2.7 | 0xa201 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 07:52:15.680183887 CEST | 1.1.1.1 | 192.168.2.7 | 0xda62 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.7 | 49702 | 172.217.16.206 | 443 | 7196 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 05:51:05 UTC | 847 | OUT | |
| 2024-10-01 05:51:05 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.7 | 49706 | 142.250.186.110 | 443 | 7196 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 05:51:05 UTC | 865 | OUT | |
| 2024-10-01 05:51:06 UTC | 2634 | IN |