Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1523185 |
| MD5: | ae543423edfe9428f33208d64ae7c680 |
| SHA1: | 612206a41dc3b1510f9faab1aae9b8a896145630 |
| SHA256: | f0a75b1a1253e778feb63f69402b3b0276b964470251dcc2160b90ba0868f57c |
| Tags: | exeuser-Bitsight |
| Infos: | |
 | |
Detection
| Score: | 56 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Classification
- System is w10x64
file.exe (PID: 4788 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: AE543423EDFE9428F33208D64AE7C680) 
chrome.exe (PID: 1876 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ap p="https:/ /youtube.c om/account ?=https:// accounts.g oogle.com/ v3/signin/ challenge/ pwd" --sta rt-fullscr een --no-f irst-run - -disable-s ession-cra shed-bubbl e --disabl e-features =CrashReco very MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 1560 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2044 --fi eld-trial- handle=198 0,i,839879 4096650981 881,146126 6671636611 4694,26214 4 --disabl e-features =CrashReco very /pref etch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 8100 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=56 60 --field -trial-han dle=1980,i ,839879409 6650981881 ,146126667 1636611469 4,262144 - -disable-f eatures=Cr ashRecover y /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 8108 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5356 --f ield-trial -handle=19 80,i,83987 9409665098 1881,14612 6667163661 14694,2621 44 --disab le-feature s=CrashRec overy /pre fetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00F0DBBE | |
| Source: | Code function: | 0_2_00EDC2A2 | |
| Source: | Code function: | 0_2_00F168EE | |
| Source: | Code function: | 0_2_00F1698F | |
| Source: | Code function: | 0_2_00F0D076 | |
| Source: | Code function: | 0_2_00F0D3A9 | |
| Source: | Code function: | 0_2_00F19642 | |
| Source: | Code function: | 0_2_00F1979D | |
| Source: | Code function: | 0_2_00F19B2B | |
| Source: | Code function: | 0_2_00F15C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_00F1CE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00F1EAFF | |
| Source: | Code function: | 0_2_00F1ED6A | |
| Source: | Code function: | 0_2_00F1EAFF | |
| Source: | Code function: | 0_2_00F0AA57 | |
| Source: | Code function: | 0_2_00F39576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_8b76eb58-6 | |
| Source: | String found in binary or memory: | memstr_24454b55-8 | |
| Source: | String found in binary or memory: | memstr_a863ab79-1 | |
| Source: | String found in binary or memory: | memstr_6a433769-1 | |
| Source: | Code function: | 0_2_00F0D5EB | |
| Source: | Code function: | 0_2_00F01201 | |
| Source: | Code function: | 0_2_00F0E8F6 | |
| Source: | Code function: | 0_2_00EA8060 | |
| Source: | Code function: | 0_2_00F12046 | |
| Source: | Code function: | 0_2_00F08298 | |
| Source: | Code function: | 0_2_00EDE4FF | |
| Source: | Code function: | 0_2_00ED676B | |
| Source: | Code function: | 0_2_00F34873 | |
| Source: | Code function: | 0_2_00EACAF0 | |
| Source: | Code function: | 0_2_00ECCAA0 | |
| Source: | Code function: | 0_2_00EBCC39 | |
| Source: | Code function: | 0_2_00ED6DD9 | |
| Source: | Code function: | 0_2_00EA91C0 | |
| Source: | Code function: | 0_2_00EBB119 | |
| Source: | Code function: | 0_2_00EC1394 | |
| Source: | Code function: | 0_2_00EC1706 | |
| Source: | Code function: | 0_2_00EC781B | |
| Source: | Code function: | 0_2_00EC19B0 | |
| Source: | Code function: | 0_2_00EB997D | |
| Source: | Code function: | 0_2_00EA7920 | |
| Source: | Code function: | 0_2_00EC7A4A | |
| Source: | Code function: | 0_2_00EF3CEB | |
| Source: | Code function: | 0_2_00EC7CA7 | |
| Source: | Code function: | 0_2_00EC1C77 | |
| Source: | Code function: | 0_2_00ED9EEE | |
| Source: | Code function: | 0_2_00F2BE44 | |
| Source: | Code function: | 0_2_00EC1F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00F137B5 | |
| Source: | Code function: | 0_2_00F010BF | |
| Source: | Code function: | 0_2_00F016C3 | |
| Source: | Code function: | 0_2_00F151CD | |
| Source: | Code function: | 0_2_00F0D4DC | |
| Source: | Code function: | 0_2_00F1648E | |
| Source: | Code function: | 0_2_00EA42A2 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00EA42DE | |
| Source: | Code function: | 0_2_00EC0A89 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00EBF98E | |
| Source: | Code function: | 0_2_00F31C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-95363 | ||
| Source: | API coverage: | ||
| Source: | Code function: | 0_2_00F0DBBE | |
| Source: | Code function: | 0_2_00EDC2A2 | |
| Source: | Code function: | 0_2_00F168EE | |
| Source: | Code function: | 0_2_00F1698F | |
| Source: | Code function: | 0_2_00F0D076 | |
| Source: | Code function: | 0_2_00F0D3A9 | |
| Source: | Code function: | 0_2_00F19642 | |
| Source: | Code function: | 0_2_00F1979D | |
| Source: | Code function: | 0_2_00F19B2B | |
| Source: | Code function: | 0_2_00F15C97 | |
| Source: | Code function: | 0_2_00EA42DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00F1EAA2 | |
| Source: | Code function: | 0_2_00ED2622 | |
| Source: | Code function: | 0_2_00EA42DE | |
| Source: | Code function: | 0_2_00EC4CE8 | |
| Source: | Code function: | 0_2_00F00B62 | |
| Source: | Code function: | 0_2_00ED2622 | |
| Source: | Code function: | 0_2_00EC083F | |
| Source: | Code function: | 0_2_00EC09D5 | |
| Source: | Code function: | 0_2_00EC0C21 | |
| Source: | Code function: | 0_2_00F01201 | |
| Source: | Code function: | 0_2_00EE2BA5 | |
| Source: | Code function: | 0_2_00F0B226 | |
| Source: | Code function: | 0_2_00F222DA | |
| Source: | Code function: | 0_2_00F00B62 | |
| Source: | Code function: | 0_2_00F01663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00EC0698 | |
| Source: | Code function: | 0_2_00F18195 | |
| Source: | Code function: | 0_2_00EFD27A | |
| Source: | Code function: | 0_2_00EDB952 | |
| Source: | Code function: | 0_2_00EA42DE | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00F21204 | |
| Source: | Code function: | 0_2_00F21806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 15 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 1 Masquerading | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Virtualization/Sandbox Evasion | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 21 Access Token Manipulation | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 2 Process Injection | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 1% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.185.206 | true | false |
| unknown |
| www3.l.google.com | 142.250.186.174 | true | false |
| unknown |
| play.google.com | 142.250.186.110 | true | false |
| unknown |
| www.google.com | 142.250.185.100 | true | false |
| unknown |
| youtube.com | 142.250.185.110 | true | false |
| unknown |
| accounts.youtube.com | unknown | unknown | false |
| unknown |
| www.youtube.com | unknown | unknown | false |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.185.206 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.174 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.110 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.100 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.186.110 | play.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.16.142 | unknown | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.5 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1523185 |
| Start date and time: | 2024-10-01 08:59:05 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 45s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 10 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal56.evad.winEXE@31/36@12/8 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.251.173.84, 172.217.16.206, 34.104.35.123, 142.250.185.138, 172.217.23.106, 216.58.212.170, 142.250.186.106, 142.250.186.138, 172.217.16.202, 172.217.18.10, 142.250.185.74, 142.250.185.202, 142.250.185.170, 216.58.212.138, 216.58.206.74, 142.250.74.202, 142.250.186.42, 142.250.185.106, 142.250.186.170, 142.250.185.227, 142.250.74.195, 142.250.186.74, 142.250.184.234, 172.217.16.138, 216.58.206.42, 142.250.181.234, 142.250.184.202, 142.250.185.234, 93.184.221.240, 192.229.221.95, 64.233.184.84, 142.250.186.78
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 1138de370e523e824bbca92d049a3777 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
|
⊘No context
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.979476293556402 |
| Encrypted: | false |
| SSDEEP: | 48:8f8dnT/zPHV0idAKZdA19ehwiZUklqehly+3:8f8H9S+y |
| MD5: | 9A1A5A0E61F7FC358FF016B5458F7DF6 |
| SHA1: | 35824FF6777D0188337010D5FB004A8F791D1278 |
| SHA-256: | C6555D50D82AC60534963F3989B698B2EDB1F9A1531CED759BD6B7724F8AA7EE |
| SHA-512: | 666411E0F2FA05936250845101D9899D84E43D43E506AD340178E201EB47D18685EB96A8307993039BD17FDDC8849D94A643F4E2B7C53483D23F0C12A8BF6757 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.995317166397845 |
| Encrypted: | false |
| SSDEEP: | 48:8FdnT/zPHV0idAKZdA1weh/iZUkAQkqehuy+2:8vH9I9QXy |
| MD5: | D9891C5320F299AE92556EC2E895EC2B |
| SHA1: | 8D30F6B6017BFC324C271D7319A0C64E0F4A8B36 |
| SHA-256: | 66C375D7530EA177039899C8AFB661A31400E08689A71C742D56FB7F3651149C |
| SHA-512: | E2E77A4E08D2F317B3CFCFD33E999AEC99CA04E6A48217874EB7C986A4DE7C62D1F95050D26E425F16D76BE203567CEDE199B35E69D948966FBA00C0CAE8191F |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2693 |
| Entropy (8bit): | 4.00466009092683 |
| Encrypted: | false |
| SSDEEP: | 48:8x8dnT/zsHV0idAKZdA14tseh7sFiZUkmgqeh7sYy+BX:8x8H6gnSy |
| MD5: | A7F48AFC193918B62240BF8BD885BB3D |
| SHA1: | 1CDA6D7B1BFCFE8F74CA63D2FA523EFE8203EDDC |
| SHA-256: | 7CFF47F0EAC452D92E88632235D41D7E89A9C88EAFF2962037930DC4285DE939 |
| SHA-512: | AB1B8DAA74CB4869DCA482B2213C53A15947BA4A1C958697ED564627982B53A9B846519BAF5C2149462FA999A217BCA66045EE18582455CF5381E3102D1A8218 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9927773742553865 |
| Encrypted: | false |
| SSDEEP: | 48:8AdnT/zPHV0idAKZdA1vehDiZUkwqeh6y+R:8YH9Tgy |
| MD5: | 08E304785A0B5BF12A60C16399BC39D6 |
| SHA1: | F01C78A8A37946DF5CF4BE27A7C74137919A94D6 |
| SHA-256: | 0D60B67B8CE295BE0E72EBAF28698DC4D2D2F0673EB977FC69CCD6E1A96ACF17 |
| SHA-512: | 89F8F8E8F4B3AFC3A8C6CB0B41023A7D8E0BE67451575CD84C7C036E0C8AB1FB9EB36F36441BF640F538D6BF58FF9B64C6A30C7A812CF1D52B9E61CB8357BC2C |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.981854887717069 |
| Encrypted: | false |
| SSDEEP: | 48:8vdnT/zPHV0idAKZdA1hehBiZUk1W1qehsy+C:8hH9D9My |
| MD5: | 458A23F0C7404E7A3E53B06EBE14BB0A |
| SHA1: | 7F0AF99A88B02F20A2042E4B6CAFA9B52AB06A56 |
| SHA-256: | B6D256D33C3BC9AF8314E695989334B12F10EF7448E5B40AC833A393174CC060 |
| SHA-512: | EED80CF25CFDCE59B965488254B89F6A3989E1532580AD0E518BAD7CB41B8060494B7278C753DCC2D2D1EFF0EBEF2E56AF97ACC4E99A30B7D527CC99D1B74259 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2683 |
| Entropy (8bit): | 3.9909999860841308 |
| Encrypted: | false |
| SSDEEP: | 48:8QdnT/zPHV0idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbSy+yT+:8IH9zT/TbxWOvTbSy7T |
| MD5: | 2C48FBCEBD45C0F6A54DAA9781CD73C6 |
| SHA1: | 27A4737D350ECD48D7C9D6C1311F3B23838DC7DD |
| SHA-256: | 12E3388B9F31366A535C3A584999573C83976531E662BA826F0D4B3A4AA8AC2B |
| SHA-512: | A74FEA52EAAF1793A9E5870E1CCB25B4BF0700B104D36BB0CC53DB8807FB33AC8224831B985746882C896472F27810381B611B0001FE3DF1FB26068E412089E3 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.3872171131917925 |
| Encrypted: | false |
| SSDEEP: | 192:FK/pAzN7GZ068Hqhqu6DQaVapzYjgKItwdiwUsYRTi1j1t9bRl9:FqI7GZ04dRYjghtgisYYbt9ll9 |
| MD5: | AB70454DE18E1CE16E61EAC290FC304D |
| SHA1: | 68532B5E8B262D7E14B8F4507AA69A61146B3C18 |
| SHA-256: | B32D746867CC4FA21FD39437502F401D952D0A3E8DC708DFB7D58B85F256C0F1 |
| SHA-512: | A123C517380BEF0B47F23A5A6E1D16650FE39D9C701F9FA5ADD79294973C118E8EA3A7BA32CB63C3DFC0CE0F843FB86BFFCAA2AAE987629E7DFF84F176DEBB98 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32499 |
| Entropy (8bit): | 5.361345284201954 |
| Encrypted: | false |
| SSDEEP: | 768:mLX1O+aL6fgyIiREM4RKmh90toLoTswtF3ATcbDR6kIsnJd9DPyMv/FI:U2M4oltoLoTswtFoc/tIsnXFLI |
| MD5: | D5C3FB8EAE24AB7E40009338B5078496 |
| SHA1: | 5638BF5986A6445A88CD79A9B690B744B126BEC2 |
| SHA-256: | 597C14D360D690BCFDC2B8D315E6BB8879AEF33DE6C30D274743079BDB63C6B0 |
| SHA-512: | 6AE434850D473BEF15AA694AB4862596982CDDA6BD3991991D3ADD8F4A5F61DFBF8756D0DA98B72EF083909D68CF7B6B148A6488E9381F92FBF15CCB20176A0E |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.3750044852869046 |
| Encrypted: | false |
| SSDEEP: | 48:o7zfN/cD498xdg+Y5jNQ8js6npwk0OmNAEZbpMzR4EQBcW5QcHj9KWfGAeFKRrw:oCD9dA5jOEGh+EFqR4rhqUhzff9w |
| MD5: | 39693D34EE3D1829DBB1627C4FC6687B |
| SHA1: | A03303C2F027F3749B48D5134D1F8FB3E495C6E9 |
| SHA-256: | 03B0C1B4E402E0BCF75D530DD9085B25357EEFD09E238453DE1F3A042542C076 |
| SHA-512: | AC0749EDC33DA0EC0E40470388DD797B6528AD08B8FAC1C2AC42F85198131052BA1B533E90409D35DA237607E8B07D591FA6BA580B6A90B0D0AB2282A01F7585 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3471 |
| Entropy (8bit): | 5.5174491302699495 |
| Encrypted: | false |
| SSDEEP: | 96:ojAmjTJ/fJgpIcB7Fd2tilGBEMO/A6VxV08w:vUTJpgDJXM0ApJ |
| MD5: | 2D999C87DD54C7FE6400D267C33FBB23 |
| SHA1: | 414C3A329C2760325EDBACBD7A221D7F8DBFEEE8 |
| SHA-256: | 76D55A1AFC1D39CB04D60EB04E45A538A0E75EE2871561C84CC89B1C13596BCC |
| SHA-512: | 72D923BB71DD147139962FF8E2BD0E336E0F6409C212AC2F25387D0F3B4FC9365F5A6D40E2980BB1065534888362C97D6B7663E362D29166B5915D2A9DA7D238 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.280977407061266 |
| Encrypted: | false |
| SSDEEP: | 48:o7YNJvl3WlENrpB3stYCIgMxILNH/wf7DVTBpdQrw:oApB8iDwYlGw |
| MD5: | 4FB66582D37D04933F00E49C2FBA34D4 |
| SHA1: | 3DB09C53BBEB1EEB045A001356E498D8EF30915D |
| SHA-256: | A97DAC01ABFE3EB75C7C97D504E21BDDDADDB6EBE0B56B6A9A10CD3700CAB41B |
| SHA-512: | 2AEB3A6CFFBF6EFA626EBDC9E11ACBAC04BFE986F98FBC050B2501898B289C67D392ED195D16ACC9565EF8784401ADA1E88188CDE3A7AB12D98BB5ED7D8A5711 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.316515499943097 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DduJqrxsNL90YIzFK/Hb5eNhz1uktdDuvKKKGbLZ99GbSSF/ZR8OkdnprGJ:o7DQJopFN+ASCKKGbF99GbSS3RY7rw |
| MD5: | D97AB4594FC610665FF2763A650EE6A8 |
| SHA1: | 5C7459CA838D27BE45745571D8D96D156F4B9F8D |
| SHA-256: | 767D778369623FD8F5FB98D3BCC3130D05D02CBE0B9B88DD226F43281B14E9AF |
| SHA-512: | CE4941B41C3A8CC983C1BBCC87EF682823CB9DB24EA7A570E35BBF832046340D433F7D47211384B61FA38F3527CC35C195A6068CCB24B48E1F492C5B4D4192A1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5049 |
| Entropy (8bit): | 5.317800104741948 |
| Encrypted: | false |
| SSDEEP: | 96:oHX9gPiPrfnHhsB0TR6kg1oDPJzLmM18Vh1z2fEZ54TZtnqj6w:EtEAr6BmPZtOeEvW/ncP |
| MD5: | CE53EF566B68CCF2D62FA044CFB0D138 |
| SHA1: | F48EC60289F2B55E8B388601206888F8295B1EB1 |
| SHA-256: | E6CC5114D92811D5DE0663266D4B63F367834AFA0FC3BAFA54F707038C59D010 |
| SHA-512: | 20B434881DE971E263669E6096C01665D4D35B0FBFF47D312A4A442645EE962A8CE6AD7E68246D4EE9691BD30D9B1DDCF7059226492E1B58CD3191B63B001E4D |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 697429 |
| Entropy (8bit): | 5.593310312179182 |
| Encrypted: | false |
| SSDEEP: | 6144:TYNlxfbDTYDhzCTNoygVWyJb5eGpbL2Mp15gI8seqfh53p+rrvV7i:T25bDTYB+qeGB+Nu |
| MD5: | 92F0F5E28355D863ACB77313F1E675DE |
| SHA1: | 8AD6F9B535D5B8952A4ADCCC57E4A4E0723F1E8D |
| SHA-256: | F903AE346609A2872554A3D8FFBDB1836CB5C8B7AAAED4C3F8296B887E03D833 |
| SHA-512: | 0C81A6CD850C6ACDBE9CCCBA00BBA34CDE1E09E8572814AE8E55DBED3C2B56F0B020359841F8217843B3403847DF46FA1C82229684F762A73C8110CE45898DAF |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.253939888205379 |
| Encrypted: | false |
| SSDEEP: | 48:o7BNJfeFb8L3A6FHqIy5Z+d70OCzSfvi/3fM/r8ZQzRrw:oFuILhFHrVCz0vLZz9w |
| MD5: | 10FF6F99E3228E96AFD6E2C30EF97C0A |
| SHA1: | 4AE3DCB8D1F5A0C302D5BAD9DFF5050A7A5E8130 |
| SHA-256: | 95E5546E1C7F311D07BB5050CC456A973E43BCC4777BA6014757376016537679 |
| SHA-512: | 116C0B1CAC98A27044100005545AB66BE5F4801D75DC259093A9F145B3A4ACD8DC1C360AF525F6DC8421CD54B675A78023D2ED8B57F5946A3969543758C673C9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22827 |
| Entropy (8bit): | 5.420322672717721 |
| Encrypted: | false |
| SSDEEP: | 384:/jqdWXWfyA20UUjDE8BSUxDJs16KHvSN34kaHaN+587SaXD2mLR0H:/jqdWXAUUjDE84Wi6KPSKjHaN+58+0J2 |
| MD5: | 2B29741A316862EE788996DD29116DD5 |
| SHA1: | 9D5551916D4452E977C39B8D69CF88DF2AAA462B |
| SHA-256: | 62955C853976B722EFBB4C116A10DB3FF54580EDD7495D280177550B8F4289AB |
| SHA-512: | 6E37C3258F07F29909763728DADE0CD40A3602D55D9099F78B37756926FCF2A50008B82876B518FEAF3E56617F0F7D1D37A73C346A99A58E6AD8BCD6689E9B15 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4070 |
| Entropy (8bit): | 5.362700670482359 |
| Encrypted: | false |
| SSDEEP: | 96:GUpT+TmXtdW1qsHFcn7t7CnyWYvNTcLaQOw:lpT+qXW1PFcn7tGnyWY1TGb |
| MD5: | ED368A20CB303C0E7C6A3E6E43C2E14F |
| SHA1: | 429A5C538B45221F80405163D1F87912DD73C05A |
| SHA-256: | 93BA77AD4B11E0A70C0D36576F0DF24E27F50001EA02BAA6D357E034532D97F2 |
| SHA-512: | DE74BBADE910475DD245FFEFD4E1FD10137DE710B1C920D33BA52554911496E1339EF3C1F6D9D315CBC98A60ABE5687A3E7D8BEE483708E18D25722E794BDBE9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 603951 |
| Entropy (8bit): | 5.789948381047936 |
| Encrypted: | false |
| SSDEEP: | 3072:W0pApkygA62bwwdnO2YflNYhFGOizdGj008PpVVM96C5bMEPQUhts6FV8eKqtVAT:WlgNmwwdnOsF98oNGuQRAYqXsI1+ |
| MD5: | A97373CC3F8795654F3C8C6B57066AE7 |
| SHA1: | F7BECFDDE230EF537E8745B598DCED737C490C3C |
| SHA-256: | A1B0568D555DC4B4AF4CC5A6C41E838B702816445C04FF002C8A13058387F311 |
| SHA-512: | 47C76D26F4F9F206F93186800E06D3DBE1FDD0A1BA23FB9A3556390DE7F86C1FFB2C78FE307FB944C690475BFBAE9738C38233E00FDDFA9775A3B2030081D7F1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEQAz5EZnBR6fK6LIn1v8ILsATM3g/m=_b,_tp" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.579760881033184 |
| TrID: |
|
| File name: | file.exe |
| File size: | 917'504 bytes |
| MD5: | ae543423edfe9428f33208d64ae7c680 |
| SHA1: | 612206a41dc3b1510f9faab1aae9b8a896145630 |
| SHA256: | f0a75b1a1253e778feb63f69402b3b0276b964470251dcc2160b90ba0868f57c |
| SHA512: | 0fc2bca7b018cfa855ac5bbcbb255d402e08b33941055d463c0d4a8d68247202155d7b6a9c1415f3334c7b6310d132a558c8d170db82f4080839481082143c71 |
| SSDEEP: | 12288:7qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagT4:7qDEvCTbMWu7rQYlBQcBiT6rprG8a44 |
| TLSH: | 28159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FB998A [Tue Oct 1 06:41:14 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F54F4B25CC3h |
| jmp 00007F54F4B255CFh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F54F4B257ADh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F54F4B2577Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F54F4B2836Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F54F4B283B8h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F54F4B283A1h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x95ac | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x95ac | 0x9600 | 51b7293c9ab480202e2cfce5e01e05cd | False | 0.2860416666666667 | data | 5.1634365561619004 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0x874 | data | 1.005083179297597 | ||
| RT_GROUP_ICON | 0xdd02c | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd0a4 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd0b8 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd0cc | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd0e0 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd1bc | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 08:59:52.116360903 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 08:59:52.116369009 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 08:59:52.241311073 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 08:59:56.089720964 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:56.089776039 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.089844942 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:56.093400955 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:56.093417883 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.748182058 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.789412022 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:56.801703930 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:56.801714897 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.802186966 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.802237988 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:56.803248882 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.803297997 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:56.813951969 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:56.814016104 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.814306974 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:56.814315081 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.866480112 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:57.167310953 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.167368889 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.167416096 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:57.171258926 CEST | 49706 | 443 | 192.168.2.5 | 142.250.185.110 |
| Oct 1, 2024 08:59:57.171288013 CEST | 443 | 49706 | 142.250.185.110 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.182636976 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:57.182687044 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.182746887 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:57.183209896 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:57.183226109 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.814449072 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.814802885 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:57.814840078 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.815407991 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.815474987 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:57.816401958 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.816451073 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:57.817581892 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:57.817677975 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.817828894 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:57.817850113 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.866045952 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:58.283468962 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:58.283493042 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:58.283565044 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:58.283591986 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 08:59:58.283735037 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:58.286772013 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.206 |
| Oct 1, 2024 08:59:58.286794901 CEST | 443 | 49710 | 142.250.185.206 | 192.168.2.5 |
| Oct 1, 2024 09:00:00.488671064 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:00.488753080 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:00.488843918 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:00.489051104 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:00.489075899 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:00.567441940 CEST | 49717 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:00.567467928 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:00.567538023 CEST | 49717 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:00.569021940 CEST | 49717 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:00.569031954 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.136804104 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.138530016 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:01.138575077 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.139472008 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.139545918 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:01.140551090 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:01.140613079 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.189465046 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:01.189491034 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.216824055 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.216913939 CEST | 49717 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:01.219914913 CEST | 49717 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:01.219922066 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.220314026 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.240598917 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:01.256877899 CEST | 49717 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:01.303404093 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.483715057 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.483854055 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.483911037 CEST | 49717 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:01.558239937 CEST | 49717 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:01.558262110 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.558273077 CEST | 49717 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:01.558278084 CEST | 443 | 49717 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.722615957 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:01.722820044 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:01.777323961 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:01.777373075 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.777436018 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:01.777873039 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:01.777887106 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:01.848790884 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:02.414010048 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:02.414072990 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:02.416205883 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:02.416218996 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:02.416690111 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:02.417787075 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:02.463401079 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:02.689539909 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:02.689582109 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:02.689894915 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:02.691080093 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:02.691101074 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:02.691114902 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 09:00:02.691121101 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 09:00:03.481139898 CEST | 443 | 49703 | 23.1.237.91 | 192.168.2.5 |
| Oct 1, 2024 09:00:03.481226921 CEST | 49703 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:05.268002987 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:05.268022060 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:05.268326998 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:05.268984079 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:05.268996000 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:05.988617897 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:05.989489079 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:05.989506960 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:05.989839077 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:05.989907980 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:05.990468025 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:05.990521908 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:05.991605043 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:05.991655111 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:05.991975069 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:05.991981030 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.038316965 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.307327032 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.307373047 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.307415962 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.307455063 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.307475090 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.307502985 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.313277006 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.319499016 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.319531918 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.319631100 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.319631100 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.319638968 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.321367025 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.326173067 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.326255083 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.332062960 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.332093954 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.332159042 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.332168102 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.332211971 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.396595955 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.396859884 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.397073984 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.397131920 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.397430897 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.397481918 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.403665066 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.403703928 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.403754950 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.403762102 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.403815985 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.410089970 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.410278082 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.416002989 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.416068077 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.416146994 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.421246052 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.425163984 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.425169945 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.427571058 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.427695036 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.427757978 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.667144060 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 09:00:06.667172909 CEST | 443 | 49732 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.705183029 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:06.705214977 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.705394030 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:06.706197977 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:06.706209898 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.744441032 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:06.744488001 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.744573116 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:06.744908094 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:06.744920969 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.342426062 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.342823029 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.342842102 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.343173027 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.343242884 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.343803883 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.343853951 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.344866037 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.344918013 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.345180988 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.345186949 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.393533945 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.393698931 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.393704891 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.394057035 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.394126892 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.394746065 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.394797087 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.394906998 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.394963026 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.395064116 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.395070076 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.398590088 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.445471048 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.643604994 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.644084930 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.644165039 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.644345999 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.644361973 CEST | 443 | 49735 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.644372940 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.644407034 CEST | 49735 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.645381927 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.645463943 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.645544052 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.645874023 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.645905972 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.698529005 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.698781013 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.698849916 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.698929071 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.698934078 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.698961020 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.698977947 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.699620008 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.699656963 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:07.699719906 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.699963093 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:07.699979067 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.326884031 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.327152014 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.327172995 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.327534914 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.327605009 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.328217030 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.328279018 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.328423023 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.328481913 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.328562021 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.328572035 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.328586102 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.371026993 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.371287107 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.371330023 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.371807098 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.371881962 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.372512102 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.372574091 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.372698069 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.372766018 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.372838974 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.372862101 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.372898102 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.375397921 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.382203102 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.412992001 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.413008928 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.545718908 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.546422958 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.546567917 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.546986103 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.547002077 CEST | 443 | 49741 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.599299908 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.599767923 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:08.599906921 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.600367069 CEST | 49740 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:08.600378990 CEST | 443 | 49740 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:09.039953947 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:09.083432913 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:09.400038958 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:09.400079012 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:09.400106907 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:09.400140047 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:09.400139093 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:09.400171995 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:09.400202990 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:09.400247097 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:09.400300980 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:09.414117098 CEST | 49715 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:00:09.414139986 CEST | 443 | 49715 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:00:12.364765882 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:12.364801884 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:12.364871025 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:12.369091034 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:12.369106054 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:13.156553030 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:13.156625032 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:13.165412903 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:13.165421009 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:13.165802002 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:13.210046053 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:13.990952969 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:14.035408974 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.246778965 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.246810913 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.246820927 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.246838093 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.246897936 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.246913910 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:14.246939898 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.246954918 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:14.246984959 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:14.247565031 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.247644901 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:14.247651100 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.247714996 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.247770071 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:14.303734064 CEST | 49703 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:14.303850889 CEST | 49703 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:14.306337118 CEST | 49754 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:14.306411028 CEST | 443 | 49754 | 23.1.237.91 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.306502104 CEST | 49754 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:14.307029009 CEST | 49754 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:14.307068110 CEST | 443 | 49754 | 23.1.237.91 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.308504105 CEST | 443 | 49703 | 23.1.237.91 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.308604002 CEST | 443 | 49703 | 23.1.237.91 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.393959045 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:14.394009113 CEST | 443 | 49755 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.394067049 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:14.394464016 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:14.394490957 CEST | 443 | 49755 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.896106958 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:14.896133900 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.896145105 CEST | 49747 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:14.896155119 CEST | 443 | 49747 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.900437117 CEST | 443 | 49754 | 23.1.237.91 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.900513887 CEST | 49754 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:15.043663025 CEST | 443 | 49755 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:15.043937922 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:15.043963909 CEST | 443 | 49755 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:15.044348001 CEST | 443 | 49755 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:15.044706106 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:15.044787884 CEST | 443 | 49755 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:15.044907093 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:15.044944048 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:15.044956923 CEST | 443 | 49755 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:15.375485897 CEST | 443 | 49755 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:15.376472950 CEST | 443 | 49755 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:15.376550913 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:15.377585888 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:15.377619028 CEST | 443 | 49755 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:34.050168991 CEST | 443 | 49754 | 23.1.237.91 | 192.168.2.5 |
| Oct 1, 2024 09:00:34.050262928 CEST | 49754 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 09:00:37.041346073 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.041438103 CEST | 443 | 49757 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.041538954 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.041937113 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.041971922 CEST | 443 | 49757 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.322407961 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.322472095 CEST | 443 | 49758 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.322545052 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.322845936 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.322859049 CEST | 443 | 49758 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.846482038 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.846529007 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.846606016 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.847148895 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.847162962 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.867568016 CEST | 443 | 49757 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.867850065 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.867913008 CEST | 443 | 49757 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.868444920 CEST | 443 | 49757 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.868825912 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.868921041 CEST | 443 | 49757 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.868985891 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.869045973 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.869059086 CEST | 443 | 49757 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.951617002 CEST | 443 | 49758 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.990746021 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.990786076 CEST | 443 | 49758 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.991271973 CEST | 443 | 49758 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.993073940 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.993146896 CEST | 443 | 49758 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:37.993268967 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.993321896 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:37.993334055 CEST | 443 | 49758 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.170589924 CEST | 443 | 49757 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.170905113 CEST | 443 | 49757 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.171005011 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.171518087 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.171565056 CEST | 443 | 49757 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.252679110 CEST | 443 | 49758 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.252986908 CEST | 443 | 49758 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.253045082 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.253267050 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.253287077 CEST | 443 | 49758 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.494940996 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.495294094 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.495311022 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.495662928 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.495723009 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.496355057 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.496403933 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.496547937 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.496604919 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.496715069 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.496726990 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.496747971 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.541316986 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.541325092 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.715455055 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.715903997 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:38.716068029 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.716100931 CEST | 49759 | 443 | 192.168.2.5 | 142.250.186.110 |
| Oct 1, 2024 09:00:38.716120005 CEST | 443 | 49759 | 142.250.186.110 | 192.168.2.5 |
| Oct 1, 2024 09:00:51.286542892 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:51.286617994 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:51.286705971 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:51.287209988 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:51.287245035 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.070998907 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.071157932 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.075431108 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.075459957 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.075702906 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.084405899 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.131413937 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.405895948 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.405922890 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.405976057 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.406004906 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.406058073 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.406092882 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.406119108 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.407350063 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.407418013 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.407440901 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.407474995 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.407502890 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.408473969 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.408544064 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.426121950 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.426177025 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:00:52.426206112 CEST | 49760 | 443 | 192.168.2.5 | 20.114.59.183 |
| Oct 1, 2024 09:00:52.426220894 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.5 |
| Oct 1, 2024 09:01:00.539063931 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:01:00.539180994 CEST | 443 | 49762 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:01:00.539284945 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:01:00.539521933 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:01:00.539556980 CEST | 443 | 49762 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:01:01.187791109 CEST | 443 | 49762 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:01:01.188483953 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:01:01.188520908 CEST | 443 | 49762 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:01:01.188882113 CEST | 443 | 49762 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:01:01.189306021 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:01:01.189382076 CEST | 443 | 49762 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:01:01.240953922 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:01:07.908778906 CEST | 49764 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:07.908821106 CEST | 443 | 49764 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:07.908902884 CEST | 49764 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:07.909171104 CEST | 49764 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:07.909188032 CEST | 443 | 49764 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:08.540930033 CEST | 443 | 49764 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:08.541316986 CEST | 49764 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:08.541380882 CEST | 443 | 49764 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:08.541802883 CEST | 443 | 49764 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:08.542124987 CEST | 49764 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:08.542200089 CEST | 443 | 49764 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:08.542310953 CEST | 49764 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:08.542346954 CEST | 49764 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:08.542360067 CEST | 443 | 49764 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:08.587960005 CEST | 49765 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:08.588016987 CEST | 443 | 49765 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:08.588145018 CEST | 49765 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:08.588485003 CEST | 49765 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:08.588500023 CEST | 443 | 49765 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:08.840400934 CEST | 443 | 49764 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:08.840673923 CEST | 443 | 49764 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:08.840749025 CEST | 49764 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:08.840980053 CEST | 49764 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:08.841017008 CEST | 443 | 49764 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:09.218574047 CEST | 443 | 49765 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:09.218894005 CEST | 49765 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:09.218914032 CEST | 443 | 49765 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:09.219288111 CEST | 443 | 49765 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:09.219793081 CEST | 49765 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:09.219877005 CEST | 443 | 49765 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:09.220010042 CEST | 49765 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:09.220027924 CEST | 49765 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:09.220038891 CEST | 443 | 49765 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:09.434302092 CEST | 443 | 49765 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:09.434425116 CEST | 443 | 49765 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:09.434499025 CEST | 49765 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:09.435066938 CEST | 49765 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:09.435091019 CEST | 443 | 49765 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:11.112323046 CEST | 443 | 49762 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:01:11.112397909 CEST | 443 | 49762 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:01:11.112592936 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:01:24.633595943 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.100 |
| Oct 1, 2024 09:01:24.633666039 CEST | 443 | 49762 | 142.250.185.100 | 192.168.2.5 |
| Oct 1, 2024 09:01:38.104806900 CEST | 49768 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:38.104871035 CEST | 443 | 49768 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:38.104990005 CEST | 49768 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:38.105232000 CEST | 49768 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:38.105248928 CEST | 443 | 49768 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:38.752257109 CEST | 443 | 49768 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:38.752562046 CEST | 49768 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:38.752582073 CEST | 443 | 49768 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:38.753853083 CEST | 443 | 49768 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:38.754170895 CEST | 49768 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:38.754339933 CEST | 443 | 49768 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:38.754342079 CEST | 49768 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:38.754379034 CEST | 49768 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:38.754462004 CEST | 443 | 49768 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:38.803987980 CEST | 49768 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:39.051987886 CEST | 443 | 49768 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:39.052495956 CEST | 443 | 49768 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:39.052604914 CEST | 49768 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:39.052836895 CEST | 49768 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:39.052866936 CEST | 443 | 49768 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:39.136440992 CEST | 49769 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:39.136486053 CEST | 443 | 49769 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:39.136626959 CEST | 49769 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:39.137120008 CEST | 49769 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:39.137130976 CEST | 443 | 49769 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:39.809524059 CEST | 443 | 49769 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:39.832849026 CEST | 49769 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:39.832892895 CEST | 443 | 49769 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:39.834391117 CEST | 443 | 49769 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:39.841762066 CEST | 49769 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:39.841949940 CEST | 49769 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:39.841955900 CEST | 443 | 49769 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:39.841969013 CEST | 49769 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:39.842008114 CEST | 443 | 49769 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:39.883167028 CEST | 49769 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:40.113981009 CEST | 443 | 49769 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:40.114685059 CEST | 443 | 49769 | 172.217.16.142 | 192.168.2.5 |
| Oct 1, 2024 09:01:40.114757061 CEST | 49769 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:40.115008116 CEST | 49769 | 443 | 192.168.2.5 | 172.217.16.142 |
| Oct 1, 2024 09:01:40.115029097 CEST | 443 | 49769 | 172.217.16.142 | 192.168.2.5 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 08:59:56.037740946 CEST | 53 | 59843 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.046153069 CEST | 62311 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 08:59:56.046726942 CEST | 51067 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 08:59:56.052706957 CEST | 53 | 62311 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.053276062 CEST | 53 | 51067 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 08:59:56.054043055 CEST | 53 | 61885 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.174525976 CEST | 59111 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 08:59:57.174961090 CEST | 55983 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 08:59:57.181317091 CEST | 53 | 59111 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.182132959 CEST | 53 | 55983 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 08:59:57.226317883 CEST | 53 | 52561 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:00.479229927 CEST | 64182 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 09:00:00.479378939 CEST | 51636 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 09:00:00.486032009 CEST | 53 | 64182 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:00.487680912 CEST | 53 | 51636 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:00.562933922 CEST | 53 | 61656 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:02.773972988 CEST | 53 | 54475 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:05.256084919 CEST | 53664 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 09:00:05.256449938 CEST | 65058 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 09:00:05.262600899 CEST | 53 | 53664 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:05.263534069 CEST | 53 | 65058 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.686295033 CEST | 55867 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 09:00:06.688724995 CEST | 60163 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 09:00:06.693706989 CEST | 53 | 55867 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:06.695404053 CEST | 53 | 60163 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:14.323210001 CEST | 53 | 53688 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:33.073771000 CEST | 53 | 60382 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:55.735680103 CEST | 53 | 50673 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:00:55.918127060 CEST | 53 | 52541 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:01:07.426738024 CEST | 53 | 61648 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:01:07.901170969 CEST | 49673 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 09:01:07.901571035 CEST | 60492 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 09:01:07.907818079 CEST | 53 | 49673 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:01:07.908380032 CEST | 53 | 60492 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 09:01:24.640881062 CEST | 53 | 60915 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 08:59:56.046153069 CEST | 192.168.2.5 | 1.1.1.1 | 0x331 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 08:59:56.046726942 CEST | 192.168.2.5 | 1.1.1.1 | 0x86b3 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 08:59:57.174525976 CEST | 192.168.2.5 | 1.1.1.1 | 0xba5c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 08:59:57.174961090 CEST | 192.168.2.5 | 1.1.1.1 | 0x456 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 09:00:00.479229927 CEST | 192.168.2.5 | 1.1.1.1 | 0x60d1 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 09:00:00.479378939 CEST | 192.168.2.5 | 1.1.1.1 | 0x702e | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 09:00:05.256084919 CEST | 192.168.2.5 | 1.1.1.1 | 0xf10b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 09:00:05.256449938 CEST | 192.168.2.5 | 1.1.1.1 | 0x3fc1 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 09:00:06.686295033 CEST | 192.168.2.5 | 1.1.1.1 | 0xa65a | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 09:00:06.688724995 CEST | 192.168.2.5 | 1.1.1.1 | 0xdc2 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 09:01:07.901170969 CEST | 192.168.2.5 | 1.1.1.1 | 0xac52 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 09:01:07.901571035 CEST | 192.168.2.5 | 1.1.1.1 | 0xb71e | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 08:59:56.052706957 CEST | 1.1.1.1 | 192.168.2.5 | 0x331 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:56.053276062 CEST | 1.1.1.1 | 192.168.2.5 | 0x86b3 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 216.58.212.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.181317091 CEST | 1.1.1.1 | 192.168.2.5 | 0xba5c | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.182132959 CEST | 1.1.1.1 | 192.168.2.5 | 0x456 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 08:59:57.182132959 CEST | 1.1.1.1 | 192.168.2.5 | 0x456 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 09:00:00.486032009 CEST | 1.1.1.1 | 192.168.2.5 | 0x60d1 | No error (0) | 142.250.185.100 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 09:00:00.487680912 CEST | 1.1.1.1 | 192.168.2.5 | 0x702e | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 09:00:05.262600899 CEST | 1.1.1.1 | 192.168.2.5 | 0xf10b | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 09:00:05.262600899 CEST | 1.1.1.1 | 192.168.2.5 | 0xf10b | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 09:00:05.263534069 CEST | 1.1.1.1 | 192.168.2.5 | 0x3fc1 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 09:00:06.693706989 CEST | 1.1.1.1 | 192.168.2.5 | 0xa65a | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 09:01:07.907818079 CEST | 1.1.1.1 | 192.168.2.5 | 0xac52 | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49706 | 142.250.185.110 | 443 | 1560 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 06:59:56 UTC | 859 | OUT | |
| 2024-10-01 06:59:57 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49710 | 142.250.185.206 | 443 | 1560 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 06:59:57 UTC | 877 | OUT | |
| 2024-10-01 06:59:58 UTC | 2634 | IN |