Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1523260 |
| MD5: | 873bd04e24ffd5ff03c7cbcb0390619b |
| SHA1: | 3d72d99e3bd8ef83e3d156e08f4d66f83053064e |
| SHA256: | 02a9704a3a661c5c01658ecba3156cf65924af152948a3006f0c4b7b37024913 |
| Tags: | exeuser-Bitsight |
| Infos: | |
 | |
Detection
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
file.exe (PID: 3372 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 873BD04E24FFD5FF03C7CBCB0390619B) 
chrome.exe (PID: 6056 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ap p="https:/ /youtube.c om/account ?=https:// accounts.g oogle.com/ v3/signin/ challenge/ pwd" --sta rt-fullscr een --no-f irst-run - -disable-s ession-cra shed-bubbl e --disabl e-features =CrashReco very MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 5720 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2352 --fi eld-trial- handle=198 8,i,267382 6556908286 864,116843 7721574150 3377,26214 4 --disabl e-features =CrashReco very /pref etch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7844 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=56 72 --field -trial-han dle=1988,i ,267382655 6908286864 ,116843772 1574150337 7,262144 - -disable-f eatures=Cr ashRecover y /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7852 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5688 --f ield-trial -handle=19 88,i,26738 2655690828 6864,11684 3772157415 03377,2621 44 --disab le-feature s=CrashRec overy /pre fetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0088DBBE | |
| Source: | Code function: | 0_2_0085C2A2 | |
| Source: | Code function: | 0_2_008968EE | |
| Source: | Code function: | 0_2_0089698F | |
| Source: | Code function: | 0_2_0088D076 | |
| Source: | Code function: | 0_2_0088D3A9 | |
| Source: | Code function: | 0_2_00899642 | |
| Source: | Code function: | 0_2_0089979D | |
| Source: | Code function: | 0_2_00899B2B | |
| Source: | Code function: | 0_2_00895C97 | |
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_0089CE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0089EAFF | |
| Source: | Code function: | 0_2_0089ED6A | |
| Source: | Code function: | 0_2_0089EAFF | |
| Source: | Code function: | 0_2_0088AA57 | |
| Source: | Code function: | 0_2_008B9576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_88a3b7c2-2 | |
| Source: | String found in binary or memory: | memstr_ba604b59-c | |
| Source: | String found in binary or memory: | memstr_9c78b84a-9 | |
| Source: | String found in binary or memory: | memstr_6648308f-0 | |
| Source: | Code function: | 0_2_0088D5EB | |
| Source: | Code function: | 0_2_00881201 | |
| Source: | Code function: | 0_2_0088E8F6 | |
| Source: | Code function: | 0_2_00892046 | |
| Source: | Code function: | 0_2_00828060 | |
| Source: | Code function: | 0_2_00888298 | |
| Source: | Code function: | 0_2_0085E4FF | |
| Source: | Code function: | 0_2_0085676B | |
| Source: | Code function: | 0_2_008B4873 | |
| Source: | Code function: | 0_2_0084CAA0 | |
| Source: | Code function: | 0_2_0082CAF0 | |
| Source: | Code function: | 0_2_0083CC39 | |
| Source: | Code function: | 0_2_00856DD9 | |
| Source: | Code function: | 0_2_008291C0 | |
| Source: | Code function: | 0_2_0083B119 | |
| Source: | Code function: | 0_2_00841394 | |
| Source: | Code function: | 0_2_00841706 | |
| Source: | Code function: | 0_2_0084781B | |
| Source: | Code function: | 0_2_008419B0 | |
| Source: | Code function: | 0_2_00827920 | |
| Source: | Code function: | 0_2_0083997D | |
| Source: | Code function: | 0_2_00847A4A | |
| Source: | Code function: | 0_2_00847CA7 | |
| Source: | Code function: | 0_2_00841C77 | |
| Source: | Code function: | 0_2_00859EEE | |
| Source: | Code function: | 0_2_008ABE44 | |
| Source: | Code function: | 0_2_00841F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_008937B5 | |
| Source: | Code function: | 0_2_008810BF | |
| Source: | Code function: | 0_2_008816C3 | |
| Source: | Code function: | 0_2_008951CD | |
| Source: | Code function: | 0_2_0088D4DC | |
| Source: | Code function: | 0_2_0089648E | |
| Source: | Code function: | 0_2_008242A2 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_008242DE | |
| Source: | Code function: | 0_2_00840A89 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_0083F98E | |
| Source: | Code function: | 0_2_008B1C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-96711 | ||
| Source: | API coverage: | ||
| Source: | Code function: | 0_2_0088DBBE | |
| Source: | Code function: | 0_2_0085C2A2 | |
| Source: | Code function: | 0_2_008968EE | |
| Source: | Code function: | 0_2_0089698F | |
| Source: | Code function: | 0_2_0088D076 | |
| Source: | Code function: | 0_2_0088D3A9 | |
| Source: | Code function: | 0_2_00899642 | |
| Source: | Code function: | 0_2_0089979D | |
| Source: | Code function: | 0_2_00899B2B | |
| Source: | Code function: | 0_2_00895C97 | |
| Source: | Code function: | 0_2_008242DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_0089EAA2 | |
| Source: | Code function: | 0_2_00852622 | |
| Source: | Code function: | 0_2_008242DE | |
| Source: | Code function: | 0_2_00844CE8 | |
| Source: | Code function: | 0_2_00880B62 | |
| Source: | Code function: | 0_2_00852622 | |
| Source: | Code function: | 0_2_0084083F | |
| Source: | Code function: | 0_2_008409D5 | |
| Source: | Code function: | 0_2_00840C21 | |
| Source: | Code function: | 0_2_00881201 | |
| Source: | Code function: | 0_2_00862BA5 | |
| Source: | Code function: | 0_2_0088B226 | |
| Source: | Code function: | 0_2_008A22DA | |
| Source: | Code function: | 0_2_00880B62 | |
| Source: | Code function: | 0_2_00881663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00840698 | |
| Source: | Code function: | 0_2_00898195 | |
| Source: | Code function: | 0_2_0087D27A | |
| Source: | Code function: | 0_2_0085B952 | |
| Source: | Code function: | 0_2_008242DE | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_008A1204 | |
| Source: | Code function: | 0_2_008A1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 15 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 1 Masquerading | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Virtualization/Sandbox Evasion | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 21 Access Token Manipulation | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 2 Process Injection | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 13% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 1% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.185.238 | true | false |
| unknown |
| www3.l.google.com | 142.250.186.174 | true | false |
| unknown |
| play.google.com | 142.250.185.78 | true | false |
| unknown |
| www.google.com | 142.250.184.196 | true | false |
| unknown |
| youtube.com | 142.250.186.174 | true | false |
| unknown |
| accounts.youtube.com | unknown | unknown | false |
| unknown |
| www.youtube.com | unknown | unknown | false |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.184.196 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.78 | play.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.174 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.238 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.174 | unknown | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.5 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1523260 |
| Start date and time: | 2024-10-01 11:22:07 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 50s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal64.evad.winEXE@31/36@12/7 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 216.58.212.131, 142.250.186.78, 74.125.71.84, 34.104.35.123, 216.58.206.74, 142.250.181.234, 172.217.18.10, 142.250.74.202, 142.250.185.234, 142.250.186.138, 142.250.186.74, 142.250.186.170, 142.250.186.42, 172.217.18.106, 142.250.184.234, 172.217.23.106, 172.217.16.202, 216.58.206.42, 142.250.184.202, 142.250.186.106, 172.217.16.131, 142.250.186.131, 142.250.185.202, 142.250.185.138, 172.217.16.138, 142.250.185.106, 142.250.185.170, 142.250.185.74, 216.58.212.138, 199.232.210.172, 192.229.221.95, 142.250.186.163, 108.177.15.84, 142.250.185.206
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Anonymous Proxy | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Anonymous Proxy | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.9776390429418176 |
| Encrypted: | false |
| SSDEEP: | 48:8SdATkCjdHiwidAKZdA19ehwiZUklqeh2y+3:8x7jYeBy |
| MD5: | 940BCC7AF6DEFF902039966DF8BE043B |
| SHA1: | CAED3948ECCA93D28B98B7208F4C9ACFD413F0CD |
| SHA-256: | 342D7CACADCE0F1F06109C3353653515FB77597A3516ACA721C80BE3AC74B358 |
| SHA-512: | 02F26B29ECD4D8A7B98AE841F0104FE51C4B5DD86963E8F9D484FCE8477F17F0906AD1331F1BBC9CB43F43467B3B2A31ED96F7ADDD3788AB339054AFA0E97D34 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.993335576468466 |
| Encrypted: | false |
| SSDEEP: | 48:8udATkCjdHiwidAKZdA1weh/iZUkAQkqehxy+2:8V7jY89QEy |
| MD5: | B6B242D6706A331C0A3F3604376581B2 |
| SHA1: | B7CA618F1F7FD73B17B25E1D310D3FE2D50FEA3D |
| SHA-256: | 736817128D349D60FE358C1E326DB191B2A2862B03D01E88C043EF7FFA8B584E |
| SHA-512: | BA73B2C988EFB79A3E1FC1810663FCDAB1F389AD001F56D53FB1FA5A2CC76A9EF4C78F55731CBC6D4CB02AC0798F90B7F2CB6FE3B0B992E7E431609CCD197752 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2693 |
| Entropy (8bit): | 4.003903412362401 |
| Encrypted: | false |
| SSDEEP: | 48:8xxdATkCjsHiwidAKZdA14tseh7sFiZUkmgqeh7sny+BX:8xs7j1Undy |
| MD5: | 1DF6706F951B1D21487327BDC84697D9 |
| SHA1: | 246D5F1C82E0AA519BF1B2AB5F9566C77D81A295 |
| SHA-256: | BDE260F104976F19250E4F437BD7CA9A27951C5E44BCB3368A83110EC3416064 |
| SHA-512: | 10487F191CEAB7248DA42D47F8377DCEFEBCC9C0949F443A5DB8B2911EE8FFDB79BC994ECB6D763AFC2FA32BC7607DC22CDCBE20C810E8C8F6FADDE4335D6D25 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.99249522292948 |
| Encrypted: | false |
| SSDEEP: | 48:88dATkCjdHiwidAKZdA1vehDiZUkwqehFy+R:8/7jYHvy |
| MD5: | ACD73920445A424CB6643C673D3054D9 |
| SHA1: | 1BC730139D6152DA291728007284186EE111D62D |
| SHA-256: | C338419B79E7515C837BC3330D90F26F0FC11E17151B98857D672AEADC1047A5 |
| SHA-512: | 1B287429C523654EB4C0EAC8659D54996AD5E92FE680DF5D00B6071BFB0F31957503D54F87AB09D4DEBD51354745791970F17DD73A487771A84AE3FF41029B19 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9810893587496285 |
| Encrypted: | false |
| SSDEEP: | 48:82dATkCjdHiwidAKZdA1hehBiZUk1W1qehTy+C:8d7jY39zy |
| MD5: | 32A0EC6E854F47F883D50CA8090D5813 |
| SHA1: | B99E2EA61C2C21D11D0600905B472EC46057FBFD |
| SHA-256: | 8AD133ECF6DCC553E88953A8C783AC252E322F3E45F5F47F81776D1325942516 |
| SHA-512: | 5D3BFC7F7FECDD299055B300BB08EF5CDC7328494DA7C0443034B98B2B410CFF67F8A7FC5EFDACE3A2333EE17805571DCFF3AB231A6C6972768048E4CB3B4B7E |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2683 |
| Entropy (8bit): | 3.9912032426789814 |
| Encrypted: | false |
| SSDEEP: | 48:8qdATkCjdHiwidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbdy+yT+:8p7jY/T/TbxWOvTbdy7T |
| MD5: | 6488B50C55BA86A6DF572013FA538983 |
| SHA1: | 3D8220D2AA452201C06153BEAFB4921E4BC81205 |
| SHA-256: | 50A9FFE4B07A6E3979E9B5F80E4003CC2CF01DD21DD58CD971A0718411387B2B |
| SHA-512: | 9341D8757AD65C0DBA75281DFD6A056BB3F634B9A3AD74E02E08F9A857775DA12652EA86A25FDDB61B889A37BEA00F2D6CD092F28C341A70AC1314C04531F8DA |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3471 |
| Entropy (8bit): | 5.5174491302699495 |
| Encrypted: | false |
| SSDEEP: | 96:ojAmjTJ/fJgpIcB7Fd2tilGBEMO/A6VxV08w:vUTJpgDJXM0ApJ |
| MD5: | 2D999C87DD54C7FE6400D267C33FBB23 |
| SHA1: | 414C3A329C2760325EDBACBD7A221D7F8DBFEEE8 |
| SHA-256: | 76D55A1AFC1D39CB04D60EB04E45A538A0E75EE2871561C84CC89B1C13596BCC |
| SHA-512: | 72D923BB71DD147139962FF8E2BD0E336E0F6409C212AC2F25387D0F3B4FC9365F5A6D40E2980BB1065534888362C97D6B7663E362D29166B5915D2A9DA7D238 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.253939888205379 |
| Encrypted: | false |
| SSDEEP: | 48:o7BNJfeFb8L3A6FHqIy5Z+d70OCzSfvi/3fM/r8ZQzRrw:oFuILhFHrVCz0vLZz9w |
| MD5: | 10FF6F99E3228E96AFD6E2C30EF97C0A |
| SHA1: | 4AE3DCB8D1F5A0C302D5BAD9DFF5050A7A5E8130 |
| SHA-256: | 95E5546E1C7F311D07BB5050CC456A973E43BCC4777BA6014757376016537679 |
| SHA-512: | 116C0B1CAC98A27044100005545AB66BE5F4801D75DC259093A9F145B3A4ACD8DC1C360AF525F6DC8421CD54B675A78023D2ED8B57F5946A3969543758C673C9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22827 |
| Entropy (8bit): | 5.420322672717721 |
| Encrypted: | false |
| SSDEEP: | 384:/jqdWXWfyA20UUjDE8BSUxDJs16KHvSN34kaHaN+587SaXD2mLR0H:/jqdWXAUUjDE84Wi6KPSKjHaN+58+0J2 |
| MD5: | 2B29741A316862EE788996DD29116DD5 |
| SHA1: | 9D5551916D4452E977C39B8D69CF88DF2AAA462B |
| SHA-256: | 62955C853976B722EFBB4C116A10DB3FF54580EDD7495D280177550B8F4289AB |
| SHA-512: | 6E37C3258F07F29909763728DADE0CD40A3602D55D9099F78B37756926FCF2A50008B82876B518FEAF3E56617F0F7D1D37A73C346A99A58E6AD8BCD6689E9B15 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5049 |
| Entropy (8bit): | 5.317800104741948 |
| Encrypted: | false |
| SSDEEP: | 96:oHX9gPiPrfnHhsB0TR6kg1oDPJzLmM18Vh1z2fEZ54TZtnqj6w:EtEAr6BmPZtOeEvW/ncP |
| MD5: | CE53EF566B68CCF2D62FA044CFB0D138 |
| SHA1: | F48EC60289F2B55E8B388601206888F8295B1EB1 |
| SHA-256: | E6CC5114D92811D5DE0663266D4B63F367834AFA0FC3BAFA54F707038C59D010 |
| SHA-512: | 20B434881DE971E263669E6096C01665D4D35B0FBFF47D312A4A442645EE962A8CE6AD7E68246D4EE9691BD30D9B1DDCF7059226492E1B58CD3191B63B001E4D |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 603951 |
| Entropy (8bit): | 5.789949489744101 |
| Encrypted: | false |
| SSDEEP: | 3072:x0pApkygA62bwwdnO2YflNYhFGOizdGj008PpVVM96C5bMEPQUhts6FV8eKqtVAT:xlgNmwwdnOsF98oNGuQRAYqXsI1+ |
| MD5: | 036BC6CEC1912EAA63C716C2A7494AFC |
| SHA1: | C32891F55B0D7A86DCE1BDBB7B84DB21C2A09F4F |
| SHA-256: | 1A6181C3DFAEE5919CE57152DCFFCDC4B151C5FB2969CFD62168C1711FF202CF |
| SHA-512: | 0AAA2285D109114921B5FD8A15F9A3D1F218AF8C61054B3925965E6753F8A49B45798326EA986C4A6B6180B6C36292A4652E2BA730C7505684DAAA4B5C314675 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGsNipZrCRRMFQh1-tVmHSsIDzQTA/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.316515499943097 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DduJqrxsNL90YIzFK/Hb5eNhz1uktdDuvKKKGbLZ99GbSSF/ZR8OkdnprGJ:o7DQJopFN+ASCKKGbF99GbSS3RY7rw |
| MD5: | D97AB4594FC610665FF2763A650EE6A8 |
| SHA1: | 5C7459CA838D27BE45745571D8D96D156F4B9F8D |
| SHA-256: | 767D778369623FD8F5FB98D3BCC3130D05D02CBE0B9B88DD226F43281B14E9AF |
| SHA-512: | CE4941B41C3A8CC983C1BBCC87EF682823CB9DB24EA7A570E35BBF832046340D433F7D47211384B61FA38F3527CC35C195A6068CCB24B48E1F492C5B4D4192A1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.3872171131917925 |
| Encrypted: | false |
| SSDEEP: | 192:FK/pAzN7GZ068Hqhqu6DQaVapzYjgKItwdiwUsYRTi1j1t9bRl9:FqI7GZ04dRYjghtgisYYbt9ll9 |
| MD5: | AB70454DE18E1CE16E61EAC290FC304D |
| SHA1: | 68532B5E8B262D7E14B8F4507AA69A61146B3C18 |
| SHA-256: | B32D746867CC4FA21FD39437502F401D952D0A3E8DC708DFB7D58B85F256C0F1 |
| SHA-512: | A123C517380BEF0B47F23A5A6E1D16650FE39D9C701F9FA5ADD79294973C118E8EA3A7BA32CB63C3DFC0CE0F843FB86BFFCAA2AAE987629E7DFF84F176DEBB98 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.3750044852869046 |
| Encrypted: | false |
| SSDEEP: | 48:o7zfN/cD498xdg+Y5jNQ8js6npwk0OmNAEZbpMzR4EQBcW5QcHj9KWfGAeFKRrw:oCD9dA5jOEGh+EFqR4rhqUhzff9w |
| MD5: | 39693D34EE3D1829DBB1627C4FC6687B |
| SHA1: | A03303C2F027F3749B48D5134D1F8FB3E495C6E9 |
| SHA-256: | 03B0C1B4E402E0BCF75D530DD9085B25357EEFD09E238453DE1F3A042542C076 |
| SHA-512: | AC0749EDC33DA0EC0E40470388DD797B6528AD08B8FAC1C2AC42F85198131052BA1B533E90409D35DA237607E8B07D591FA6BA580B6A90B0D0AB2282A01F7585 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32499 |
| Entropy (8bit): | 5.361345284201954 |
| Encrypted: | false |
| SSDEEP: | 768:mLX1O+aL6fgyIiREM4RKmh90toLoTswtF3ATcbDR6kIsnJd9DPyMv/FI:U2M4oltoLoTswtFoc/tIsnXFLI |
| MD5: | D5C3FB8EAE24AB7E40009338B5078496 |
| SHA1: | 5638BF5986A6445A88CD79A9B690B744B126BEC2 |
| SHA-256: | 597C14D360D690BCFDC2B8D315E6BB8879AEF33DE6C30D274743079BDB63C6B0 |
| SHA-512: | 6AE434850D473BEF15AA694AB4862596982CDDA6BD3991991D3ADD8F4A5F61DFBF8756D0DA98B72EF083909D68CF7B6B148A6488E9381F92FBF15CCB20176A0E |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.280977407061266 |
| Encrypted: | false |
| SSDEEP: | 48:o7YNJvl3WlENrpB3stYCIgMxILNH/wf7DVTBpdQrw:oApB8iDwYlGw |
| MD5: | 4FB66582D37D04933F00E49C2FBA34D4 |
| SHA1: | 3DB09C53BBEB1EEB045A001356E498D8EF30915D |
| SHA-256: | A97DAC01ABFE3EB75C7C97D504E21BDDDADDB6EBE0B56B6A9A10CD3700CAB41B |
| SHA-512: | 2AEB3A6CFFBF6EFA626EBDC9E11ACBAC04BFE986F98FBC050B2501898B289C67D392ED195D16ACC9565EF8784401ADA1E88188CDE3A7AB12D98BB5ED7D8A5711 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4070 |
| Entropy (8bit): | 5.362700670482359 |
| Encrypted: | false |
| SSDEEP: | 96:GUpT+TmXtdW1qsHFcn7t7CnyWYvNTcLaQOw:lpT+qXW1PFcn7tGnyWY1TGb |
| MD5: | ED368A20CB303C0E7C6A3E6E43C2E14F |
| SHA1: | 429A5C538B45221F80405163D1F87912DD73C05A |
| SHA-256: | 93BA77AD4B11E0A70C0D36576F0DF24E27F50001EA02BAA6D357E034532D97F2 |
| SHA-512: | DE74BBADE910475DD245FFEFD4E1FD10137DE710B1C920D33BA52554911496E1339EF3C1F6D9D315CBC98A60ABE5687A3E7D8BEE483708E18D25722E794BDBE9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 697429 |
| Entropy (8bit): | 5.593310312179182 |
| Encrypted: | false |
| SSDEEP: | 6144:TYNlxfbDTYDhzCTNoygVWyJb5eGpbL2Mp15gI8seqfh53p+rrvV7i:T25bDTYB+qeGB+Nu |
| MD5: | 92F0F5E28355D863ACB77313F1E675DE |
| SHA1: | 8AD6F9B535D5B8952A4ADCCC57E4A4E0723F1E8D |
| SHA-256: | F903AE346609A2872554A3D8FFBDB1836CB5C8B7AAAED4C3F8296B887E03D833 |
| SHA-512: | 0C81A6CD850C6ACDBE9CCCBA00BBA34CDE1E09E8572814AE8E55DBED3C2B56F0B020359841F8217843B3403847DF46FA1C82229684F762A73C8110CE45898DAF |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.5797761241913 |
| TrID: |
|
| File name: | file.exe |
| File size: | 917'504 bytes |
| MD5: | 873bd04e24ffd5ff03c7cbcb0390619b |
| SHA1: | 3d72d99e3bd8ef83e3d156e08f4d66f83053064e |
| SHA256: | 02a9704a3a661c5c01658ecba3156cf65924af152948a3006f0c4b7b37024913 |
| SHA512: | 8c632c03c1600a52d8a5e12d87094644cd7672915e43e1438419cd2177cddf38e452f3a36c2f20c044a5f1b146a1e7605d1f2a7c29dcdceb4ad9b1c2bee9531e |
| SSDEEP: | 12288:gqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagTy:gqDEvCTbMWu7rQYlBQcBiT6rprG8a4y |
| TLSH: | D9159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FBBCBC [Tue Oct 1 09:11:24 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007FD0E47B0DC3h |
| jmp 00007FD0E47B06CFh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FD0E47B08ADh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FD0E47B087Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007FD0E47B346Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007FD0E47B34B8h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007FD0E47B34A1h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x95ac | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x95ac | 0x9600 | 8b6df623cea438bbea066d1ca6a31242 | False | 0.2860416666666667 | data | 5.1643975005276275 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0x874 | data | 1.005083179297597 | ||
| RT_GROUP_ICON | 0xdd02c | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd0a4 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd0b8 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd0cc | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd0e0 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd1bc | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 11:22:54.511356115 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 11:22:54.511357069 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 11:22:54.605093956 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 11:22:58.632746935 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:58.632796049 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:58.632852077 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:58.634234905 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:58.634249926 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.270406008 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.270934105 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:59.270952940 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.271382093 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.271454096 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:59.272434950 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.272486925 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:59.275137901 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:59.275223970 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.276036024 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:59.276042938 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.320480108 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:59.554029942 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.554801941 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.554856062 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:59.555243969 CEST | 49706 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:22:59.555262089 CEST | 443 | 49706 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.565962076 CEST | 49712 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:22:59.570744991 CEST | 53 | 49712 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.570802927 CEST | 49712 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:22:59.570867062 CEST | 49712 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:22:59.570878983 CEST | 49712 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:22:59.570967913 CEST | 49712 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:22:59.571228027 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:22:59.571288109 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.571352959 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:22:59.571584940 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:22:59.571614981 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.575694084 CEST | 53 | 49712 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.575707912 CEST | 53 | 49712 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.618994951 CEST | 53 | 49712 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.943224907 CEST | 53 | 49712 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.943284988 CEST | 49712 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:23:00.200097084 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.200392962 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:23:00.200417042 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.200872898 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.200944901 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:23:00.201602936 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.201659918 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:23:00.202701092 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:23:00.202771902 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.202902079 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:23:00.202919006 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.246510029 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:23:00.523499966 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.523519039 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.523581028 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:23:00.523612022 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.524183989 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.525753021 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:23:00.525779009 CEST | 443 | 49713 | 142.250.185.238 | 192.168.2.5 |
| Oct 1, 2024 11:23:00.525801897 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:23:00.525829077 CEST | 49713 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 1, 2024 11:23:02.864995003 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:02.865032911 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:02.865096092 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:02.865314007 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:02.865324974 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:03.617789030 CEST | 49722 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:03.617882013 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:03.617971897 CEST | 49722 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:03.619685888 CEST | 49722 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:03.619739056 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:03.620018959 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:03.620222092 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:03.620234013 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:03.621140003 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:03.621191025 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:03.622162104 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:03.622216940 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:03.668139935 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:03.668145895 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:03.714348078 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:04.121625900 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 11:23:04.121653080 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 11:23:04.218061924 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 11:23:04.279167891 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:04.279273033 CEST | 49722 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:04.283531904 CEST | 49722 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:04.283562899 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:04.283987045 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:04.327471972 CEST | 49722 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:04.328051090 CEST | 49722 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:04.375442982 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:05.498395920 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:05.498547077 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:05.498634100 CEST | 49722 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:05.498724937 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:05.498759985 CEST | 49722 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:05.498759985 CEST | 49722 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:05.498781919 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:05.498799086 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:05.547971010 CEST | 49729 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:05.548033953 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:05.548271894 CEST | 49729 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:05.548538923 CEST | 49729 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:05.548573017 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:05.865281105 CEST | 443 | 49705 | 23.1.237.91 | 192.168.2.5 |
| Oct 1, 2024 11:23:05.866132975 CEST | 49705 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 1, 2024 11:23:06.190824032 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:06.190907001 CEST | 49729 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:06.192373991 CEST | 49729 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:06.192400932 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:06.192747116 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:06.193953991 CEST | 49729 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:06.239398956 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:06.463690042 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:06.463835955 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:06.463912010 CEST | 49729 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:06.583746910 CEST | 49729 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:06.583794117 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:06.583822966 CEST | 49729 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 1, 2024 11:23:06.583838940 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.110574007 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:08.110615969 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.110703945 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:08.111931086 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:08.111949921 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.770622015 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.771059036 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:08.771087885 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.771522999 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.771583080 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:08.772237062 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.772281885 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:08.773327112 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:08.773392916 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.773592949 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:08.773602009 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.824368954 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.088547945 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.088649988 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.088686943 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.088706017 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.088752985 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.088782072 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.094446898 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.094526052 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.094547033 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.100708961 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.100744009 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.100766897 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.100783110 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.100918055 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.106980085 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.107042074 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.113585949 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.113621950 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.113646030 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.113660097 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.113867998 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.161688089 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.161726952 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.161940098 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.162530899 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.162545919 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.179466963 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.179516077 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.179543972 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.179558039 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.179577112 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.179624081 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.179639101 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.179692030 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.188255072 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.188302040 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.188328981 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.188344002 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.189845085 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.189909935 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.189924955 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.189971924 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.195907116 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.195982933 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.196108103 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.202214956 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.203522921 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.203537941 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.208880901 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.209055901 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.209131956 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.209270954 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 1, 2024 11:23:09.209299088 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.226708889 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.226748943 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.226823092 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.227238894 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.227252007 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.796348095 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.796643019 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.796658039 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.797039032 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.797106981 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.797759056 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.797816992 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.798846960 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.798912048 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.799051046 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.839728117 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.839736938 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.876281023 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.876430988 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.876451015 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.876976013 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.877027988 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.877721071 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.877763987 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.878669977 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.878750086 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.878978968 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.888566971 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.920536995 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:09.920545101 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.966239929 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.329571962 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.329696894 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.329794884 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.330075979 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.330250025 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.330300093 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.330331087 CEST | 49739 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.330347061 CEST | 443 | 49739 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.330673933 CEST | 49740 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.330688000 CEST | 443 | 49740 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.331444025 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.331474066 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.331784964 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.332695007 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.332802057 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.333139896 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.333159924 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.333190918 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.333858013 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.333908081 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.960325956 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.960541010 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.960557938 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.960975885 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.961035013 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.961705923 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.961755037 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.961894035 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.961950064 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.962021112 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.962028027 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.962038994 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.980655909 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.980947971 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.980998039 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.981324911 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.981405973 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.981921911 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.981977940 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.982116938 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.982177019 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.982309103 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:10.982331038 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:10.982367992 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:11.007405043 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:11.013689995 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:11.027411938 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:11.028898001 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:11.153589964 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:11.153883934 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:11.153934002 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:11.155442953 CEST | 49744 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:11.155457973 CEST | 443 | 49744 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:11.178194046 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:11.178317070 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:11.178391933 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:11.179116964 CEST | 49745 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:11.179142952 CEST | 443 | 49745 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:11.789056063 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:11.835405111 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:12.077871084 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:12.077908039 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:12.077930927 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:12.077958107 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:12.077959061 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:12.077976942 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:12.077992916 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:12.078224897 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:12.078268051 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:12.084167957 CEST | 49718 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:23:12.084177017 CEST | 443 | 49718 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:23:14.578275919 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:14.578352928 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:14.578450918 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:14.579535007 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:14.579579115 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:15.398638964 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:15.398752928 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:15.400420904 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:15.400444031 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:15.400696039 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:15.448959112 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:15.929692030 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:15.975399017 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.199033022 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.199053049 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.199059963 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.199069977 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.199105024 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.199136019 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:16.199174881 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.199203014 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:16.199228048 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:16.199291945 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.199353933 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:16.199398994 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.199523926 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.201533079 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:16.918236971 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:16.918294907 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.918329954 CEST | 49752 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:16.918363094 CEST | 443 | 49752 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:17.093992949 CEST | 49759 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:17.094019890 CEST | 443 | 49759 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:17.094079971 CEST | 49759 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:17.094482899 CEST | 49759 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:17.094494104 CEST | 443 | 49759 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:17.734832048 CEST | 443 | 49759 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:17.739161015 CEST | 49759 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:17.739172935 CEST | 443 | 49759 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:17.739597082 CEST | 443 | 49759 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:17.754199028 CEST | 49759 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:17.754282951 CEST | 443 | 49759 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:17.754359961 CEST | 49759 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:17.754359961 CEST | 49759 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:17.754388094 CEST | 443 | 49759 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:17.795160055 CEST | 49759 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:18.046693087 CEST | 443 | 49759 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:18.046916962 CEST | 443 | 49759 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:18.047066927 CEST | 49759 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:18.049458981 CEST | 49759 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:18.049474955 CEST | 443 | 49759 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:39.265388012 CEST | 49760 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:39.265433073 CEST | 443 | 49760 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:39.265525103 CEST | 49760 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:39.265826941 CEST | 49760 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:39.265844107 CEST | 443 | 49760 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.140162945 CEST | 49761 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.140196085 CEST | 443 | 49761 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.140266895 CEST | 49761 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.140584946 CEST | 49761 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.140602112 CEST | 443 | 49761 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.610160112 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.610202074 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.610270977 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.624361038 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.624377966 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.775799990 CEST | 443 | 49760 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.776089907 CEST | 49760 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.776106119 CEST | 443 | 49760 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.776484013 CEST | 443 | 49760 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.776833057 CEST | 49760 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.776905060 CEST | 443 | 49760 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.777090073 CEST | 49760 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.777126074 CEST | 49760 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.777138948 CEST | 443 | 49760 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.785058022 CEST | 443 | 49761 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.785270929 CEST | 49761 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.785281897 CEST | 443 | 49761 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.785600901 CEST | 443 | 49761 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.785897970 CEST | 49761 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.785958052 CEST | 443 | 49761 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:40.786035061 CEST | 49761 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.786056042 CEST | 49761 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:40.786065102 CEST | 443 | 49761 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.055255890 CEST | 443 | 49760 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.056237936 CEST | 443 | 49760 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.056307077 CEST | 49760 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.056401968 CEST | 49760 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.056421041 CEST | 443 | 49760 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.062206030 CEST | 443 | 49761 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.062325001 CEST | 443 | 49761 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.062396049 CEST | 49761 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.062551975 CEST | 49761 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.062571049 CEST | 443 | 49761 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.426552057 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.426821947 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.426840067 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.427155972 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.427217007 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.427781105 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.427831888 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.427970886 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.428029060 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.428111076 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.428119898 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.428137064 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.468195915 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.468202114 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.626626968 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.626745939 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:41.626808882 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.627315044 CEST | 49762 | 443 | 192.168.2.5 | 142.250.185.78 |
| Oct 1, 2024 11:23:41.627335072 CEST | 443 | 49762 | 142.250.185.78 | 192.168.2.5 |
| Oct 1, 2024 11:23:53.266092062 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:53.266196012 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:53.266293049 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:53.266612053 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:53.266649008 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.079186916 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.079377890 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:54.082838058 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:54.082879066 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.083122015 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.095437050 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:54.139435053 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.423779011 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.423804045 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.423819065 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.423903942 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:54.423937082 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.423991919 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:54.424964905 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.425000906 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.425056934 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:54.425056934 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:54.425076962 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.425293922 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.425343990 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:54.428231955 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:54.428261042 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:23:54.428287029 CEST | 49763 | 443 | 192.168.2.5 | 4.175.87.197 |
| Oct 1, 2024 11:23:54.428301096 CEST | 443 | 49763 | 4.175.87.197 | 192.168.2.5 |
| Oct 1, 2024 11:24:02.937829971 CEST | 49765 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:24:02.937861919 CEST | 443 | 49765 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:24:02.937930107 CEST | 49765 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:24:02.945141077 CEST | 49765 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:24:02.945158005 CEST | 443 | 49765 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:24:03.599086046 CEST | 443 | 49765 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:24:03.599354029 CEST | 49765 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:24:03.599387884 CEST | 443 | 49765 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:24:03.600111008 CEST | 443 | 49765 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:24:03.600514889 CEST | 49765 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:24:03.600584984 CEST | 443 | 49765 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:24:03.652414083 CEST | 49765 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:24:10.309933901 CEST | 49767 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:10.309993982 CEST | 443 | 49767 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.310061932 CEST | 49767 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:10.310272932 CEST | 49767 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:10.310288906 CEST | 443 | 49767 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.423042059 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:10.423122883 CEST | 443 | 49768 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.423197031 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:10.423441887 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:10.423476934 CEST | 443 | 49768 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.977350950 CEST | 443 | 49767 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.977627993 CEST | 49767 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:10.977652073 CEST | 443 | 49767 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.977963924 CEST | 443 | 49767 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.978238106 CEST | 49767 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:10.978293896 CEST | 443 | 49767 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.978393078 CEST | 49767 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:10.978415012 CEST | 49767 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:10.978425980 CEST | 443 | 49767 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.054718971 CEST | 443 | 49768 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.054975033 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:11.055016041 CEST | 443 | 49768 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.055336952 CEST | 443 | 49768 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.055699110 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:11.055764914 CEST | 443 | 49768 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.055871964 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:11.055908918 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:11.055921078 CEST | 443 | 49768 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.280872107 CEST | 443 | 49767 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.281558037 CEST | 443 | 49767 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.281620979 CEST | 49767 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:11.281913042 CEST | 49767 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:11.281939030 CEST | 443 | 49767 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.353821993 CEST | 443 | 49768 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.354351997 CEST | 443 | 49768 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:11.354428053 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:11.354547977 CEST | 49768 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:11.354578972 CEST | 443 | 49768 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:13.502074003 CEST | 443 | 49765 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:24:13.502136946 CEST | 443 | 49765 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:24:13.502185106 CEST | 49765 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:24:26.293848991 CEST | 49765 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:24:26.293876886 CEST | 443 | 49765 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:24:40.455096006 CEST | 49770 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:40.455223083 CEST | 443 | 49770 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:40.455440044 CEST | 49770 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:40.455745935 CEST | 49770 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:40.455784082 CEST | 443 | 49770 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:41.118158102 CEST | 443 | 49770 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:41.118544102 CEST | 49770 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:41.118603945 CEST | 443 | 49770 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:41.119183064 CEST | 443 | 49770 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:41.119481087 CEST | 49770 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:41.119574070 CEST | 443 | 49770 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:41.119623899 CEST | 49770 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:41.119657993 CEST | 49770 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:41.119673014 CEST | 443 | 49770 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:41.424499035 CEST | 443 | 49770 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:41.424727917 CEST | 443 | 49770 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:41.424840927 CEST | 49770 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:41.426106930 CEST | 49770 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:41.426162958 CEST | 443 | 49770 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:43.690613031 CEST | 49771 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:43.690709114 CEST | 443 | 49771 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:43.690804958 CEST | 49771 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:43.691224098 CEST | 49771 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:43.691261053 CEST | 443 | 49771 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:44.402151108 CEST | 443 | 49771 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:44.402549028 CEST | 49771 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:44.402616978 CEST | 443 | 49771 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:44.402954102 CEST | 443 | 49771 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:44.403228998 CEST | 49771 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:44.403304100 CEST | 443 | 49771 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:44.403379917 CEST | 49771 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:44.403450012 CEST | 49771 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:44.403465033 CEST | 443 | 49771 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:44.700850010 CEST | 443 | 49771 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:44.701265097 CEST | 443 | 49771 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:24:44.701385975 CEST | 49771 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:44.701692104 CEST | 49771 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 1, 2024 11:24:44.701730967 CEST | 443 | 49771 | 142.250.185.174 | 192.168.2.5 |
| Oct 1, 2024 11:25:02.981754065 CEST | 49772 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:25:02.981786966 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:25:02.981868029 CEST | 49772 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:25:02.982146025 CEST | 49772 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:25:02.982160091 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:25:03.610897064 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:25:03.611195087 CEST | 49772 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:25:03.611208916 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:25:03.611546040 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:25:03.611860037 CEST | 49772 | 443 | 192.168.2.5 | 142.250.184.196 |
| Oct 1, 2024 11:25:03.611917973 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.5 |
| Oct 1, 2024 11:25:03.651891947 CEST | 49772 | 443 | 192.168.2.5 | 142.250.184.196 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 11:22:58.526650906 CEST | 53692 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:22:58.526797056 CEST | 58767 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:22:58.533720016 CEST | 53 | 53692 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:58.536048889 CEST | 53 | 58767 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:58.634090900 CEST | 53 | 63115 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:58.641319036 CEST | 53 | 51748 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.557899952 CEST | 50367 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:22:59.558051109 CEST | 59881 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:22:59.565417051 CEST | 53 | 50367 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.565598011 CEST | 53 | 59881 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:22:59.644629955 CEST | 53 | 57201 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:02.857537031 CEST | 64737 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:23:02.857656002 CEST | 56100 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:23:02.864120960 CEST | 53 | 56100 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:02.864350080 CEST | 53 | 64737 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:03.099848986 CEST | 53 | 58907 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:05.451714993 CEST | 53 | 65141 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.101871967 CEST | 63227 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:23:08.102051973 CEST | 57061 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:23:08.108783007 CEST | 53 | 63227 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:08.109519958 CEST | 53 | 57061 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.153630018 CEST | 53019 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:23:09.154174089 CEST | 51395 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:23:09.160825014 CEST | 53 | 51395 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:09.160862923 CEST | 53 | 53019 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:16.633513927 CEST | 53 | 63997 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:35.521640062 CEST | 53 | 54920 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:58.223577023 CEST | 53 | 49302 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:23:58.949251890 CEST | 53 | 54634 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.117672920 CEST | 53 | 49193 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.301954031 CEST | 54833 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:24:10.302242994 CEST | 64212 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 1, 2024 11:24:10.309210062 CEST | 53 | 54833 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:24:10.309499979 CEST | 53 | 64212 | 1.1.1.1 | 192.168.2.5 |
| Oct 1, 2024 11:24:26.421531916 CEST | 53 | 58829 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 11:22:58.526650906 CEST | 192.168.2.5 | 1.1.1.1 | 0x4df7 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 11:22:58.526797056 CEST | 192.168.2.5 | 1.1.1.1 | 0x8996 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 11:22:59.557899952 CEST | 192.168.2.5 | 1.1.1.1 | 0xc01e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 11:22:59.558051109 CEST | 192.168.2.5 | 1.1.1.1 | 0x18c0 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 11:23:02.857537031 CEST | 192.168.2.5 | 1.1.1.1 | 0x5be7 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 11:23:02.857656002 CEST | 192.168.2.5 | 1.1.1.1 | 0x9fc6 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 11:23:08.101871967 CEST | 192.168.2.5 | 1.1.1.1 | 0x9835 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 11:23:08.102051973 CEST | 192.168.2.5 | 1.1.1.1 | 0xb302 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 11:23:09.153630018 CEST | 192.168.2.5 | 1.1.1.1 | 0x3d1c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 11:23:09.154174089 CEST | 192.168.2.5 | 1.1.1.1 | 0x7e8c | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 11:24:10.301954031 CEST | 192.168.2.5 | 1.1.1.1 | 0x2ad4 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 11:24:10.302242994 CEST | 192.168.2.5 | 1.1.1.1 | 0xdeca | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 11:22:58.533720016 CEST | 1.1.1.1 | 192.168.2.5 | 0x4df7 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:58.536048889 CEST | 1.1.1.1 | 192.168.2.5 | 0x8996 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 216.58.212.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 172.217.23.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:22:59.565417051 CEST | 1.1.1.1 | 192.168.2.5 | 0xc01e | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:23:02.864120960 CEST | 1.1.1.1 | 192.168.2.5 | 0x9fc6 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 11:23:02.864350080 CEST | 1.1.1.1 | 192.168.2.5 | 0x5be7 | No error (0) | 142.250.184.196 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:23:08.108783007 CEST | 1.1.1.1 | 192.168.2.5 | 0x9835 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 11:23:08.108783007 CEST | 1.1.1.1 | 192.168.2.5 | 0x9835 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:23:08.109519958 CEST | 1.1.1.1 | 192.168.2.5 | 0xb302 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 11:23:09.160862923 CEST | 1.1.1.1 | 192.168.2.5 | 0x3d1c | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 11:24:10.309210062 CEST | 1.1.1.1 | 192.168.2.5 | 0x2ad4 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49706 | 142.250.186.174 | 443 | 5720 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 09:22:59 UTC | 859 | OUT | |
| 2024-10-01 09:22:59 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49713 | 142.250.185.238 | 443 | 5720 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 09:23:00 UTC | 877 | OUT | |
| 2024-10-01 09:23:00 UTC | 2634 | IN |