Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1523390 |
| MD5: | 28f4aa5264e452b3b6d44ce952d0b753 |
| SHA1: | 48a612d02667a33d916dfe2cf2d8deea1ed9fe2f |
| SHA256: | edda936f37b0ca35e9829c5e1c0153a52a0bbe63ae114e6b6ae69b1323cfdbf6 |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
file.exe (PID: 4560 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 28F4AA5264E452B3B6D44CE952D0B753) 
chrome.exe (PID: 2720 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ap p="https:/ /youtube.c om/account ?=https:// accounts.g oogle.com/ v3/signin/ challenge/ pwd" --sta rt-fullscr een --no-f irst-run - -disable-s ession-cra shed-bubbl e --disabl e-features =CrashReco very MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 5192 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2116 --fi eld-trial- handle=169 2,i,101534 6740275151 3809,73435 2519476836 0430,26214 4 --disabl e-features =CrashReco very /pref etch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 8124 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=54 12 --field -trial-han dle=1692,i ,101534674 0275151380 9,73435251 9476836043 0,262144 - -disable-f eatures=Cr ashRecover y /prefetc h:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 8132 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5204 --f ield-trial -handle=16 92,i,10153 4674027515 13809,7343 5251947683 60430,2621 44 --disab le-feature s=CrashRec overy /pre fetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0021DBBE | |
| Source: | Code function: | 0_2_001EC2A2 | |
| Source: | Code function: | 0_2_002268EE | |
| Source: | Code function: | 0_2_0022698F | |
| Source: | Code function: | 0_2_0021D076 | |
| Source: | Code function: | 0_2_0021D3A9 | |
| Source: | Code function: | 0_2_00229642 | |
| Source: | Code function: | 0_2_0022979D | |
| Source: | Code function: | 0_2_00229B2B | |
| Source: | Code function: | 0_2_00225C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_0022CE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0022EAFF | |
| Source: | Code function: | 0_2_0022ED6A | |
| Source: | Code function: | 0_2_0022EAFF | |
| Source: | Code function: | 0_2_0021AA57 | |
| Source: | Code function: | 0_2_00249576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_e14146eb-3 | |
| Source: | String found in binary or memory: | memstr_c7d7623d-5 | |
| Source: | String found in binary or memory: | memstr_14d0d0ea-6 | |
| Source: | String found in binary or memory: | memstr_a97c6d18-4 | |
| Source: | Code function: | 0_2_0021D5EB | |
| Source: | Code function: | 0_2_00211201 | |
| Source: | Code function: | 0_2_0021E8F6 | |
| Source: | Code function: | 0_2_001BBF40 | |
| Source: | Code function: | 0_2_00222046 | |
| Source: | Code function: | 0_2_001B8060 | |
| Source: | Code function: | 0_2_00218298 | |
| Source: | Code function: | 0_2_001EE4FF | |
| Source: | Code function: | 0_2_001E676B | |
| Source: | Code function: | 0_2_00244873 | |
| Source: | Code function: | 0_2_001DCAA0 | |
| Source: | Code function: | 0_2_001BCAF0 | |
| Source: | Code function: | 0_2_001CCC39 | |
| Source: | Code function: | 0_2_001E6DD9 | |
| Source: | Code function: | 0_2_001CB119 | |
| Source: | Code function: | 0_2_001B91C0 | |
| Source: | Code function: | 0_2_001D1394 | |
| Source: | Code function: | 0_2_001D781B | |
| Source: | Code function: | 0_2_001B7920 | |
| Source: | Code function: | 0_2_001C997D | |
| Source: | Code function: | 0_2_001D7A4A | |
| Source: | Code function: | 0_2_001D7CA7 | |
| Source: | Code function: | 0_2_0023BE44 | |
| Source: | Code function: | 0_2_001E9EEE | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_002237B5 | |
| Source: | Code function: | 0_2_002110BF | |
| Source: | Code function: | 0_2_002116C3 | |
| Source: | Code function: | 0_2_002251CD | |
| Source: | Code function: | 0_2_0021D4DC | |
| Source: | Code function: | 0_2_0022648E | |
| Source: | Code function: | 0_2_001B42A2 | |
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_001B42DE | |
| Source: | Code function: | 0_2_001D0A89 | |
| Source: | Code function: | 0_2_001CF98E | |
| Source: | Code function: | 0_2_00241C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-93987 | ||
| Source: | API coverage: | ||
| Source: | Code function: | 0_2_0021DBBE | |
| Source: | Code function: | 0_2_001EC2A2 | |
| Source: | Code function: | 0_2_002268EE | |
| Source: | Code function: | 0_2_0022698F | |
| Source: | Code function: | 0_2_0021D076 | |
| Source: | Code function: | 0_2_0021D3A9 | |
| Source: | Code function: | 0_2_00229642 | |
| Source: | Code function: | 0_2_0022979D | |
| Source: | Code function: | 0_2_00229B2B | |
| Source: | Code function: | 0_2_00225C97 | |
| Source: | Code function: | 0_2_001B42DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_0022EAA2 | |
| Source: | Code function: | 0_2_001E2622 | |
| Source: | Code function: | 0_2_001B42DE | |
| Source: | Code function: | 0_2_001D4CE8 | |
| Source: | Code function: | 0_2_00210B62 | |
| Source: | Code function: | 0_2_001E2622 | |
| Source: | Code function: | 0_2_001D083F | |
| Source: | Code function: | 0_2_001D09D5 | |
| Source: | Code function: | 0_2_001D0C21 | |
| Source: | Code function: | 0_2_00211201 | |
| Source: | Code function: | 0_2_001F2BA5 | |
| Source: | Code function: | 0_2_0021B226 | |
| Source: | Code function: | 0_2_002322DA | |
| Source: | Code function: | 0_2_00210B62 | |
| Source: | Code function: | 0_2_00211663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_001D0698 | |
| Source: | Code function: | 0_2_00228195 | |
| Source: | Code function: | 0_2_0020D27A | |
| Source: | Code function: | 0_2_001EB952 | |
| Source: | Code function: | 0_2_001B42DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 0_2_00231204 | |
| Source: | Code function: | 0_2_00231806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 15 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 2 Valid Accounts | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Virtualization/Sandbox Evasion | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 21 Access Token Manipulation | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 2 Process Injection | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.185.238 | true | false | unknown | |
| www3.l.google.com | 142.250.186.174 | true | false | unknown | |
| play.google.com | 216.58.212.142 | true | false | unknown | |
| www.google.com | 142.250.184.196 | true | false | unknown | |
| youtube.com | 172.217.16.142 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.184.196 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 216.58.212.142 | play.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.174 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.181.238 | unknown | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 172.217.16.142 | youtube.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.7 |
| 192.168.2.16 |
| 192.168.2.6 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1523390 |
| Start date and time: | 2024-10-01 15:06:05 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 52s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal64.troj.evad.winEXE@37/30@12/9 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.185.174, 74.125.71.84, 142.250.185.195, 34.104.35.123, 142.250.185.170, 142.250.185.74, 216.58.212.170, 142.250.185.202, 172.217.18.10, 142.250.185.138, 142.250.184.202, 142.250.186.42, 142.250.186.74, 142.250.185.106, 142.250.186.106, 216.58.206.42, 142.250.184.234, 142.250.181.234, 142.250.185.234, 142.250.186.170, 216.58.206.35, 172.217.16.202, 142.250.186.138, 172.217.16.138, 216.58.206.74, 172.217.23.106, 192.229.221.95, 2.16.100.168, 172.217.18.3, 142.250.110.84, 142.250.185.238
- Excluded domains from analysis (whitelisted): clients1.google.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Phisher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| youtube-ui.l.google.com | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Phisher | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
| Get hash | malicious | Phisher | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
|
⊘No context
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5049 |
| Entropy (8bit): | 5.317800104741948 |
| Encrypted: | false |
| SSDEEP: | 96:oHX9gPiPrfnHhsB0TR6kg1oDPJzLmM18Vh1z2fEZ54TZtnqj6w:EtEAr6BmPZtOeEvW/ncP |
| MD5: | CE53EF566B68CCF2D62FA044CFB0D138 |
| SHA1: | F48EC60289F2B55E8B388601206888F8295B1EB1 |
| SHA-256: | E6CC5114D92811D5DE0663266D4B63F367834AFA0FC3BAFA54F707038C59D010 |
| SHA-512: | 20B434881DE971E263669E6096C01665D4D35B0FBFF47D312A4A442645EE962A8CE6AD7E68246D4EE9691BD30D9B1DDCF7059226492E1B58CD3191B63B001E4D |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 697429 |
| Entropy (8bit): | 5.593310312179182 |
| Encrypted: | false |
| SSDEEP: | 6144:TYNlxfbDTYDhzCTNoygVWyJb5eGpbL2Mp15gI8seqfh53p+rrvV7i:T25bDTYB+qeGB+Nu |
| MD5: | 92F0F5E28355D863ACB77313F1E675DE |
| SHA1: | 8AD6F9B535D5B8952A4ADCCC57E4A4E0723F1E8D |
| SHA-256: | F903AE346609A2872554A3D8FFBDB1836CB5C8B7AAAED4C3F8296B887E03D833 |
| SHA-512: | 0C81A6CD850C6ACDBE9CCCBA00BBA34CDE1E09E8572814AE8E55DBED3C2B56F0B020359841F8217843B3403847DF46FA1C82229684F762A73C8110CE45898DAF |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.253939888205379 |
| Encrypted: | false |
| SSDEEP: | 48:o7BNJfeFb8L3A6FHqIy5Z+d70OCzSfvi/3fM/r8ZQzRrw:oFuILhFHrVCz0vLZz9w |
| MD5: | 10FF6F99E3228E96AFD6E2C30EF97C0A |
| SHA1: | 4AE3DCB8D1F5A0C302D5BAD9DFF5050A7A5E8130 |
| SHA-256: | 95E5546E1C7F311D07BB5050CC456A973E43BCC4777BA6014757376016537679 |
| SHA-512: | 116C0B1CAC98A27044100005545AB66BE5F4801D75DC259093A9F145B3A4ACD8DC1C360AF525F6DC8421CD54B675A78023D2ED8B57F5946A3969543758C673C9 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22827 |
| Entropy (8bit): | 5.420322672717721 |
| Encrypted: | false |
| SSDEEP: | 384:/jqdWXWfyA20UUjDE8BSUxDJs16KHvSN34kaHaN+587SaXD2mLR0H:/jqdWXAUUjDE84Wi6KPSKjHaN+58+0J2 |
| MD5: | 2B29741A316862EE788996DD29116DD5 |
| SHA1: | 9D5551916D4452E977C39B8D69CF88DF2AAA462B |
| SHA-256: | 62955C853976B722EFBB4C116A10DB3FF54580EDD7495D280177550B8F4289AB |
| SHA-512: | 6E37C3258F07F29909763728DADE0CD40A3602D55D9099F78B37756926FCF2A50008B82876B518FEAF3E56617F0F7D1D37A73C346A99A58E6AD8BCD6689E9B15 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4070 |
| Entropy (8bit): | 5.362700670482359 |
| Encrypted: | false |
| SSDEEP: | 96:GUpT+TmXtdW1qsHFcn7t7CnyWYvNTcLaQOw:lpT+qXW1PFcn7tGnyWY1TGb |
| MD5: | ED368A20CB303C0E7C6A3E6E43C2E14F |
| SHA1: | 429A5C538B45221F80405163D1F87912DD73C05A |
| SHA-256: | 93BA77AD4B11E0A70C0D36576F0DF24E27F50001EA02BAA6D357E034532D97F2 |
| SHA-512: | DE74BBADE910475DD245FFEFD4E1FD10137DE710B1C920D33BA52554911496E1339EF3C1F6D9D315CBC98A60ABE5687A3E7D8BEE483708E18D25722E794BDBE9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 603951 |
| Entropy (8bit): | 5.789948381047936 |
| Encrypted: | false |
| SSDEEP: | 3072:W0pApkygA62bwwdnO2YflNYhFGOizdGj008PpVVM96C5bMEPQUhts6FV8eKqtVAT:WlgNmwwdnOsF98oNGuQRAYqXsI1+ |
| MD5: | A97373CC3F8795654F3C8C6B57066AE7 |
| SHA1: | F7BECFDDE230EF537E8745B598DCED737C490C3C |
| SHA-256: | A1B0568D555DC4B4AF4CC5A6C41E838B702816445C04FF002C8A13058387F311 |
| SHA-512: | 47C76D26F4F9F206F93186800E06D3DBE1FDD0A1BA23FB9A3556390DE7F86C1FFB2C78FE307FB944C690475BFBAE9738C38233E00FDDFA9775A3B2030081D7F1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEQAz5EZnBR6fK6LIn1v8ILsATM3g/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.3872171131917925 |
| Encrypted: | false |
| SSDEEP: | 192:FK/pAzN7GZ068Hqhqu6DQaVapzYjgKItwdiwUsYRTi1j1t9bRl9:FqI7GZ04dRYjghtgisYYbt9ll9 |
| MD5: | AB70454DE18E1CE16E61EAC290FC304D |
| SHA1: | 68532B5E8B262D7E14B8F4507AA69A61146B3C18 |
| SHA-256: | B32D746867CC4FA21FD39437502F401D952D0A3E8DC708DFB7D58B85F256C0F1 |
| SHA-512: | A123C517380BEF0B47F23A5A6E1D16650FE39D9C701F9FA5ADD79294973C118E8EA3A7BA32CB63C3DFC0CE0F843FB86BFFCAA2AAE987629E7DFF84F176DEBB98 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32499 |
| Entropy (8bit): | 5.361345284201954 |
| Encrypted: | false |
| SSDEEP: | 768:mLX1O+aL6fgyIiREM4RKmh90toLoTswtF3ATcbDR6kIsnJd9DPyMv/FI:U2M4oltoLoTswtFoc/tIsnXFLI |
| MD5: | D5C3FB8EAE24AB7E40009338B5078496 |
| SHA1: | 5638BF5986A6445A88CD79A9B690B744B126BEC2 |
| SHA-256: | 597C14D360D690BCFDC2B8D315E6BB8879AEF33DE6C30D274743079BDB63C6B0 |
| SHA-512: | 6AE434850D473BEF15AA694AB4862596982CDDA6BD3991991D3ADD8F4A5F61DFBF8756D0DA98B72EF083909D68CF7B6B148A6488E9381F92FBF15CCB20176A0E |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.3750044852869046 |
| Encrypted: | false |
| SSDEEP: | 48:o7zfN/cD498xdg+Y5jNQ8js6npwk0OmNAEZbpMzR4EQBcW5QcHj9KWfGAeFKRrw:oCD9dA5jOEGh+EFqR4rhqUhzff9w |
| MD5: | 39693D34EE3D1829DBB1627C4FC6687B |
| SHA1: | A03303C2F027F3749B48D5134D1F8FB3E495C6E9 |
| SHA-256: | 03B0C1B4E402E0BCF75D530DD9085B25357EEFD09E238453DE1F3A042542C076 |
| SHA-512: | AC0749EDC33DA0EC0E40470388DD797B6528AD08B8FAC1C2AC42F85198131052BA1B533E90409D35DA237607E8B07D591FA6BA580B6A90B0D0AB2282A01F7585 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3471 |
| Entropy (8bit): | 5.5174491302699495 |
| Encrypted: | false |
| SSDEEP: | 96:ojAmjTJ/fJgpIcB7Fd2tilGBEMO/A6VxV08w:vUTJpgDJXM0ApJ |
| MD5: | 2D999C87DD54C7FE6400D267C33FBB23 |
| SHA1: | 414C3A329C2760325EDBACBD7A221D7F8DBFEEE8 |
| SHA-256: | 76D55A1AFC1D39CB04D60EB04E45A538A0E75EE2871561C84CC89B1C13596BCC |
| SHA-512: | 72D923BB71DD147139962FF8E2BD0E336E0F6409C212AC2F25387D0F3B4FC9365F5A6D40E2980BB1065534888362C97D6B7663E362D29166B5915D2A9DA7D238 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.280977407061266 |
| Encrypted: | false |
| SSDEEP: | 48:o7YNJvl3WlENrpB3stYCIgMxILNH/wf7DVTBpdQrw:oApB8iDwYlGw |
| MD5: | 4FB66582D37D04933F00E49C2FBA34D4 |
| SHA1: | 3DB09C53BBEB1EEB045A001356E498D8EF30915D |
| SHA-256: | A97DAC01ABFE3EB75C7C97D504E21BDDDADDB6EBE0B56B6A9A10CD3700CAB41B |
| SHA-512: | 2AEB3A6CFFBF6EFA626EBDC9E11ACBAC04BFE986F98FBC050B2501898B289C67D392ED195D16ACC9565EF8784401ADA1E88188CDE3A7AB12D98BB5ED7D8A5711 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.316515499943097 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DduJqrxsNL90YIzFK/Hb5eNhz1uktdDuvKKKGbLZ99GbSSF/ZR8OkdnprGJ:o7DQJopFN+ASCKKGbF99GbSS3RY7rw |
| MD5: | D97AB4594FC610665FF2763A650EE6A8 |
| SHA1: | 5C7459CA838D27BE45745571D8D96D156F4B9F8D |
| SHA-256: | 767D778369623FD8F5FB98D3BCC3130D05D02CBE0B9B88DD226F43281B14E9AF |
| SHA-512: | CE4941B41C3A8CC983C1BBCC87EF682823CB9DB24EA7A570E35BBF832046340D433F7D47211384B61FA38F3527CC35C195A6068CCB24B48E1F492C5B4D4192A1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2EQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHcuwDoV1_a7sThPZwbu2Ah9zAL5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.5797605345732935 |
| TrID: |
|
| File name: | file.exe |
| File size: | 917'504 bytes |
| MD5: | 28f4aa5264e452b3b6d44ce952d0b753 |
| SHA1: | 48a612d02667a33d916dfe2cf2d8deea1ed9fe2f |
| SHA256: | edda936f37b0ca35e9829c5e1c0153a52a0bbe63ae114e6b6ae69b1323cfdbf6 |
| SHA512: | fa506f07a2e738f002928d3e7108cd31fac093e392293e584e9d9b603da27e0579a055478fbff3bfc0323545d29411c3090570c63e2b658edeac347987eab0be |
| SSDEEP: | 12288:GqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagTH:GqDEvCTbMWu7rQYlBQcBiT6rprG8a4H |
| TLSH: | 36159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FBF23B [Tue Oct 1 12:59:39 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F4F41020A43h |
| jmp 00007F4F4102034Fh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F4F4102052Dh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F4F410204FAh |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F4F410230EDh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F4F41023138h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F4F41023121h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x95ac | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x95ac | 0x9600 | 1af87e6a3887a51ab59069578b3f7099 | False | 0.2861458333333333 | data | 5.163891914716751 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0x874 | data | 1.005083179297597 | ||
| RT_GROUP_ICON | 0xdd02c | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd0a4 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd0b8 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd0cc | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd0e0 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd1bc | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 15:07:00.156455040 CEST | 49674 | 443 | 192.168.2.6 | 173.222.162.64 |
| Oct 1, 2024 15:07:00.156455040 CEST | 49673 | 443 | 192.168.2.6 | 173.222.162.64 |
| Oct 1, 2024 15:07:00.468934059 CEST | 49672 | 443 | 192.168.2.6 | 173.222.162.64 |
| Oct 1, 2024 15:07:01.442347050 CEST | 49710 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:01.442400932 CEST | 443 | 49710 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:01.442495108 CEST | 49710 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:01.443041086 CEST | 49710 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:01.443056107 CEST | 443 | 49710 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:02.261925936 CEST | 443 | 49710 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:02.262078047 CEST | 49710 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:02.266074896 CEST | 49710 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:02.266092062 CEST | 443 | 49710 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:02.266345978 CEST | 443 | 49710 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:02.268860102 CEST | 49710 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:02.268970013 CEST | 49710 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:02.268975973 CEST | 443 | 49710 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:02.269203901 CEST | 49710 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:02.311407089 CEST | 443 | 49710 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:02.451267958 CEST | 443 | 49710 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:02.451503038 CEST | 443 | 49710 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:02.451589108 CEST | 49710 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:02.451813936 CEST | 49710 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:02.451838017 CEST | 443 | 49710 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:05.336028099 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:05.336072922 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:05.336128950 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:05.337389946 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:05.337404013 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:05.974294901 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.015537977 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:06.043673992 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:06.043689013 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.044351101 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.044418097 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:06.045078993 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.045128107 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:06.093241930 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:06.093328953 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.093703032 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:06.093719959 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.138933897 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:06.300717115 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.300798893 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.300848007 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:06.309032917 CEST | 49714 | 443 | 192.168.2.6 | 172.217.16.142 |
| Oct 1, 2024 15:07:06.309062004 CEST | 443 | 49714 | 172.217.16.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:09.764004946 CEST | 49673 | 443 | 192.168.2.6 | 173.222.162.64 |
| Oct 1, 2024 15:07:09.764036894 CEST | 49674 | 443 | 192.168.2.6 | 173.222.162.64 |
| Oct 1, 2024 15:07:09.960506916 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:09.960546017 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:09.960621119 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:09.960834980 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:09.960848093 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:10.082307100 CEST | 49672 | 443 | 192.168.2.6 | 173.222.162.64 |
| Oct 1, 2024 15:07:10.596988916 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:10.597209930 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:10.597242117 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:10.598354101 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:10.598421097 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:10.599845886 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:10.599911928 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:10.605205059 CEST | 49727 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:10.605251074 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:10.605329037 CEST | 49727 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:10.606688976 CEST | 49727 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:10.606704950 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:10.641355038 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:10.641381025 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:10.673755884 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:10.673810005 CEST | 443 | 49728 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:10.673891068 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:10.674607038 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:10.674633980 CEST | 443 | 49728 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:10.686887026 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:11.261841059 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.261917114 CEST | 49727 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:11.265913963 CEST | 49727 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:11.265925884 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.266175032 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.311693907 CEST | 49727 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:11.313704967 CEST | 49727 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:11.359400034 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.462646008 CEST | 443 | 49728 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.462704897 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:11.465684891 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:11.465697050 CEST | 443 | 49728 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.465946913 CEST | 443 | 49728 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.468262911 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:11.468482971 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:11.468488932 CEST | 443 | 49728 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.469314098 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:11.515409946 CEST | 443 | 49728 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.534491062 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.534559965 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.534605026 CEST | 49727 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:11.534722090 CEST | 49727 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:11.534745932 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.534758091 CEST | 49727 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:11.534765005 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.586419106 CEST | 49729 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:11.586460114 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.586548090 CEST | 49729 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:11.587270021 CEST | 49729 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:11.587287903 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.644345045 CEST | 443 | 49728 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.644819975 CEST | 443 | 49728 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.644875050 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:11.646377087 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:11.646393061 CEST | 443 | 49728 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.646414995 CEST | 49728 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:11.732557058 CEST | 443 | 49705 | 173.222.162.64 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.732635975 CEST | 49705 | 443 | 192.168.2.6 | 173.222.162.64 |
| Oct 1, 2024 15:07:12.221206903 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:12.221292973 CEST | 49729 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:12.223555088 CEST | 49729 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:12.223568916 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:12.223808050 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:12.224917889 CEST | 49729 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:12.267410040 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:12.498051882 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:12.498264074 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:12.498584032 CEST | 49729 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:12.515611887 CEST | 49729 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:12.515611887 CEST | 49729 | 443 | 192.168.2.6 | 184.28.90.27 |
| Oct 1, 2024 15:07:12.515633106 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:12.515645981 CEST | 443 | 49729 | 184.28.90.27 | 192.168.2.6 |
| Oct 1, 2024 15:07:14.666013956 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:14.666045904 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:14.666177034 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:14.666505098 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:14.666517973 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.298944950 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.299215078 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.299228907 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.299642086 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.299735069 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.300343037 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.300422907 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.301664114 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.301664114 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.301680088 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.301728964 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.344486952 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.344496965 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.391702890 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.621711969 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.621748924 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.621779919 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.623368979 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.623380899 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.627727032 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.629905939 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.629913092 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.633902073 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.634018898 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.634088039 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.634095907 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.635597944 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.640294075 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.640383005 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.646850109 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.646895885 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.646920919 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.646931887 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.647542953 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.711734056 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.711801052 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.711812973 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.711822987 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.711837053 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.712264061 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.712270975 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.717143059 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.717180967 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.717185974 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.717191935 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.717689037 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.719499111 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:15.719547033 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.719749928 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:15.720472097 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:15.720490932 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.723469973 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.723583937 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.729851007 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.730411053 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.730421066 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.731318951 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.735944986 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.742305994 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.742872953 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.742979050 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.744170904 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.757205009 CEST | 49743 | 443 | 192.168.2.6 | 142.250.186.174 |
| Oct 1, 2024 15:07:15.757220030 CEST | 443 | 49743 | 142.250.186.174 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.869956017 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:15.869980097 CEST | 443 | 49747 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.871282101 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:15.875473022 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:15.875483990 CEST | 443 | 49747 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.358675957 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.362423897 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.362452984 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.362871885 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.362940073 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.363697052 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.363754988 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.370680094 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.370784998 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.370970011 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.370979071 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.422265053 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.513026953 CEST | 443 | 49747 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.513991117 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.514004946 CEST | 443 | 49747 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.514406919 CEST | 443 | 49747 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.514462948 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.515146017 CEST | 443 | 49747 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.515198946 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.526658058 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.526736021 CEST | 443 | 49747 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.527457952 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.527475119 CEST | 443 | 49747 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.578572989 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.660151005 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.660339117 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.660388947 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.660759926 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.660779953 CEST | 443 | 49746 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.660789013 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.660819054 CEST | 49746 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.661742926 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.661788940 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.661848068 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.662195921 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.662213087 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.811660051 CEST | 443 | 49747 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.812216043 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.812264919 CEST | 443 | 49747 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.812316895 CEST | 49747 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.813100100 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.813138008 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:16.813199997 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.813616991 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:16.813632965 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.293811083 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.294059992 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.294075012 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.294450998 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.294524908 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.295145988 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.295196056 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.295373917 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.295444012 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.295594931 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.295602083 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.295618057 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.339407921 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.341747046 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.443850040 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.446186066 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.446202993 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.446588039 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.446659088 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.447335958 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.447406054 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.447725058 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.447787046 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.447871923 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.447972059 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.447979927 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.500024080 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.510216951 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.511089087 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.511145115 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.511759043 CEST | 49750 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.511778116 CEST | 443 | 49750 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.661984921 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.662098885 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:17.662240028 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.662992001 CEST | 49752 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:17.663008928 CEST | 443 | 49752 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:18.274895906 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:18.319408894 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:18.541207075 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:18.541256905 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:18.541289091 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:18.541318893 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:18.541335106 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:18.541353941 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:18.541371107 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:18.541435003 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:18.541486979 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:18.545516014 CEST | 49723 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:07:18.545531988 CEST | 443 | 49723 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:07:20.110920906 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:20.110965967 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:20.111021996 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:20.112124920 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:20.112134933 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:20.796241045 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:20.796312094 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:20.808871031 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:20.808897972 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:20.809223890 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:20.857441902 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:21.040260077 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:21.087404966 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:21.270747900 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:21.270766973 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:21.270773888 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:21.270781994 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:21.270821095 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:21.270842075 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:21.270859003 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:21.270888090 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:21.270901918 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:21.271399975 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:21.271464109 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:21.271466970 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:21.271513939 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:21.285787106 CEST | 49759 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:21.285800934 CEST | 443 | 49759 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:23.724936008 CEST | 49763 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:23.724973917 CEST | 443 | 49763 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:23.725137949 CEST | 49763 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:23.725574970 CEST | 49763 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:23.725594044 CEST | 443 | 49763 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:24.375183105 CEST | 443 | 49763 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:24.375549078 CEST | 49763 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:24.375567913 CEST | 443 | 49763 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:24.375945091 CEST | 443 | 49763 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:24.376267910 CEST | 49763 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:24.376333952 CEST | 443 | 49763 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:24.376605988 CEST | 49763 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:24.376689911 CEST | 49763 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:24.376694918 CEST | 443 | 49763 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:24.714684963 CEST | 443 | 49763 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:24.716353893 CEST | 443 | 49763 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:24.716413975 CEST | 49763 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:24.720607042 CEST | 49763 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:24.720623016 CEST | 443 | 49763 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:26.852421045 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:26.852482080 CEST | 443 | 49764 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:26.852550030 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:26.853107929 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:26.853121996 CEST | 443 | 49764 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:27.710973024 CEST | 443 | 49764 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:27.711042881 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:27.716290951 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:27.716301918 CEST | 443 | 49764 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:27.716562986 CEST | 443 | 49764 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:27.719945908 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:27.719995975 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:27.720000029 CEST | 443 | 49764 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:27.720127106 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:27.763434887 CEST | 443 | 49764 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:27.890494108 CEST | 443 | 49764 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:27.891020060 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:27.891038895 CEST | 443 | 49764 | 40.115.3.253 | 192.168.2.6 |
| Oct 1, 2024 15:07:27.891056061 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:27.891088009 CEST | 49764 | 443 | 192.168.2.6 | 40.115.3.253 |
| Oct 1, 2024 15:07:46.248421907 CEST | 49765 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:46.248469114 CEST | 443 | 49765 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:46.248531103 CEST | 49765 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:46.249138117 CEST | 49765 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:46.249155998 CEST | 443 | 49765 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.041579008 CEST | 443 | 49765 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.041640997 CEST | 49765 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:47.043437958 CEST | 49765 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:47.043454885 CEST | 443 | 49765 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.043715954 CEST | 443 | 49765 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.054204941 CEST | 49765 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:47.054275990 CEST | 49765 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:47.054285049 CEST | 443 | 49765 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.054400921 CEST | 49765 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:47.095407963 CEST | 443 | 49765 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.226054907 CEST | 443 | 49765 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.226155996 CEST | 443 | 49765 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.226234913 CEST | 49765 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:47.226478100 CEST | 49765 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:07:47.226497889 CEST | 443 | 49765 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.251266003 CEST | 49766 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:47.251316071 CEST | 443 | 49766 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.251398087 CEST | 49766 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:47.252051115 CEST | 49766 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:47.252063990 CEST | 443 | 49766 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.553767920 CEST | 49767 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:47.553832054 CEST | 443 | 49767 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.553911924 CEST | 49767 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:47.554186106 CEST | 49767 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:47.554207087 CEST | 443 | 49767 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.915148020 CEST | 443 | 49766 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.915474892 CEST | 49766 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:47.915497065 CEST | 443 | 49766 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.915929079 CEST | 443 | 49766 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.916275024 CEST | 49766 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:47.916342020 CEST | 443 | 49766 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:47.916440964 CEST | 49766 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:47.916455030 CEST | 49766 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:47.916466951 CEST | 443 | 49766 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.210833073 CEST | 443 | 49767 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.211172104 CEST | 49767 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.211194038 CEST | 443 | 49767 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.211613894 CEST | 443 | 49767 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.211900949 CEST | 49767 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.212028027 CEST | 443 | 49767 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.212059021 CEST | 49767 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.212085009 CEST | 49767 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.212091923 CEST | 443 | 49767 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.222322941 CEST | 443 | 49766 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.222484112 CEST | 443 | 49766 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.222567081 CEST | 49766 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.222829103 CEST | 49766 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.222846031 CEST | 443 | 49766 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.361076117 CEST | 49768 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.361121893 CEST | 443 | 49768 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.361188889 CEST | 49768 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.361500978 CEST | 49768 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.361509085 CEST | 443 | 49768 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.549041986 CEST | 443 | 49767 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.549179077 CEST | 443 | 49767 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:48.549243927 CEST | 49767 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.549668074 CEST | 49767 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:48.549693108 CEST | 443 | 49767 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:49.550287008 CEST | 443 | 49768 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:49.550575018 CEST | 49768 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:49.550600052 CEST | 443 | 49768 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:49.551095963 CEST | 443 | 49768 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:49.551428080 CEST | 49768 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:49.551543951 CEST | 443 | 49768 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:49.551728010 CEST | 49768 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:49.551748991 CEST | 49768 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:49.551773071 CEST | 443 | 49768 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:49.945709944 CEST | 443 | 49768 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:49.945880890 CEST | 443 | 49768 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:49.945964098 CEST | 49768 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:49.946688890 CEST | 49768 | 443 | 192.168.2.6 | 216.58.212.142 |
| Oct 1, 2024 15:07:49.946707964 CEST | 443 | 49768 | 216.58.212.142 | 192.168.2.6 |
| Oct 1, 2024 15:07:57.853324890 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:57.853377104 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:57.853471994 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:57.853810072 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:57.853821039 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.543615103 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.543874979 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.546751022 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.546766043 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.547143936 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.557051897 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.599401951 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.808995962 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.809014082 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.809034109 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.809092999 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.809118986 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.809138060 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.809165001 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.810235023 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.810266972 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.810303926 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.810307980 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.810328960 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.810342073 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.810385942 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.814199924 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.814215899 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:07:58.814227104 CEST | 49769 | 443 | 192.168.2.6 | 13.85.23.86 |
| Oct 1, 2024 15:07:58.814233065 CEST | 443 | 49769 | 13.85.23.86 | 192.168.2.6 |
| Oct 1, 2024 15:08:08.091305017 CEST | 49771 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:08.091378927 CEST | 443 | 49771 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:08.091479063 CEST | 49771 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:08.092052937 CEST | 49771 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:08.092072010 CEST | 443 | 49771 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:08.982295990 CEST | 443 | 49771 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:08.982480049 CEST | 49771 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:08.984479904 CEST | 49771 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:08.984493971 CEST | 443 | 49771 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:08.984752893 CEST | 443 | 49771 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:08.986622095 CEST | 49771 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:08.986679077 CEST | 49771 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:08.986685038 CEST | 443 | 49771 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:08.986809015 CEST | 49771 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:09.031403065 CEST | 443 | 49771 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:09.162206888 CEST | 443 | 49771 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:09.162290096 CEST | 443 | 49771 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:09.162339926 CEST | 49771 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:09.162486076 CEST | 49771 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:09.162507057 CEST | 443 | 49771 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:10.015840054 CEST | 49772 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:08:10.015882015 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:08:10.016072989 CEST | 49772 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:08:10.016239882 CEST | 49772 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:08:10.016263008 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:08:10.653460979 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:08:10.655586958 CEST | 49772 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:08:10.655606031 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:08:10.655961990 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:08:10.662852049 CEST | 49772 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:08:10.662934065 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:08:10.717426062 CEST | 49772 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:08:18.243421078 CEST | 49774 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:18.243469000 CEST | 443 | 49774 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:18.243566036 CEST | 49774 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:18.243777037 CEST | 49774 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:18.243793011 CEST | 443 | 49774 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:18.909491062 CEST | 443 | 49774 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:18.909837008 CEST | 49774 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:18.909866095 CEST | 443 | 49774 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:18.910253048 CEST | 443 | 49774 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:18.910595894 CEST | 49774 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:18.910674095 CEST | 443 | 49774 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:18.910763025 CEST | 49774 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:18.910788059 CEST | 49774 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:18.910794973 CEST | 443 | 49774 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:18.988270044 CEST | 49775 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:18.988321066 CEST | 443 | 49775 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:18.988415003 CEST | 49775 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:18.988732100 CEST | 49775 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:18.988753080 CEST | 443 | 49775 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.214270115 CEST | 443 | 49774 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.214827061 CEST | 443 | 49774 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.214885950 CEST | 49774 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:19.214993000 CEST | 49774 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:19.215013981 CEST | 443 | 49774 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.620562077 CEST | 443 | 49775 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.621182919 CEST | 49775 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:19.621206999 CEST | 443 | 49775 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.621591091 CEST | 443 | 49775 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.621917963 CEST | 49775 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:19.621998072 CEST | 443 | 49775 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.622082949 CEST | 49775 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:19.622082949 CEST | 49775 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:19.622113943 CEST | 443 | 49775 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.920052052 CEST | 443 | 49775 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.921705008 CEST | 443 | 49775 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:19.921773911 CEST | 49775 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:19.922107935 CEST | 49775 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:19.922131062 CEST | 443 | 49775 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:20.577059031 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:08:20.577151060 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:08:20.577222109 CEST | 49772 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:08:32.640196085 CEST | 49772 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:08:32.640217066 CEST | 443 | 49772 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:08:34.484803915 CEST | 49776 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:34.484874964 CEST | 443 | 49776 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:34.484966993 CEST | 49776 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:34.485560894 CEST | 49776 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:34.485577106 CEST | 443 | 49776 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:35.287010908 CEST | 443 | 49776 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:35.287097931 CEST | 49776 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:35.289299011 CEST | 49776 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:35.289316893 CEST | 443 | 49776 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:35.289582968 CEST | 443 | 49776 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:35.291488886 CEST | 49776 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:35.291555882 CEST | 49776 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:35.291562080 CEST | 443 | 49776 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:35.291673899 CEST | 49776 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:35.335405111 CEST | 443 | 49776 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:35.466227055 CEST | 443 | 49776 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:35.466305971 CEST | 443 | 49776 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:35.466418982 CEST | 49776 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:35.466540098 CEST | 49776 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:08:35.466562986 CEST | 443 | 49776 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:08:39.889173031 CEST | 49704 | 80 | 192.168.2.6 | 93.184.221.240 |
| Oct 1, 2024 15:08:39.894618988 CEST | 80 | 49704 | 93.184.221.240 | 192.168.2.6 |
| Oct 1, 2024 15:08:39.894690990 CEST | 49704 | 80 | 192.168.2.6 | 93.184.221.240 |
| Oct 1, 2024 15:08:48.502253056 CEST | 49778 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:48.502291918 CEST | 443 | 49778 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:48.502377033 CEST | 49778 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:48.502892971 CEST | 49778 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:48.502901077 CEST | 443 | 49778 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:49.135818005 CEST | 443 | 49778 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:49.136519909 CEST | 49778 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:49.136534929 CEST | 443 | 49778 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:49.136888027 CEST | 443 | 49778 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:49.137763023 CEST | 49778 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:49.137819052 CEST | 443 | 49778 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:49.138338089 CEST | 49778 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:49.138427019 CEST | 49778 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:49.138432980 CEST | 443 | 49778 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:49.455579996 CEST | 443 | 49778 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:49.456370115 CEST | 443 | 49778 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:49.456419945 CEST | 49778 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:49.530940056 CEST | 49778 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:49.530956030 CEST | 443 | 49778 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:49.657804966 CEST | 49779 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:49.657860994 CEST | 443 | 49779 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:49.657942057 CEST | 49779 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:49.658315897 CEST | 49779 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:49.658332109 CEST | 443 | 49779 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:50.308697939 CEST | 443 | 49779 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:50.309027910 CEST | 49779 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:50.309068918 CEST | 443 | 49779 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:50.309446096 CEST | 443 | 49779 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:50.309880972 CEST | 49779 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:50.309947014 CEST | 443 | 49779 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:50.310051918 CEST | 49779 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:50.310071945 CEST | 49779 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:50.310085058 CEST | 443 | 49779 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:50.807914972 CEST | 443 | 49779 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:50.808048010 CEST | 443 | 49779 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:08:50.808092117 CEST | 49779 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:50.808621883 CEST | 49779 | 443 | 192.168.2.6 | 142.250.181.238 |
| Oct 1, 2024 15:08:50.808643103 CEST | 443 | 49779 | 142.250.181.238 | 192.168.2.6 |
| Oct 1, 2024 15:09:01.522476912 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:01.522522926 CEST | 443 | 49780 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:09:01.522591114 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:01.523163080 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:01.523185968 CEST | 443 | 49780 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:09:02.300280094 CEST | 443 | 49780 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:09:02.300498962 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:02.302381992 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:02.302396059 CEST | 443 | 49780 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:09:02.302619934 CEST | 443 | 49780 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:09:02.304445028 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:02.304514885 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:02.304528952 CEST | 443 | 49780 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:09:02.304658890 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:02.351397991 CEST | 443 | 49780 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:09:02.476043940 CEST | 443 | 49780 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:09:02.476428032 CEST | 443 | 49780 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:09:02.476490021 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:02.476602077 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:02.476602077 CEST | 49780 | 443 | 192.168.2.6 | 40.113.103.199 |
| Oct 1, 2024 15:09:02.476624966 CEST | 443 | 49780 | 40.113.103.199 | 192.168.2.6 |
| Oct 1, 2024 15:09:10.078915119 CEST | 49781 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:09:10.078980923 CEST | 443 | 49781 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:09:10.079056025 CEST | 49781 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:09:10.079406023 CEST | 49781 | 443 | 192.168.2.6 | 142.250.184.196 |
| Oct 1, 2024 15:09:10.079421043 CEST | 443 | 49781 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:09:10.736926079 CEST | 443 | 49781 | 142.250.184.196 | 192.168.2.6 |
| Oct 1, 2024 15:09:10.780103922 CEST | 49781 | 443 | 192.168.2.6 | 142.250.184.196 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 15:07:05.273588896 CEST | 63593 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:07:05.273737907 CEST | 50145 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:07:05.280272961 CEST | 53 | 63593 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:05.280663967 CEST | 53 | 50145 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:05.281649113 CEST | 53 | 51034 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:05.281661034 CEST | 53 | 61591 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.342724085 CEST | 55881 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:07:06.343090057 CEST | 59246 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:07:06.349481106 CEST | 53 | 55881 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.349828005 CEST | 53 | 59246 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:06.365464926 CEST | 53 | 58721 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:09.789150953 CEST | 53 | 50975 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:09.952433109 CEST | 49799 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:07:09.952554941 CEST | 60684 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:07:09.959346056 CEST | 53 | 49799 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:09.959703922 CEST | 53 | 60684 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:11.709809065 CEST | 53 | 63750 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:14.654906988 CEST | 62231 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:07:14.655051947 CEST | 57511 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:07:14.661542892 CEST | 53 | 62231 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:14.662502050 CEST | 53 | 57511 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.710730076 CEST | 56234 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:07:15.710944891 CEST | 59296 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:07:15.717644930 CEST | 53 | 59296 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:15.717822075 CEST | 53 | 56234 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:23.614994049 CEST | 53 | 53479 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:07:42.584588051 CEST | 53 | 63849 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:08:05.211918116 CEST | 53 | 59302 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:08:05.570391893 CEST | 53 | 58144 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:08:16.746052027 CEST | 53 | 55286 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:08:18.235948086 CEST | 64475 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:08:18.236089945 CEST | 53668 | 53 | 192.168.2.6 | 1.1.1.1 |
| Oct 1, 2024 15:08:18.242856026 CEST | 53 | 64475 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:08:18.243134022 CEST | 53 | 53668 | 1.1.1.1 | 192.168.2.6 |
| Oct 1, 2024 15:08:32.647519112 CEST | 53 | 61580 | 1.1.1.1 | 192.168.2.6 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 15:07:05.273588896 CEST | 192.168.2.6 | 1.1.1.1 | 0xe695 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 15:07:05.273737907 CEST | 192.168.2.6 | 1.1.1.1 | 0x281d | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 15:07:06.342724085 CEST | 192.168.2.6 | 1.1.1.1 | 0xb273 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 15:07:06.343090057 CEST | 192.168.2.6 | 1.1.1.1 | 0x34bc | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 15:07:09.952433109 CEST | 192.168.2.6 | 1.1.1.1 | 0xd122 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 15:07:09.952554941 CEST | 192.168.2.6 | 1.1.1.1 | 0xde39 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 15:07:14.654906988 CEST | 192.168.2.6 | 1.1.1.1 | 0xfea0 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 15:07:14.655051947 CEST | 192.168.2.6 | 1.1.1.1 | 0xb284 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 15:07:15.710730076 CEST | 192.168.2.6 | 1.1.1.1 | 0xfcba | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 15:07:15.710944891 CEST | 192.168.2.6 | 1.1.1.1 | 0x7622 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 15:08:18.235948086 CEST | 192.168.2.6 | 1.1.1.1 | 0xf5ee | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 15:08:18.236089945 CEST | 192.168.2.6 | 1.1.1.1 | 0xdd79 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 15:07:05.280272961 CEST | 1.1.1.1 | 192.168.2.6 | 0xe695 | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:05.280663967 CEST | 1.1.1.1 | 192.168.2.6 | 0x281d | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 172.217.23.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 216.58.212.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349481106 CEST | 1.1.1.1 | 192.168.2.6 | 0xb273 | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349828005 CEST | 1.1.1.1 | 192.168.2.6 | 0x34bc | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:06.349828005 CEST | 1.1.1.1 | 192.168.2.6 | 0x34bc | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 15:07:09.959346056 CEST | 1.1.1.1 | 192.168.2.6 | 0xd122 | No error (0) | 142.250.184.196 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:09.959703922 CEST | 1.1.1.1 | 192.168.2.6 | 0xde39 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 15:07:14.661542892 CEST | 1.1.1.1 | 192.168.2.6 | 0xfea0 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:14.661542892 CEST | 1.1.1.1 | 192.168.2.6 | 0xfea0 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:14.662502050 CEST | 1.1.1.1 | 192.168.2.6 | 0xb284 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 15:07:15.717822075 CEST | 1.1.1.1 | 192.168.2.6 | 0xfcba | No error (0) | 216.58.212.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 15:08:18.242856026 CEST | 1.1.1.1 | 192.168.2.6 | 0xf5ee | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 0 | 192.168.2.6 | 49710 | 40.113.103.199 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:02 UTC | 71 | OUT | |
| 2024-10-01 13:07:02 UTC | 249 | OUT | |
| 2024-10-01 13:07:02 UTC | 1084 | OUT | |
| 2024-10-01 13:07:02 UTC | 218 | OUT | |
| 2024-10-01 13:07:02 UTC | 14 | IN | |
| 2024-10-01 13:07:02 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.6 | 49714 | 172.217.16.142 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:06 UTC | 847 | OUT | |
| 2024-10-01 13:07:06 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.6 | 49727 | 184.28.90.27 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:11 UTC | 161 | OUT | |
| 2024-10-01 13:07:11 UTC | 467 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 3 | 192.168.2.6 | 49728 | 40.115.3.253 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:11 UTC | 71 | OUT | |
| 2024-10-01 13:07:11 UTC | 249 | OUT | |
| 2024-10-01 13:07:11 UTC | 1084 | OUT | |
| 2024-10-01 13:07:11 UTC | 218 | OUT | |
| 2024-10-01 13:07:11 UTC | 14 | IN | |
| 2024-10-01 13:07:11 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.6 | 49729 | 184.28.90.27 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:12 UTC | 239 | OUT | |
| 2024-10-01 13:07:12 UTC | 515 | IN | |
| 2024-10-01 13:07:12 UTC | 55 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.6 | 49743 | 142.250.186.174 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:15 UTC | 1232 | OUT | |
| 2024-10-01 13:07:15 UTC | 1965 | IN | |
| 2024-10-01 13:07:15 UTC | 1965 | IN | |
| 2024-10-01 13:07:15 UTC | 1965 | IN | |
| 2024-10-01 13:07:15 UTC | 1965 | IN | |
| 2024-10-01 13:07:15 UTC | 1965 | IN | |
| 2024-10-01 13:07:15 UTC | 1965 | IN | |
| 2024-10-01 13:07:15 UTC | 1965 | IN | |
| 2024-10-01 13:07:15 UTC | 1965 | IN | |
| 2024-10-01 13:07:15 UTC | 1965 | IN | |
| 2024-10-01 13:07:15 UTC | 1965 | IN | |
| 2024-10-01 13:07:15 UTC | 1965 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.6 | 49746 | 216.58.212.142 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:16 UTC | 549 | OUT | |
| 2024-10-01 13:07:16 UTC | 520 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.6 | 49747 | 216.58.212.142 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:16 UTC | 549 | OUT | |
| 2024-10-01 13:07:16 UTC | 520 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.6 | 49750 | 216.58.212.142 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:17 UTC | 1120 | OUT | |
| 2024-10-01 13:07:17 UTC | 519 | OUT | |
| 2024-10-01 13:07:17 UTC | 932 | IN | |
| 2024-10-01 13:07:17 UTC | 137 | IN | |
| 2024-10-01 13:07:17 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.6 | 49752 | 216.58.212.142 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:17 UTC | 1120 | OUT | |
| 2024-10-01 13:07:17 UTC | 519 | OUT | |
| 2024-10-01 13:07:17 UTC | 932 | IN | |
| 2024-10-01 13:07:17 UTC | 137 | IN | |
| 2024-10-01 13:07:17 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.6 | 49723 | 142.250.184.196 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:18 UTC | 1209 | OUT | |
| 2024-10-01 13:07:18 UTC | 705 | IN | |
| 2024-10-01 13:07:18 UTC | 685 | IN | |
| 2024-10-01 13:07:18 UTC | 1390 | IN | |
| 2024-10-01 13:07:18 UTC | 1390 | IN | |
| 2024-10-01 13:07:18 UTC | 1390 | IN | |
| 2024-10-01 13:07:18 UTC | 575 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.6 | 49759 | 13.85.23.86 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:21 UTC | 306 | OUT | |
| 2024-10-01 13:07:21 UTC | 560 | IN | |
| 2024-10-01 13:07:21 UTC | 15824 | IN | |
| 2024-10-01 13:07:21 UTC | 8666 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.6 | 49763 | 216.58.212.142 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:24 UTC | 1294 | OUT | |
| 2024-10-01 13:07:24 UTC | 1224 | OUT | |
| 2024-10-01 13:07:24 UTC | 940 | IN | |
| 2024-10-01 13:07:24 UTC | 137 | IN | |
| 2024-10-01 13:07:24 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 13 | 192.168.2.6 | 49764 | 40.115.3.253 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:27 UTC | 71 | OUT | |
| 2024-10-01 13:07:27 UTC | 249 | OUT | |
| 2024-10-01 13:07:27 UTC | 1084 | OUT | |
| 2024-10-01 13:07:27 UTC | 218 | OUT | |
| 2024-10-01 13:07:27 UTC | 14 | IN | |
| 2024-10-01 13:07:27 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 14 | 192.168.2.6 | 49765 | 40.113.103.199 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:47 UTC | 71 | OUT | |
| 2024-10-01 13:07:47 UTC | 249 | OUT | |
| 2024-10-01 13:07:47 UTC | 1084 | OUT | |
| 2024-10-01 13:07:47 UTC | 218 | OUT | |
| 2024-10-01 13:07:47 UTC | 14 | IN | |
| 2024-10-01 13:07:47 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.6 | 49766 | 216.58.212.142 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:47 UTC | 1325 | OUT | |
| 2024-10-01 13:07:47 UTC | 1280 | OUT | |
| 2024-10-01 13:07:48 UTC | 523 | IN | |
| 2024-10-01 13:07:48 UTC | 137 | IN | |
| 2024-10-01 13:07:48 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.6 | 49767 | 216.58.212.142 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:48 UTC | 1285 | OUT | |
| 2024-10-01 13:07:48 UTC | 1039 | OUT | |
| 2024-10-01 13:07:48 UTC | 523 | IN | |
| 2024-10-01 13:07:48 UTC | 137 | IN | |
| 2024-10-01 13:07:48 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.6 | 49768 | 216.58.212.142 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:49 UTC | 1325 | OUT | |
| 2024-10-01 13:07:49 UTC | 1203 | OUT | |
| 2024-10-01 13:07:49 UTC | 523 | IN | |
| 2024-10-01 13:07:49 UTC | 137 | IN | |
| 2024-10-01 13:07:49 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.6 | 49769 | 13.85.23.86 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:07:58 UTC | 306 | OUT | |
| 2024-10-01 13:07:58 UTC | 560 | IN | |
| 2024-10-01 13:07:58 UTC | 15824 | IN | |
| 2024-10-01 13:07:58 UTC | 14181 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 19 | 192.168.2.6 | 49771 | 40.113.103.199 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:08:08 UTC | 71 | OUT | |
| 2024-10-01 13:08:08 UTC | 249 | OUT | |
| 2024-10-01 13:08:08 UTC | 1084 | OUT | |
| 2024-10-01 13:08:08 UTC | 218 | OUT | |
| 2024-10-01 13:08:09 UTC | 14 | IN | |
| 2024-10-01 13:08:09 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.6 | 49774 | 142.250.181.238 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:08:18 UTC | 1325 | OUT | |
| 2024-10-01 13:08:18 UTC | 1207 | OUT | |
| 2024-10-01 13:08:19 UTC | 523 | IN | |
| 2024-10-01 13:08:19 UTC | 137 | IN | |
| 2024-10-01 13:08:19 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.6 | 49775 | 142.250.181.238 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:08:19 UTC | 1325 | OUT | |
| 2024-10-01 13:08:19 UTC | 1185 | OUT | |
| 2024-10-01 13:08:19 UTC | 523 | IN | |
| 2024-10-01 13:08:19 UTC | 137 | IN | |
| 2024-10-01 13:08:19 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 22 | 192.168.2.6 | 49776 | 40.113.103.199 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:08:35 UTC | 71 | OUT | |
| 2024-10-01 13:08:35 UTC | 249 | OUT | |
| 2024-10-01 13:08:35 UTC | 1084 | OUT | |
| 2024-10-01 13:08:35 UTC | 218 | OUT | |
| 2024-10-01 13:08:35 UTC | 14 | IN | |
| 2024-10-01 13:08:35 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 23 | 192.168.2.6 | 49778 | 142.250.181.238 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:08:49 UTC | 1325 | OUT | |
| 2024-10-01 13:08:49 UTC | 1245 | OUT | |
| 2024-10-01 13:08:49 UTC | 523 | IN | |
| 2024-10-01 13:08:49 UTC | 137 | IN | |
| 2024-10-01 13:08:49 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 24 | 192.168.2.6 | 49779 | 142.250.181.238 | 443 | 5192 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:08:50 UTC | 1325 | OUT | |
| 2024-10-01 13:08:50 UTC | 1243 | OUT | |
| 2024-10-01 13:08:50 UTC | 523 | IN | |
| 2024-10-01 13:08:50 UTC | 137 | IN | |
| 2024-10-01 13:08:50 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 25 | 192.168.2.6 | 49780 | 40.113.103.199 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 13:09:02 UTC | 71 | OUT | |
| 2024-10-01 13:09:02 UTC | 249 | OUT | |
| 2024-10-01 13:09:02 UTC | 1084 | OUT | |
| 2024-10-01 13:09:02 UTC | 218 | OUT | |
| 2024-10-01 13:09:02 UTC | 14 | IN | |
| 2024-10-01 13:09:02 UTC | 58 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 09:07:03 |
| Start date: | 01/10/2024 |
| Path: | C:\Users\user\Desktop\file.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1b0000 |
| File size: | 917'504 bytes |
| MD5 hash: | 28F4AA5264E452B3B6D44CE952D0B753 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 09:07:03 |
| Start date: | 01/10/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff684c40000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 5BBFA6CBDF4C254EB368D534F9E23C92 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 4 |
| Start time: | 09:07:04 |
| Start date: | 01/10/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff684c40000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 5BBFA6CBDF4C254EB368D534F9E23C92 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 6 |
| Start time: | 09:07:14 |
| Start date: | 01/10/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff684c40000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 5BBFA6CBDF4C254EB368D534F9E23C92 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 7 |
| Start time: | 09:07:15 |
| Start date: | 01/10/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff684c40000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 5BBFA6CBDF4C254EB368D534F9E23C92 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 1.9% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 7.3% |
| Total number of Nodes: | 1457 |
| Total number of Limit Nodes: | 44 |
Graph
Function 001B42DE Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 235libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001BBF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001BD730 Relevance: 21.6, APIs: 14, Instructions: 631windowsleeptimeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B344D Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 201registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001F065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B10F3 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 153comCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001DE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00249576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00244873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001CF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0022698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00229642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0022979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00228195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0022ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001EB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002322DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00229B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001C997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00241C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00218298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00225C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002251CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002116C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001DCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001BCAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002268EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002237B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002110BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001CB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001D09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001D781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00222046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E6DD9 Relevance: .6, Instructions: 637COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001CCC39 Relevance: .6, Instructions: 635COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B7920 Relevance: .6, Instructions: 563COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B91C0 Relevance: .5, Instructions: 475COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E9EEE Relevance: .3, Instructions: 294COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001D7A4A Relevance: .2, Instructions: 237COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001D7CA7 Relevance: .2, Instructions: 237COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00232ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002470D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00232711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00240FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00240241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001C8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0023C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0024091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0024833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0022FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0024911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00233FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00246CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0022C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002214BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0023B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0023255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00248D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0023CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00223D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00215CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001C8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001C9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002196E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002106DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00243F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00233C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00227A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0023055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0023372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00248B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021BC5E Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 137windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00243C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0022C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001ECE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002125A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021C5D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 191windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00243886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001CF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00242D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00215622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001F1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00221187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001C948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00242DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00217726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002177FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002204D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002205A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002440AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0022096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0020F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001C920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002207EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002481DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00214C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002114CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00248A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002151FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00207439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021C27D Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 114windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00243D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00242F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001D4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0020D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00222947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0023A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00218BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00228AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00246B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00223874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00245706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00230930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001ECDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001C9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00215711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002110F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00210FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0022030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001C95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00212716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00216E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0023304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00243EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00244653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002437B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002441EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00212F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00245882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0023342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00210436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00246278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001EB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002256D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002452C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00247674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002416DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00248FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00242782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002178F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00247CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00245660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001DD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00249EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001B600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00247E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00248863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001C98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0021162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0020D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0020D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00224D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001CF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0022D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00244537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002431EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0022CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00243429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00211D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00248172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00210B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00242322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00242356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|