Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1523556 |
| MD5: | 536a43d3de5f4acf818bb41029651839 |
| SHA1: | 1ded3dacb997d6977f47c7a8358b302658007a09 |
| SHA256: | 803c36cb6711cb22db01a4a3cb2ff7685ba82841e688d6aa703d0fc72e763cbb |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 72 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
file.exe (PID: 7328 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 536A43D3DE5F4ACF818BB41029651839) 
chrome.exe (PID: 7344 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ap p="https:/ /youtube.c om/account ?=https:// accounts.g oogle.com/ v3/signin/ challenge/ pwd" --sta rt-fullscr een --no-f irst-run - -disable-s ession-cra shed-bubbl e --disabl e-features =CrashReco very MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7564 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2076 --fi eld-trial- handle=205 2,i,108171 4923664627 6970,91078 7776874534 1469,26214 4 --disabl e-features =CrashReco very /pref etch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7216 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=54 00 --field -trial-han dle=2052,i ,108171492 3664627697 0,91078777 6874534146 9,262144 - -disable-f eatures=Cr ashRecover y /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 5480 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5228 --f ield-trial -handle=20 52,i,10817 1492366462 76970,9107 8777687453 41469,2621 44 --disab le-feature s=CrashRec overy /pre fetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0063DBBE | |
| Source: | Code function: | 0_2_006468EE | |
| Source: | Code function: | 0_2_0064698F | |
| Source: | Code function: | 0_2_0063D076 | |
| Source: | Code function: | 0_2_0063D3A9 | |
| Source: | Code function: | 0_2_00649642 | |
| Source: | Code function: | 0_2_0064979D | |
| Source: | Code function: | 0_2_00649B2B | |
| Source: | Code function: | 0_2_00645C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_0064CE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0064EAFF | |
| Source: | Code function: | 0_2_0064ED6A | |
| Source: | Code function: | 0_2_0064EAFF | |
| Source: | Code function: | 0_2_0063AA57 | |
| Source: | Code function: | 0_2_00669576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_62d67cd5-a | |
| Source: | String found in binary or memory: | memstr_d63b488e-5 | |
| Source: | String found in binary or memory: | memstr_1f983dc3-8 | |
| Source: | String found in binary or memory: | memstr_3df37007-b | |
| Source: | Code function: | 0_2_0063D5EB | |
| Source: | Code function: | 0_2_00631201 | |
| Source: | Code function: | 0_2_0063E8F6 | |
| Source: | Code function: | 0_2_005DBF40 | |
| Source: | Code function: | 0_2_00642046 | |
| Source: | Code function: | 0_2_005D8060 | |
| Source: | Code function: | 0_2_00638298 | |
| Source: | Code function: | 0_2_0060E4FF | |
| Source: | Code function: | 0_2_0060676B | |
| Source: | Code function: | 0_2_00664873 | |
| Source: | Code function: | 0_2_005DCAF0 | |
| Source: | Code function: | 0_2_005FCAA0 | |
| Source: | Code function: | 0_2_005ECC39 | |
| Source: | Code function: | 0_2_00606DD9 | |
| Source: | Code function: | 0_2_005EB119 | |
| Source: | Code function: | 0_2_005D91C0 | |
| Source: | Code function: | 0_2_005F1394 | |
| Source: | Code function: | 0_2_005F1706 | |
| Source: | Code function: | 0_2_005F781B | |
| Source: | Code function: | 0_2_005E997D | |
| Source: | Code function: | 0_2_005D7920 | |
| Source: | Code function: | 0_2_005F19B0 | |
| Source: | Code function: | 0_2_005F7A4A | |
| Source: | Code function: | 0_2_005F1C77 | |
| Source: | Code function: | 0_2_005F7CA7 | |
| Source: | Code function: | 0_2_0065BE44 | |
| Source: | Code function: | 0_2_00609EEE | |
| Source: | Code function: | 0_2_005F1F32 | |
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_006437B5 | |
| Source: | Code function: | 0_2_006310BF | |
| Source: | Code function: | 0_2_006316C3 | |
| Source: | Code function: | 0_2_006451CD | |
| Source: | Code function: | 0_2_0063D4DC | |
| Source: | Code function: | 0_2_0064648E | |
| Source: | Code function: | 0_2_005D42A2 | |
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_005D42DE | |
| Source: | Code function: | 0_2_005F0A89 | |
| Source: | Code function: | 0_2_005EF98E | |
| Source: | Code function: | 0_2_00661C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-94487 | ||
| Source: | API coverage: | ||
| Source: | Code function: | 0_2_0063DBBE | |
| Source: | Code function: | 0_2_006468EE | |
| Source: | Code function: | 0_2_0064698F | |
| Source: | Code function: | 0_2_0063D076 | |
| Source: | Code function: | 0_2_0063D3A9 | |
| Source: | Code function: | 0_2_00649642 | |
| Source: | Code function: | 0_2_0064979D | |
| Source: | Code function: | 0_2_00649B2B | |
| Source: | Code function: | 0_2_00645C97 | |
| Source: | Code function: | 0_2_005D42DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_0064EAA2 | |
| Source: | Code function: | 0_2_00602622 | |
| Source: | Code function: | 0_2_005D42DE | |
| Source: | Code function: | 0_2_005F4CE8 | |
| Source: | Code function: | 0_2_00630B62 | |
| Source: | Code function: | 0_2_00602622 | |
| Source: | Code function: | 0_2_005F083F | |
| Source: | Code function: | 0_2_005F09D5 | |
| Source: | Code function: | 0_2_005F0C21 | |
| Source: | Code function: | 0_2_00631201 | |
| Source: | Code function: | 0_2_00612BA5 | |
| Source: | Code function: | 0_2_0063B226 | |
| Source: | Code function: | 0_2_006522DA | |
| Source: | Code function: | 0_2_00630B62 | |
| Source: | Code function: | 0_2_00631663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_005F0698 | |
| Source: | Code function: | 0_2_00648195 | |
| Source: | Code function: | 0_2_0062D27A | |
| Source: | Code function: | 0_2_0060BB6F | |
| Source: | Code function: | 0_2_005D42DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 0_2_00651204 | |
| Source: | Code function: | 0_2_00651806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 15 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 2 Valid Accounts | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Virtualization/Sandbox Evasion | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 21 Access Token Manipulation | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 2 Process Injection | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 13% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.186.142 | true | false | unknown | |
| www3.l.google.com | 142.250.185.142 | true | false | unknown | |
| play.google.com | 142.250.185.110 | true | false | unknown | |
| www.google.com | 142.250.185.132 | true | false | unknown | |
| youtube.com | 142.250.185.142 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.184.196 | unknown | United States | 15169 | GOOGLEUS | false | |
| 172.217.18.14 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.132 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.110 | play.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.142 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.142 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.4 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1523556 |
| Start date and time: | 2024-10-01 18:50:08 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 33s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal72.troj.evad.winEXE@31/30@14/8 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.250.184.206, 64.233.167.84, 34.104.35.123, 172.217.16.131, 142.250.185.163, 142.250.186.106, 172.217.18.10, 216.58.206.42, 142.250.184.202, 142.250.181.234, 142.250.185.74, 172.217.16.202, 216.58.206.74, 142.250.186.138, 216.58.212.138, 142.250.186.42, 172.217.16.138, 216.58.212.170, 142.250.186.170, 142.250.74.202, 142.250.186.74, 142.250.184.234, 142.250.185.106, 142.250.185.170, 142.250.185.234, 142.250.185.202, 142.250.185.138, 199.232.214.172, 192.229.221.95, 142.250.185.67, 64.233.166.84, 142.250.186.78
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | PureLog Stealer | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | PureLog Stealer | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | EvilProxy, HTMLPhisher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | EvilProxy, HTMLPhisher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Captcha Phish | Browse |
|
⊘No context
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.3750044852869046 |
| Encrypted: | false |
| SSDEEP: | 48:o7zfN/cD498xdg+Y5jNQ8js6npwk0OmNAEZbpMzR4EQBcW5QcHj9KWfGAeFKRrw:oCD9dA5jOEGh+EFqR4rhqUhzff9w |
| MD5: | 39693D34EE3D1829DBB1627C4FC6687B |
| SHA1: | A03303C2F027F3749B48D5134D1F8FB3E495C6E9 |
| SHA-256: | 03B0C1B4E402E0BCF75D530DD9085B25357EEFD09E238453DE1F3A042542C076 |
| SHA-512: | AC0749EDC33DA0EC0E40470388DD797B6528AD08B8FAC1C2AC42F85198131052BA1B533E90409D35DA237607E8B07D591FA6BA580B6A90B0D0AB2282A01F7585 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.3872171131917925 |
| Encrypted: | false |
| SSDEEP: | 192:FK/pAzN7GZ068Hqhqu6DQaVapzYjgKItwdiwUsYRTi1j1t9bRl9:FqI7GZ04dRYjghtgisYYbt9ll9 |
| MD5: | AB70454DE18E1CE16E61EAC290FC304D |
| SHA1: | 68532B5E8B262D7E14B8F4507AA69A61146B3C18 |
| SHA-256: | B32D746867CC4FA21FD39437502F401D952D0A3E8DC708DFB7D58B85F256C0F1 |
| SHA-512: | A123C517380BEF0B47F23A5A6E1D16650FE39D9C701F9FA5ADD79294973C118E8EA3A7BA32CB63C3DFC0CE0F843FB86BFFCAA2AAE987629E7DFF84F176DEBB98 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 603951 |
| Entropy (8bit): | 5.789948199046733 |
| Encrypted: | false |
| SSDEEP: | 3072:H0pApkygA62bwwdnO2YflNYhFGOizdGj008PpVVM96C5bMEPQUhts6FV8eKqtVAT:HlgNmwwdnOsF98oNGuQRAYqXsI1+ |
| MD5: | 347C4D39594D38A3D6809E18ADD124A6 |
| SHA1: | DB975BC89E63D7A9942B1DFC5861D4EB13BFA78B |
| SHA-256: | B64E99E9CCC589D315F53868A2140154B16609A246D90BC4052CA5DA5B7BF6E1 |
| SHA-512: | 774F9F7EFDE53E8D884A06514039947E9D6399A8B0DA703FC290213D1832F9FB877C0D8B925B33A01AA85BCA203038A1D18E87991193DE349E90F5D4329D3CB8 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFOppGSZx8socZIrVC7cvQS0xsEZw/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5049 |
| Entropy (8bit): | 5.317800104741948 |
| Encrypted: | false |
| SSDEEP: | 96:oHX9gPiPrfnHhsB0TR6kg1oDPJzLmM18Vh1z2fEZ54TZtnqj6w:EtEAr6BmPZtOeEvW/ncP |
| MD5: | CE53EF566B68CCF2D62FA044CFB0D138 |
| SHA1: | F48EC60289F2B55E8B388601206888F8295B1EB1 |
| SHA-256: | E6CC5114D92811D5DE0663266D4B63F367834AFA0FC3BAFA54F707038C59D010 |
| SHA-512: | 20B434881DE971E263669E6096C01665D4D35B0FBFF47D312A4A442645EE962A8CE6AD7E68246D4EE9691BD30D9B1DDCF7059226492E1B58CD3191B63B001E4D |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32499 |
| Entropy (8bit): | 5.361345284201954 |
| Encrypted: | false |
| SSDEEP: | 768:mLX1O+aL6fgyIiREM4RKmh90toLoTswtF3ATcbDR6kIsnJd9DPyMv/FI:U2M4oltoLoTswtFoc/tIsnXFLI |
| MD5: | D5C3FB8EAE24AB7E40009338B5078496 |
| SHA1: | 5638BF5986A6445A88CD79A9B690B744B126BEC2 |
| SHA-256: | 597C14D360D690BCFDC2B8D315E6BB8879AEF33DE6C30D274743079BDB63C6B0 |
| SHA-512: | 6AE434850D473BEF15AA694AB4862596982CDDA6BD3991991D3ADD8F4A5F61DFBF8756D0DA98B72EF083909D68CF7B6B148A6488E9381F92FBF15CCB20176A0E |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4070 |
| Entropy (8bit): | 5.362700670482359 |
| Encrypted: | false |
| SSDEEP: | 96:GUpT+TmXtdW1qsHFcn7t7CnyWYvNTcLaQOw:lpT+qXW1PFcn7tGnyWY1TGb |
| MD5: | ED368A20CB303C0E7C6A3E6E43C2E14F |
| SHA1: | 429A5C538B45221F80405163D1F87912DD73C05A |
| SHA-256: | 93BA77AD4B11E0A70C0D36576F0DF24E27F50001EA02BAA6D357E034532D97F2 |
| SHA-512: | DE74BBADE910475DD245FFEFD4E1FD10137DE710B1C920D33BA52554911496E1339EF3C1F6D9D315CBC98A60ABE5687A3E7D8BEE483708E18D25722E794BDBE9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.280977407061266 |
| Encrypted: | false |
| SSDEEP: | 48:o7YNJvl3WlENrpB3stYCIgMxILNH/wf7DVTBpdQrw:oApB8iDwYlGw |
| MD5: | 4FB66582D37D04933F00E49C2FBA34D4 |
| SHA1: | 3DB09C53BBEB1EEB045A001356E498D8EF30915D |
| SHA-256: | A97DAC01ABFE3EB75C7C97D504E21BDDDADDB6EBE0B56B6A9A10CD3700CAB41B |
| SHA-512: | 2AEB3A6CFFBF6EFA626EBDC9E11ACBAC04BFE986F98FBC050B2501898B289C67D392ED195D16ACC9565EF8784401ADA1E88188CDE3A7AB12D98BB5ED7D8A5711 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.253939888205379 |
| Encrypted: | false |
| SSDEEP: | 48:o7BNJfeFb8L3A6FHqIy5Z+d70OCzSfvi/3fM/r8ZQzRrw:oFuILhFHrVCz0vLZz9w |
| MD5: | 10FF6F99E3228E96AFD6E2C30EF97C0A |
| SHA1: | 4AE3DCB8D1F5A0C302D5BAD9DFF5050A7A5E8130 |
| SHA-256: | 95E5546E1C7F311D07BB5050CC456A973E43BCC4777BA6014757376016537679 |
| SHA-512: | 116C0B1CAC98A27044100005545AB66BE5F4801D75DC259093A9F145B3A4ACD8DC1C360AF525F6DC8421CD54B675A78023D2ED8B57F5946A3969543758C673C9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22827 |
| Entropy (8bit): | 5.420322672717721 |
| Encrypted: | false |
| SSDEEP: | 384:/jqdWXWfyA20UUjDE8BSUxDJs16KHvSN34kaHaN+587SaXD2mLR0H:/jqdWXAUUjDE84Wi6KPSKjHaN+58+0J2 |
| MD5: | 2B29741A316862EE788996DD29116DD5 |
| SHA1: | 9D5551916D4452E977C39B8D69CF88DF2AAA462B |
| SHA-256: | 62955C853976B722EFBB4C116A10DB3FF54580EDD7495D280177550B8F4289AB |
| SHA-512: | 6E37C3258F07F29909763728DADE0CD40A3602D55D9099F78B37756926FCF2A50008B82876B518FEAF3E56617F0F7D1D37A73C346A99A58E6AD8BCD6689E9B15 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 697429 |
| Entropy (8bit): | 5.593310312179182 |
| Encrypted: | false |
| SSDEEP: | 6144:TYNlxfbDTYDhzCTNoygVWyJb5eGpbL2Mp15gI8seqfh53p+rrvV7i:T25bDTYB+qeGB+Nu |
| MD5: | 92F0F5E28355D863ACB77313F1E675DE |
| SHA1: | 8AD6F9B535D5B8952A4ADCCC57E4A4E0723F1E8D |
| SHA-256: | F903AE346609A2872554A3D8FFBDB1836CB5C8B7AAAED4C3F8296B887E03D833 |
| SHA-512: | 0C81A6CD850C6ACDBE9CCCBA00BBA34CDE1E09E8572814AE8E55DBED3C2B56F0B020359841F8217843B3403847DF46FA1C82229684F762A73C8110CE45898DAF |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3471 |
| Entropy (8bit): | 5.5174491302699495 |
| Encrypted: | false |
| SSDEEP: | 96:ojAmjTJ/fJgpIcB7Fd2tilGBEMO/A6VxV08w:vUTJpgDJXM0ApJ |
| MD5: | 2D999C87DD54C7FE6400D267C33FBB23 |
| SHA1: | 414C3A329C2760325EDBACBD7A221D7F8DBFEEE8 |
| SHA-256: | 76D55A1AFC1D39CB04D60EB04E45A538A0E75EE2871561C84CC89B1C13596BCC |
| SHA-512: | 72D923BB71DD147139962FF8E2BD0E336E0F6409C212AC2F25387D0F3B4FC9365F5A6D40E2980BB1065534888362C97D6B7663E362D29166B5915D2A9DA7D238 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.316515499943097 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DduJqrxsNL90YIzFK/Hb5eNhz1uktdDuvKKKGbLZ99GbSSF/ZR8OkdnprGJ:o7DQJopFN+ASCKKGbF99GbSS3RY7rw |
| MD5: | D97AB4594FC610665FF2763A650EE6A8 |
| SHA1: | 5C7459CA838D27BE45745571D8D96D156F4B9F8D |
| SHA-256: | 767D778369623FD8F5FB98D3BCC3130D05D02CBE0B9B88DD226F43281B14E9AF |
| SHA-512: | CE4941B41C3A8CC983C1BBCC87EF682823CB9DB24EA7A570E35BBF832046340D433F7D47211384B61FA38F3527CC35C195A6068CCB24B48E1F492C5B4D4192A1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBi2UQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlE_AKDvSw5nLjp568Wqpy45S7OTYg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.5797684864265795 |
| TrID: |
|
| File name: | file.exe |
| File size: | 917'504 bytes |
| MD5: | 536a43d3de5f4acf818bb41029651839 |
| SHA1: | 1ded3dacb997d6977f47c7a8358b302658007a09 |
| SHA256: | 803c36cb6711cb22db01a4a3cb2ff7685ba82841e688d6aa703d0fc72e763cbb |
| SHA512: | f4ef677f5bc042ec4410cc8a3ebf48f9e6e63b68fc94bd53028e5bc5b84a7949466ea48d9fdd58906f811e13d77eb2b6a2a8ef25767998e26a8e59611fe0f7c6 |
| SSDEEP: | 12288:YqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagTn:YqDEvCTbMWu7rQYlBQcBiT6rprG8a4n |
| TLSH: | 45159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FC2706 [Tue Oct 1 16:44:54 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007FA6B8F4F1E3h |
| jmp 00007FA6B8F4EAEFh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FA6B8F4ECCDh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FA6B8F4EC9Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007FA6B8F5188Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007FA6B8F518D8h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007FA6B8F518C1h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x95ac | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x95ac | 0x9600 | 46a2063796f7593204e016fd7c3a1a5f | False | 0.286015625 | data | 5.164194835659661 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0x874 | data | 1.005083179297597 | ||
| RT_GROUP_ICON | 0xdd02c | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd0a4 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd0b8 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd0cc | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd0e0 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd1bc | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 18:50:53.671353102 CEST | 49675 | 443 | 192.168.2.4 | 173.222.162.32 |
| Oct 1, 2024 18:50:59.731123924 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:50:59.731156111 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:50:59.731214046 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:50:59.733098030 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:50:59.733112097 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.448235035 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.459934950 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:00.459945917 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.460484028 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.460546970 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:00.461082935 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.461131096 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:00.466578960 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:00.466639996 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.467147112 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:00.467154026 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.513729095 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:00.770509958 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.778713942 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.778768063 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:00.779166937 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:00.779179096 CEST | 443 | 49732 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.790359020 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:00.790412903 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.790476084 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:00.790723085 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:00.790755033 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.436279058 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.436830997 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:01.436881065 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.437326908 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.437390089 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:01.438054085 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.438106060 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:01.441107035 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:01.441174030 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.441323996 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:01.441339970 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.483102083 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:01.754308939 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.754323959 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.754410982 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:01.754460096 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.754686117 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.754883051 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:01.756517887 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:01.756550074 CEST | 443 | 49736 | 142.250.186.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:01.756571054 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:01.757286072 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.142 |
| Oct 1, 2024 18:51:03.280317068 CEST | 49675 | 443 | 192.168.2.4 | 173.222.162.32 |
| Oct 1, 2024 18:51:04.087033033 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:04.087089062 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.087174892 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:04.087377071 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:04.087424040 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.137927055 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:04.137948990 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.138016939 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:04.139468908 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:04.139481068 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.760359049 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.760556936 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:04.760592937 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.761493921 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.761552095 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:04.762502909 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:04.762572050 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.810405016 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:04.810426950 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.811789989 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.811856985 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:04.815788031 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:04.815794945 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.816219091 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.857270002 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:04.857274055 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:04.869350910 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:04.915410995 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:05.098073006 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:05.098191023 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:05.098236084 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:05.279567003 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:05.279581070 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:05.279589891 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:05.279596090 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:05.393233061 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:05.393285036 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:05.393369913 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:05.393801928 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:05.393834114 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:06.045245886 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:06.045300961 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:06.046834946 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:06.046844006 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:06.047049999 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:06.048291922 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:06.095411062 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:06.326092958 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:06.326206923 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:06.326283932 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:06.327220917 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:06.327220917 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 1, 2024 18:51:06.327260971 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:06.327272892 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 1, 2024 18:51:08.871201038 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:08.871226072 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:08.871331930 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:08.871527910 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:08.871537924 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.615566015 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.615788937 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.615799904 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.616343975 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.616398096 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.617362022 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.617408991 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.618278980 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.618350983 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.618640900 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.618648052 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.671622038 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.938677073 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.938739061 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.938790083 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.938806057 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.938817024 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.938855886 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.944679976 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.944739103 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.950766087 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.950805902 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.950822115 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.950829029 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.950850964 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.958214998 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.958285093 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.958290100 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.963287115 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.963332891 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.963342905 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.963347912 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.963402033 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:09.966454029 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:09.966494083 CEST | 443 | 49760 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.966574907 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:09.969072104 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:09.969089031 CEST | 443 | 49760 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.027138948 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.027185917 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.027331114 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.027338982 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.027348995 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.027389050 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.027393103 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.027434111 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.033549070 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.033631086 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.034009933 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.034060001 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.039941072 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.040018082 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.045996904 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.046061993 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.046066999 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.052476883 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.052542925 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.052547932 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.058789968 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.058841944 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.058846951 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.058944941 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.058990955 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.127779007 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 1, 2024 18:51:10.127787113 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.152903080 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.152915001 CEST | 443 | 49761 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.153007984 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.153465033 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.153475046 CEST | 443 | 49761 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.599621058 CEST | 443 | 49760 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.599839926 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.599860907 CEST | 443 | 49760 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.600260019 CEST | 443 | 49760 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.600318909 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.600851059 CEST | 443 | 49760 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.600902081 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.601763010 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.601818085 CEST | 443 | 49760 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.602000952 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.602010965 CEST | 443 | 49760 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.655464888 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.810412884 CEST | 443 | 49761 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.810925007 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.810935974 CEST | 443 | 49761 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.811512947 CEST | 443 | 49761 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.811569929 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.812537909 CEST | 443 | 49761 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.812597036 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.812721968 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.812796116 CEST | 443 | 49761 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.812943935 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.812949896 CEST | 443 | 49761 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.855953932 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.901110888 CEST | 443 | 49760 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.901591063 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.901628017 CEST | 443 | 49760 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.901690006 CEST | 49760 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.902343035 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.902386904 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:10.902451992 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.902709007 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:10.902725935 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.115098000 CEST | 443 | 49761 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.115631104 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.115668058 CEST | 443 | 49761 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.115725994 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.116588116 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.116612911 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.116683006 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.117067099 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.117079973 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.552160025 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.552345037 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.552371025 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.552755117 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.552817106 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.553354025 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.553407907 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.553498983 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.553559065 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.553617001 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.553627968 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.553643942 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.594125032 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.594132900 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.797128916 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.797826052 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.797878027 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.798713923 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.798732042 CEST | 443 | 49764 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.844130993 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.844355106 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.844364882 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.844863892 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.844928026 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.845854044 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.845916986 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.846081972 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.846157074 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.846298933 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.846304893 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.846321106 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:11.887408018 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.887981892 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:12.061125994 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:12.063575983 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:12.063642025 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:12.064305067 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:12.064311981 CEST | 443 | 49765 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:12.815614939 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:12.863401890 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:13.085323095 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:13.085381031 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:13.085414886 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:13.085441113 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:13.085465908 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:13.085480928 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:13.085510969 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:13.085561037 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:13.085612059 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:13.086429119 CEST | 49741 | 443 | 192.168.2.4 | 142.250.185.132 |
| Oct 1, 2024 18:51:13.086437941 CEST | 443 | 49741 | 142.250.185.132 | 192.168.2.4 |
| Oct 1, 2024 18:51:15.898351908 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:15.898379087 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:15.898509026 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:15.899379969 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:15.899394035 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:16.745454073 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:16.745524883 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:16.749229908 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:16.749239922 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:16.749454975 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:16.795850039 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:17.479187012 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:17.523403883 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.751585007 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.751615047 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.751625061 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.751646042 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.751698017 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.751714945 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:17.751714945 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:17.751739025 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.751751900 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.751794100 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:17.751801014 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.751831055 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:17.751990080 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:17.753026962 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.753061056 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.754266977 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:17.878158092 CEST | 49777 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:17.878180027 CEST | 443 | 49777 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.878257990 CEST | 49777 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:17.878567934 CEST | 49777 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:17.878578901 CEST | 443 | 49777 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:18.392251968 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:18.392270088 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:18.392281055 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:18.392287016 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:18.552186012 CEST | 443 | 49777 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:18.552423954 CEST | 49777 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:18.552442074 CEST | 443 | 49777 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:18.552815914 CEST | 443 | 49777 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:18.553210020 CEST | 49777 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:18.553289890 CEST | 443 | 49777 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:18.553399086 CEST | 49777 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:18.553415060 CEST | 49777 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:18.553426981 CEST | 443 | 49777 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:18.893569946 CEST | 443 | 49777 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:18.894679070 CEST | 443 | 49777 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:18.894747019 CEST | 49777 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:18.895515919 CEST | 49777 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:18.895529032 CEST | 443 | 49777 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:21.403862000 CEST | 80 | 49723 | 84.201.210.20 | 192.168.2.4 |
| Oct 1, 2024 18:51:21.403999090 CEST | 49723 | 80 | 192.168.2.4 | 84.201.210.20 |
| Oct 1, 2024 18:51:21.404031038 CEST | 49723 | 80 | 192.168.2.4 | 84.201.210.20 |
| Oct 1, 2024 18:51:21.405420065 CEST | 80 | 49723 | 84.201.210.20 | 192.168.2.4 |
| Oct 1, 2024 18:51:21.405473948 CEST | 49723 | 80 | 192.168.2.4 | 84.201.210.20 |
| Oct 1, 2024 18:51:21.405530930 CEST | 80 | 49723 | 84.201.210.20 | 192.168.2.4 |
| Oct 1, 2024 18:51:21.405575037 CEST | 49723 | 80 | 192.168.2.4 | 84.201.210.20 |
| Oct 1, 2024 18:51:21.410258055 CEST | 80 | 49723 | 84.201.210.20 | 192.168.2.4 |
| Oct 1, 2024 18:51:41.657519102 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:41.657551050 CEST | 443 | 49781 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:41.657607079 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:41.657902002 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:41.657915115 CEST | 443 | 49781 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:41.703526974 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:41.703540087 CEST | 443 | 49782 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:41.703588963 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:41.703898907 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:41.703907967 CEST | 443 | 49782 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:41.797274113 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:41.797307014 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:41.797380924 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:41.797652006 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:41.797666073 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.340163946 CEST | 443 | 49781 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.340390921 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.340405941 CEST | 443 | 49781 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.340712070 CEST | 443 | 49781 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.341265917 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.341319084 CEST | 443 | 49781 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.341434956 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.341455936 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.341466904 CEST | 443 | 49781 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.428396940 CEST | 443 | 49782 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.428654909 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.428664923 CEST | 443 | 49782 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.429012060 CEST | 443 | 49782 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.429328918 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.429387093 CEST | 443 | 49782 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.429528952 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.429548979 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.429557085 CEST | 443 | 49782 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.494133949 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.494421959 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.494432926 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.494738102 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.494795084 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.495342970 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.495408058 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.495512962 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.495563984 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.495651007 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.495657921 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.495671988 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.543399096 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.549313068 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.641371012 CEST | 443 | 49781 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.642462015 CEST | 443 | 49781 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.642545938 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.642999887 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.643018961 CEST | 443 | 49781 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.711189985 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.711767912 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.711850882 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.712650061 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.712656975 CEST | 443 | 49783 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.734560013 CEST | 443 | 49782 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.755464077 CEST | 443 | 49782 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:42.755568027 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.755939960 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.110 |
| Oct 1, 2024 18:51:42.755945921 CEST | 443 | 49782 | 142.250.185.110 | 192.168.2.4 |
| Oct 1, 2024 18:51:54.845752954 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:54.845783949 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:54.845865965 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:54.846187115 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:54.846205950 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:55.907588005 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:55.907668114 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:55.912286997 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:55.912297964 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:55.912519932 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:55.923934937 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:55.967431068 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:56.249121904 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:56.249145031 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:56.249185085 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:56.249248028 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:56.249258995 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:56.249310970 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:56.251049995 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:56.251084089 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:56.251117945 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:56.251121044 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:56.251174927 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:56.255234957 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:56.255244017 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:51:56.255264044 CEST | 49784 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 1, 2024 18:51:56.255269051 CEST | 443 | 49784 | 4.175.87.197 | 192.168.2.4 |
| Oct 1, 2024 18:52:04.137825012 CEST | 49786 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:52:04.137878895 CEST | 443 | 49786 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:52:04.137964010 CEST | 49786 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:52:04.138163090 CEST | 49786 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:52:04.138180017 CEST | 443 | 49786 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:52:04.794573069 CEST | 443 | 49786 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:52:04.794857979 CEST | 49786 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:52:04.794915915 CEST | 443 | 49786 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:52:04.795212984 CEST | 443 | 49786 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:52:04.795492887 CEST | 49786 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:52:04.795564890 CEST | 443 | 49786 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:52:04.841893911 CEST | 49786 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:52:09.906107903 CEST | 49724 | 80 | 192.168.2.4 | 88.221.110.91 |
| Oct 1, 2024 18:52:09.911500931 CEST | 80 | 49724 | 88.221.110.91 | 192.168.2.4 |
| Oct 1, 2024 18:52:09.911588907 CEST | 49724 | 80 | 192.168.2.4 | 88.221.110.91 |
| Oct 1, 2024 18:52:12.433296919 CEST | 49788 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:12.433319092 CEST | 443 | 49788 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:12.433377981 CEST | 49788 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:12.433600903 CEST | 49788 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:12.433614969 CEST | 443 | 49788 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:12.486236095 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:12.486269951 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:12.486408949 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:12.486555099 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:12.486567020 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.077394009 CEST | 443 | 49788 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.077997923 CEST | 49788 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.078008890 CEST | 443 | 49788 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.078326941 CEST | 443 | 49788 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.078576088 CEST | 49788 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.078634024 CEST | 443 | 49788 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.079375029 CEST | 49788 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.079395056 CEST | 49788 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.079411983 CEST | 443 | 49788 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.141383886 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.141587973 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.141611099 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.141922951 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.142185926 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.142254114 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.142330885 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.142330885 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.142359972 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.389229059 CEST | 443 | 49788 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.389353037 CEST | 443 | 49788 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.389425993 CEST | 49788 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.391087055 CEST | 49788 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.391093969 CEST | 443 | 49788 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.446094036 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.446192980 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:13.446244955 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.446743965 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:13.446763992 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:14.687886953 CEST | 443 | 49786 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:52:14.687939882 CEST | 443 | 49786 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:52:14.687993050 CEST | 49786 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:52:28.601685047 CEST | 49786 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:52:28.601723909 CEST | 443 | 49786 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:52:43.082782030 CEST | 49791 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:43.082814932 CEST | 443 | 49791 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:43.082886934 CEST | 49791 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:43.084598064 CEST | 49791 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:43.084611893 CEST | 443 | 49791 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:43.453984976 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:43.454088926 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:43.454189062 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:43.454395056 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:43.454432964 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:43.731369019 CEST | 443 | 49791 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:43.731746912 CEST | 49791 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:43.731759071 CEST | 443 | 49791 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:43.732074022 CEST | 443 | 49791 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:43.733095884 CEST | 49791 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:43.733148098 CEST | 443 | 49791 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:43.733349085 CEST | 49791 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:43.733417988 CEST | 49791 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:43.733427048 CEST | 443 | 49791 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.050492048 CEST | 443 | 49791 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.052309036 CEST | 443 | 49791 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.052376032 CEST | 49791 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:44.052469015 CEST | 49791 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:44.052479029 CEST | 443 | 49791 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.106093884 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.106327057 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:44.106364012 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.106745958 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.107053995 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:44.107129097 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.107192993 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:44.107229948 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:44.107242107 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.404438972 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.404861927 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:52:44.405025959 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:44.405320883 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 1, 2024 18:52:44.405349016 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 1, 2024 18:53:04.189055920 CEST | 49793 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:53:04.189095974 CEST | 443 | 49793 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:53:04.189219952 CEST | 49793 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:53:04.189749956 CEST | 49793 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:53:04.189765930 CEST | 443 | 49793 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:53:04.818454027 CEST | 443 | 49793 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:53:04.818797112 CEST | 49793 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:53:04.818818092 CEST | 443 | 49793 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:53:04.819274902 CEST | 443 | 49793 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:53:04.819577932 CEST | 49793 | 443 | 192.168.2.4 | 142.250.184.196 |
| Oct 1, 2024 18:53:04.819657087 CEST | 443 | 49793 | 142.250.184.196 | 192.168.2.4 |
| Oct 1, 2024 18:53:04.874233007 CEST | 49793 | 443 | 192.168.2.4 | 142.250.184.196 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 1, 2024 18:50:59.603235960 CEST | 51918 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:50:59.603801966 CEST | 57129 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:50:59.610090971 CEST | 53 | 51918 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:50:59.610377073 CEST | 53 | 63555 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:50:59.610573053 CEST | 53 | 57129 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:50:59.614265919 CEST | 53 | 64103 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.748763084 CEST | 53 | 51777 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.781246901 CEST | 49394 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:51:00.781512976 CEST | 64870 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:51:00.789812088 CEST | 53 | 49394 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:00.789844036 CEST | 53 | 64870 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.077931881 CEST | 65205 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:51:04.078058004 CEST | 53918 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:51:04.086230040 CEST | 53 | 65205 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:04.086267948 CEST | 53 | 53918 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:06.182300091 CEST | 53 | 52824 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:08.859554052 CEST | 53463 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:51:08.860006094 CEST | 55367 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:51:08.866832972 CEST | 53 | 53463 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:08.867173910 CEST | 53 | 55367 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.937155962 CEST | 49580 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:51:09.937220097 CEST | 57803 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:51:09.944446087 CEST | 53 | 49580 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:09.945368052 CEST | 53 | 57803 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:11.930318117 CEST | 53 | 59548 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:17.739949942 CEST | 53 | 57582 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:21.494529009 CEST | 138 | 138 | 192.168.2.4 | 192.168.2.255 |
| Oct 1, 2024 18:51:36.569485903 CEST | 53 | 51846 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:59.085469007 CEST | 53 | 50180 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:51:59.468761921 CEST | 53 | 53372 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:52:04.129045010 CEST | 51335 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:52:04.129180908 CEST | 64762 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:52:04.135938883 CEST | 53 | 51335 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:52:04.137258053 CEST | 53 | 64762 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:52:10.900902987 CEST | 53 | 50422 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:52:12.424360037 CEST | 57509 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:52:12.424484968 CEST | 58530 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 1, 2024 18:52:12.432135105 CEST | 53 | 57509 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:52:12.432969093 CEST | 53 | 58530 | 1.1.1.1 | 192.168.2.4 |
| Oct 1, 2024 18:52:28.610153913 CEST | 53 | 55026 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 18:50:59.603235960 CEST | 192.168.2.4 | 1.1.1.1 | 0xc031 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 18:50:59.603801966 CEST | 192.168.2.4 | 1.1.1.1 | 0xe588 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 18:51:00.781246901 CEST | 192.168.2.4 | 1.1.1.1 | 0x6c92 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 18:51:00.781512976 CEST | 192.168.2.4 | 1.1.1.1 | 0x8fb | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 18:51:04.077931881 CEST | 192.168.2.4 | 1.1.1.1 | 0xcca9 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 18:51:04.078058004 CEST | 192.168.2.4 | 1.1.1.1 | 0xe466 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 18:51:08.859554052 CEST | 192.168.2.4 | 1.1.1.1 | 0x6a5f | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 18:51:08.860006094 CEST | 192.168.2.4 | 1.1.1.1 | 0x79f3 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 18:51:09.937155962 CEST | 192.168.2.4 | 1.1.1.1 | 0x5399 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 18:51:09.937220097 CEST | 192.168.2.4 | 1.1.1.1 | 0xc855 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 18:52:04.129045010 CEST | 192.168.2.4 | 1.1.1.1 | 0xd03c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 18:52:04.129180908 CEST | 192.168.2.4 | 1.1.1.1 | 0xc49b | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 1, 2024 18:52:12.424360037 CEST | 192.168.2.4 | 1.1.1.1 | 0x8fa4 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 1, 2024 18:52:12.424484968 CEST | 192.168.2.4 | 1.1.1.1 | 0xcdca | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 1, 2024 18:50:59.610090971 CEST | 1.1.1.1 | 192.168.2.4 | 0xc031 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:50:59.610573053 CEST | 1.1.1.1 | 192.168.2.4 | 0xe588 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 172.217.18.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789812088 CEST | 1.1.1.1 | 192.168.2.4 | 0x6c92 | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789844036 CEST | 1.1.1.1 | 192.168.2.4 | 0x8fb | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:00.789844036 CEST | 1.1.1.1 | 192.168.2.4 | 0x8fb | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 18:51:04.086230040 CEST | 1.1.1.1 | 192.168.2.4 | 0xcca9 | No error (0) | 142.250.185.132 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:04.086267948 CEST | 1.1.1.1 | 192.168.2.4 | 0xe466 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 18:51:08.866832972 CEST | 1.1.1.1 | 192.168.2.4 | 0x6a5f | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:08.866832972 CEST | 1.1.1.1 | 192.168.2.4 | 0x6a5f | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:08.867173910 CEST | 1.1.1.1 | 192.168.2.4 | 0x79f3 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 1, 2024 18:51:09.944446087 CEST | 1.1.1.1 | 192.168.2.4 | 0x5399 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:52:04.135938883 CEST | 1.1.1.1 | 192.168.2.4 | 0xd03c | No error (0) | 142.250.184.196 | A (IP address) | IN (0x0001) | false | ||
| Oct 1, 2024 18:52:04.137258053 CEST | 1.1.1.1 | 192.168.2.4 | 0xc49b | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 1, 2024 18:52:12.432135105 CEST | 1.1.1.1 | 192.168.2.4 | 0x8fa4 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49732 | 142.250.185.142 | 443 | 7564 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 16:51:00 UTC | 851 | OUT | |
| 2024-10-01 16:51:00 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49736 | 142.250.186.142 | 443 | 7564 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-01 16:51:01 UTC | 869 | OUT | |
| 2024-10-01 16:51:01 UTC | 2634 | IN |