Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1524237 |
| MD5: | 1bf42b89a7e2436161c26089f29a0652 |
| SHA1: | 196af2e64f23aea23fc728955864280a2150c02d |
| SHA256: | 9ecce840839e193265eff13feb177e00794c9df0c0a58c92ea6c31affc728fe3 |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 76 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Classification
- System is w10x64
file.exe (PID: 7776 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 1BF42B89A7E2436161C26089F29A0652) 
chrome.exe (PID: 7792 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ap p="https:/ /youtube.c om/account ?=https:// accounts.g oogle.com/ v3/signin/ challenge/ pwd" --no- first-run --disable- session-cr ashed-bubb le --disab le-feature s=WelcomeP age,CrashR ecovery -- start-full screen --d isable-pop up-blockin g MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - chrome.exe (PID: 8036 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2016 --fi eld-trial- handle=193 6,i,233841 6857820957 988,184190 4883852242 2849,26214 4 --disabl e-features =CrashReco very,Welco mePage /pr efetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - chrome.exe (PID: 1280 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=54 16 --field -trial-han dle=1936,i ,233841685 7820957988 ,184190488 3852242284 9,262144 - -disable-f eatures=Cr ashRecover y,WelcomeP age /prefe tch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - chrome.exe (PID: 3308 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5700 --f ield-trial -handle=19 36,i,23384 1685782095 7988,18419 0488385224 22849,2621 44 --disab le-feature s=CrashRec overy,Welc omePage /p refetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0039DBBE | |
| Source: | Code function: | 0_2_0036C2A2 | |
| Source: | Code function: | 0_2_003A68EE | |
| Source: | Code function: | 0_2_003A698F | |
| Source: | Code function: | 0_2_0039D076 | |
| Source: | Code function: | 0_2_0039D3A9 | |
| Source: | Code function: | 0_2_003A9642 | |
| Source: | Code function: | 0_2_003A979D | |
| Source: | Code function: | 0_2_003A9B2B | |
| Source: | Code function: | 0_2_003A5C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_003ACE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_003AEAFF | |
| Source: | Code function: | 0_2_003AED6A | |
| Source: | Code function: | 0_2_003AEAFF | |
| Source: | Code function: | 0_2_0039AA57 | |
| Source: | Code function: | 0_2_003C9576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_06e2d599-0 | |
| Source: | String found in binary or memory: | memstr_a5d1e81d-8 | |
| Source: | String found in binary or memory: | memstr_b467c3ae-6 | |
| Source: | String found in binary or memory: | memstr_97c1c06e-3 | |
| Source: | Code function: | 0_2_0039D5EB | |
| Source: | Code function: | 0_2_00391201 | |
| Source: | Code function: | 0_2_0039E8F6 | |
| Source: | Code function: | 0_2_0033BF40 | |
| Source: | Code function: | 0_2_00338060 | |
| Source: | Code function: | 0_2_003A2046 | |
| Source: | Code function: | 0_2_00398298 | |
| Source: | Code function: | 0_2_0036E4FF | |
| Source: | Code function: | 0_2_0036676B | |
| Source: | Code function: | 0_2_003C4873 | |
| Source: | Code function: | 0_2_0035CAA0 | |
| Source: | Code function: | 0_2_0033CAF0 | |
| Source: | Code function: | 0_2_0034CC39 | |
| Source: | Code function: | 0_2_00366DD9 | |
| Source: | Code function: | 0_2_0034B119 | |
| Source: | Code function: | 0_2_003391C0 | |
| Source: | Code function: | 0_2_00351394 | |
| Source: | Code function: | 0_2_00351706 | |
| Source: | Code function: | 0_2_0035781B | |
| Source: | Code function: | 0_2_00337920 | |
| Source: | Code function: | 0_2_0034997D | |
| Source: | Code function: | 0_2_003519B0 | |
| Source: | Code function: | 0_2_00357A4A | |
| Source: | Code function: | 0_2_00351C77 | |
| Source: | Code function: | 0_2_00357CA7 | |
| Source: | Code function: | 0_2_003BBE44 | |
| Source: | Code function: | 0_2_00369EEE | |
| Source: | Code function: | 0_2_00351F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_003A37B5 | |
| Source: | Code function: | 0_2_003910BF | |
| Source: | Code function: | 0_2_003916C3 | |
| Source: | Code function: | 0_2_003A51CD | |
| Source: | Code function: | 0_2_0039D4DC | |
| Source: | Code function: | 0_2_003A648E | |
| Source: | Code function: | 0_2_003342A2 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_003342DE | |
| Source: | Code function: | 0_2_00350A89 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_0034F98E | |
| Source: | Code function: | 0_2_003C1C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-96937 | ||
| Source: | API coverage: | ||
| Source: | Code function: | 0_2_0039DBBE | |
| Source: | Code function: | 0_2_0036C2A2 | |
| Source: | Code function: | 0_2_003A68EE | |
| Source: | Code function: | 0_2_003A698F | |
| Source: | Code function: | 0_2_0039D076 | |
| Source: | Code function: | 0_2_0039D3A9 | |
| Source: | Code function: | 0_2_003A9642 | |
| Source: | Code function: | 0_2_003A979D | |
| Source: | Code function: | 0_2_003A9B2B | |
| Source: | Code function: | 0_2_003A5C97 | |
| Source: | Code function: | 0_2_003342DE | |
| Source: | Process information queried: | Jump to behavior | ||
Anti Debugging | |
|---|
| Source: | Debugger detection routine: | graph_0-96969 | ||
| Source: | Code function: | 0_2_003AEAA2 | |
| Source: | Code function: | 0_2_00362622 | |
| Source: | Code function: | 0_2_003342DE | |
| Source: | Code function: | 0_2_00354CE8 | |
| Source: | Code function: | 0_2_00390B62 | |
| Source: | Code function: | 0_2_00362622 | |
| Source: | Code function: | 0_2_0035083F | |
| Source: | Code function: | 0_2_003509D5 | |
| Source: | Code function: | 0_2_00350C21 | |
| Source: | Code function: | 0_2_00391201 | |
| Source: | Code function: | 0_2_00372BA5 | |
| Source: | Code function: | 0_2_0039B226 | |
| Source: | Code function: | 0_2_003B22DA | |
| Source: | Code function: | 0_2_00390B62 | |
| Source: | Code function: | 0_2_00391663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00350698 | |
| Source: | Code function: | 0_2_003A8195 | |
| Source: | Code function: | 0_2_0038D27A | |
| Source: | Code function: | 0_2_0036B952 | |
| Source: | Code function: | 0_2_003342DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 0_2_003B1204 | |
| Source: | Code function: | 0_2_003B1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 15 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 1 Masquerading | LSA Secrets | 22 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | Cached Domain Credentials | 2 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 2 Virtualization/Sandbox Evasion | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 21 Access Token Manipulation | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 2 Process Injection | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 16% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.186.174 | true | false | unknown | |
| www3.l.google.com | 142.250.185.238 | true | false | unknown | |
| play.google.com | 172.217.18.14 | true | false | unknown | |
| www.google.com | 142.250.184.228 | true | false | unknown | |
| youtube.com | 172.217.16.206 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.186.174 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.18.14 | play.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.238 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.186.142 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.250.184.228 | www.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.11 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1524237 |
| Start date and time: | 2024-10-02 17:19:27 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 7s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 13 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal76.troj.evad.winEXE@33/38@12/7 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.186.163, 172.217.16.206, 64.233.167.84, 34.104.35.123, 172.217.18.99, 142.250.184.195, 142.250.186.138, 142.250.184.202, 172.217.16.202, 142.250.185.138, 142.250.185.202, 216.58.206.74, 142.250.186.74, 172.217.18.10, 172.217.18.106, 142.250.185.170, 142.250.184.234, 142.250.185.74, 142.250.185.106, 142.250.186.106, 172.217.23.106, 142.250.185.234, 142.250.181.234, 142.250.186.170, 217.20.57.19, 192.229.221.95, 142.250.185.67, 64.233.184.84
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | HTMLPhisher | Browse | ||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Babadeda | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 1138de370e523e824bbca92d049a3777 | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Babadeda | Browse |
| ||
| Get hash | malicious | Babadeda | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Babadeda | Browse |
| ||
| Get hash | malicious | Babadeda | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
|
⊘No context
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2675 |
| Entropy (8bit): | 3.9836057513065373 |
| Encrypted: | false |
| SSDEEP: | 48:80yda2TUdmggZHhidAKZdA1nehwiZUklqehHy+3:80okg3oy |
| MD5: | D0DF3A58A7559DF23210CED8CE9433EE |
| SHA1: | B9B89A2E8B25178CCE666EE051DF3B639901A0E3 |
| SHA-256: | AE7E1BE972E9F5B478CC354CFCE9506A1089009F87B379351C601789564EF37A |
| SHA-512: | 08DBF975652EDFD2B70FD43DB72D4D2F19FFDF9AE66980CAD0BF1E57BFFEDD74D59185599C73CB42754A76CAE9931A7D4BA36C0A8CD6D9EA5525F8AADEB814DB |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 4.00346521930635 |
| Encrypted: | false |
| SSDEEP: | 48:8ckyda2TUdmggZHhidAKZdA1geh/iZUkAQkqehYy+2:8ckokgz9Qdy |
| MD5: | D88A7CF89F551FD18DE621B32536F484 |
| SHA1: | D873D0E06D9FE0479D78CFC3512F98BC621285AB |
| SHA-256: | 1E35B310C84E42B0927424201A6F7FE11D40081D26DC2BB5A52344D7B8451E5A |
| SHA-512: | 4A8224E56AB2095A56DFE3BE56EDFD81722A39681C0460C20EA929EAC42FA522C8835567041B87FCE166A857C98454A9848672A9E458591D5EDA709D700617E1 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2691 |
| Entropy (8bit): | 4.00846026478267 |
| Encrypted: | false |
| SSDEEP: | 48:87yda2TUdmgCHhidAKZdA148eh7sFiZUkmgqeh7s2y+BX:87ok0nky |
| MD5: | DE93C04CB45DECFC52D23AD8125489EE |
| SHA1: | DF430431B8A87A8E1352FEF7E3CBCB9E076EC632 |
| SHA-256: | 6F62CC60ED51E68C1FB273B27EF2E10317A3F37B7B9EC253182AE614F2A2B47B |
| SHA-512: | 2D0D7F07E695E56C439F36406BED4AC968D8C98070DF5137557CB8761775311ABBF3B01BB0DD3FC153F1CCEEBD8744962921AEB8050CB44B3ADBC3907A1DBA05 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9984408545902257 |
| Encrypted: | false |
| SSDEEP: | 48:8Xyda2TUdmggZHhidAKZdA1lehDiZUkwqehcy+R:8Xokguuy |
| MD5: | CB8D1094BC494A7AB76B75F144C18A72 |
| SHA1: | 9E9513081C64A25CEB9940AA5C1BC40AEC66DEE9 |
| SHA-256: | 086B738FC59C44A696B8AE1C6A93A9B5BFC571988C91FC7B953CE81B4448BF17 |
| SHA-512: | F47DE3EB6F4BF778E8EC029FC356D3A12B8FBAF7EF9BA45C192F5F6DFD20171B1B3868D65F7694706F29D1186F394C5118B05E3A14B721655DD8FB9C6E6EBA12 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9884220196490343 |
| Encrypted: | false |
| SSDEEP: | 48:8Ayda2TUdmggZHhidAKZdA17ehBiZUk1W1qehyy+C:8Aokgu9Sy |
| MD5: | BC1AF42FC1A3E19F58E319462B42169F |
| SHA1: | 2161EF04DB0D5DE85C052F57DD3933D890E5260B |
| SHA-256: | 954EE431D56108E6ED2EBF9C2F4D8A85B3235A82B34B491A3035B94DB0A27B4E |
| SHA-512: | B01744C161C5CC36648AFC0D9FA8767FC6022039E116B6A1AAC1779BD3E22F40705DC728124434B2E6CBE985AF25616E8CAFE5D357C357099EAE7B8486B253DA |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9997585014962094 |
| Encrypted: | false |
| SSDEEP: | 48:8Ryda2TUdmggZHhidAKZdA1duTiehOuTbbiZUk5OjqehOuTbky+yT+:8RokgOTLTbxWOvTbky7T |
| MD5: | EA25018D1405A49A9E97F6952298E090 |
| SHA1: | 3F5314687B99E9C71B4118C63EA524A8D106F0CF |
| SHA-256: | 1A41E7157DE1D202001C5994E2B1732009F10BF2B0F8A79D463F433F7D1F2A7D |
| SHA-512: | 3D66B26312C8116093D79502B29DDA83458D5C522EB0874ACAFE517B04C9F8B14CA6AD628DFB2857B5D9100C07D240DA5000C3C965A36C222355B3ACB93A8D52 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5050 |
| Entropy (8bit): | 5.289052544075544 |
| Encrypted: | false |
| SSDEEP: | 96:o4We0hP7OBFXYvB1sig3Fd8HkaXzLmUrv8Vh1WJlLQXT2v2gqw:655758Fd8HkaPZ0GmAD |
| MD5: | 26E26FD11772DFF5C7004BEA334289CC |
| SHA1: | 638DAAF541BDE31E95AEE4F8ADA677434D7051DB |
| SHA-256: | ADFE3E4960982F5EF4C043052A9990D8683C5FC2B590E817B6B1A5774DDE2CE3 |
| SHA-512: | C31929EB6D1C60D6A84A2574FF60490394A6D6F9B354972F3328952F570D80B3F2AEC916B0E1B66DDB1AC056EB75BFAC477E7AF631D0AD1810EDBAF025465D66 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22833 |
| Entropy (8bit): | 5.425034548615223 |
| Encrypted: | false |
| SSDEEP: | 384:7lFo6ZEdpgtmyiPixV9OX9gMBpHkHnfst9lZulagGcwYHiRFjJzN7:77o6ZviPixV8xpEHn89l4IgGcwYCRtb7 |
| MD5: | 749B18538FE32BFE0815D75F899F5B21 |
| SHA1: | AF95A019211AF69F752A43CAA54A83C2AFD41D28 |
| SHA-256: | 116B2687C1D5E00DB56A79894AB0C12D4E2E000B9379B7E7AD751B84DF611F3F |
| SHA-512: | E4B6F4556AA0FD9979BB52681508F5E26FFB256473803F74F7F5C8D93FA3636D7D0A5835618FBC6123022805CE0D9616A7451A0F302C665E28A6090B5D588505 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.298162049824456 |
| Encrypted: | false |
| SSDEEP: | 48:o7vGoolL3ALFKphnpiu7xOKAcfO/3d/rYh4vZorw:o/QLUFUL4KA+2y0Mw |
| MD5: | CE055F881BDAB4EF6C1C8AA4B3890348 |
| SHA1: | 2671741A70E9F5B608F690AAEEA4972003747654 |
| SHA-256: | 9B91C23691D6032CDFE28863E369624B2EDB033E1487A1D1BB0977E3590E5462 |
| SHA-512: | 8A22250628985C2E570E6FBADFC0D5CB6753F0735130F9E74962A409476C2859C5C81F8A0F5C427A9F13ED399C8E251FA43FF67AD5F16860640D45E7A538E857 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3467 |
| Entropy (8bit): | 5.514745431912774 |
| Encrypted: | false |
| SSDEEP: | 96:ozbld2fNUmeqJNizhNtt1W8t//loyIpXmdVE2w:onSKE8PWe/Cy4X3j |
| MD5: | 8DEF399E8355ABC23E64505281005099 |
| SHA1: | 24FF74C3AEFD7696D84FF148465DF4B1B60B1696 |
| SHA-256: | F128D7218E1286B05DF11310AD3C8F4CF781402698E45448850D2A3A22F5F185 |
| SHA-512: | 33721DD47658D8E12ADF6BD9E9316EB89F5B6297927F7FD60F954E04B829DCBF0E1AE6DDD9A3401F45E0011AE4B1397B960C218238A3D0F633A2173D8E604082 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32500 |
| Entropy (8bit): | 5.378903546681047 |
| Encrypted: | false |
| SSDEEP: | 768:zYlbuROstb0e39nKGrkysU0smpu4OLOdzIf1p/5GeSsngurz6aKEEEGo/:zYl61Cysbu4OLOdzIfrIen72ZFo/ |
| MD5: | BF4BF9728A7C302FBA5B14F3D0F1878B |
| SHA1: | 2607CA7A93710D629400077FF3602CB207E6F53D |
| SHA-256: | 8981E7B228DF7D6A8797C0CD1E9B0F1F88337D5F0E1C27A04E7A57D2C4309798 |
| SHA-512: | AC9E170FC3AFDC0CF6BB8E926B93EF129A5FAD1BBA51B60BABCF3555E9B652E98F86A00FB099879DED35DD3FFE72ECFA597E20E6CA8CF402BEDEC40F78412EDA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.355381206612617 |
| Encrypted: | false |
| SSDEEP: | 48:o7FEEM3MtH15jNQ8jsK3rnw0dkckTrKEp/OqLE9xz0W5Bzv3M6hIHYA+JITbwrF8:oq675jOArwoAmI/DLaxNPL5m+m6w |
| MD5: | E2A7251AD83A0D0634FEA2703D10ED07 |
| SHA1: | 90D72011F31FC40D3DA3748F2817F90A29EB5C01 |
| SHA-256: | 1079B49C4AAF5C10E4F2E6A086623F40D200A71FF2A1F64E88AA6C91E4BE7A6F |
| SHA-512: | CD6D75580EA8BD97CF7C7C0E0BD9D9A54FB6EA7DF1DDB5A95E94D38B260F9EE1425C640839ECD229B8D01E145CF2786CA374D31EC537EB8FE17FF415D5B985F5 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1416 |
| Entropy (8bit): | 5.275155058463166 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7hqCsNRxoYTY9/qoVk7hz1l2p6vDMW94uEQOeGbCx4VGbgCSFBV87O/BprGJ:o7hv6oy12kvwKEeGbC6GbHSh/Hrw |
| MD5: | 4DB6842CDFAC9E03D7C1CF87E398B357 |
| SHA1: | 08158AB8F5947E048C88A1289E9E8CE9641B7CE9 |
| SHA-256: | 8991D23B586608AE114E150355FF192B30A379EAB1DC3F1444109DDC52B13AC1 |
| SHA-512: | FB7C461DFB96B10E099C3BA41C45AA904BB7D473EF0D44BD6A2E841BC44336DD5F1C9B73919B79A6BF4AA13B806E742F2003A16528E995374E210BB4C3E96EFA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 358799 |
| Entropy (8bit): | 5.624587482410481 |
| Encrypted: | false |
| SSDEEP: | 6144:T/wM8RGYcBlKmhCxiDlnc0pYMSrBg5X3rU:TD8XxEdA |
| MD5: | A51DFF6CB98C15CBA0A2B688CC0A862F |
| SHA1: | 5CF15DBD322A0F9CF3A820013E185EC2EDD56BB0 |
| SHA-256: | 854215C9FE46B6029883F37C44512F7EB10BA97FC7A623C237DC6824BD92DB1E |
| SHA-512: | D1036F2C4AE71BE22315D5AEC062E1D59EA2570D7138B97F367149C9622BEE35EAC1DBE9818AC7BE107D88683089EBE220951D025CC11908055B108B27D7BD86 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,EFQ78c,EIOG1e,GwYlN,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,y5vRwf,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1652 |
| Entropy (8bit): | 5.269909938363071 |
| Encrypted: | false |
| SSDEEP: | 48:o72ZrNZDuZW4yNAbU+15fMxIdf5WENoBCbw7DbG2bEJrw:oyRuZMNAY+1i4HoBNG2Ilw |
| MD5: | 63E5B24335CCDC457DD0B69AD1891CF9 |
| SHA1: | 8DD3AED0737BEDBEE133BA564D3CA43579A138F7 |
| SHA-256: | FB72BE79F85659D5AF831FD644C4702EA5BFC6E6A90CDB156DE0816B179278C0 |
| SHA-512: | EC3A143FED571A7FC490433F11DDBD66752E42F0BAC476F79F9B8310DB0419CAE2B8CD65F1283D590F5979F4CC1FB8B2610F106BF38E0B93F384201B8BF5E5DA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,NwH0H,OmgaI,gychg,w9hDv,EEDORb,Mlhmy,ZfAoz,kWgXee,ovKuLd,yDVVkb,ebZ3mb,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4066 |
| Entropy (8bit): | 5.363016925556486 |
| Encrypted: | false |
| SSDEEP: | 96:G2CiFZX5BReR68ujioIRVrqtyzBeTV6SfyAKLif9c7w:bCMZXVeR6jiosVrqtyzBaImyAKw9x |
| MD5: | FC5E597D923838E10390DADD12651A81 |
| SHA1: | C9959F8D539DB5DF07B8246EC12539B6A9CC101F |
| SHA-256: | A7EBD5280C50AE93C061EAE1E9727329E015E97531F8F2D82D0E3EA76ADB37B4 |
| SHA-512: | 784CA572808F184A849388723FBB3701E6981D885BBA8A330A933F90BF0B36A2E4A491D4463A27911B1D9F7A7134F23E15F187FC7CB4554EAE9BC252513EED7C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 743936 |
| Entropy (8bit): | 5.791086737110097 |
| Encrypted: | false |
| SSDEEP: | 6144:HVXWBQkPdzg5pTX1ROv/duPzd8C3s891/N:gfd8j91/N |
| MD5: | F9F15F21696A09965757714D00305D14 |
| SHA1: | C7292420A092BF5C277A68B6E42971190AD63C82 |
| SHA-256: | EE66751937B1179DF56A5A789EB36D98B6A53116EABFEC2B35F93894EF71966E |
| SHA-512: | 751EB98B9E8ED75FC72569C6887C348847E0A1D7889A7C4254D96AA54D30C3A57CE1F2F42797A55996EBD6AAB58026EC623BCD9AEEB2672857B2081141021B78 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFJRy1OqtUmLpt_G_DWG-oJaagYwQ/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.404371326611379 |
| Encrypted: | false |
| SSDEEP: | 192:EEFZpeip4HzZlY0If0Ma23jcUcrhCx6VD1TYPi8:Es/p4jgjUhtD1TY68 |
| MD5: | 21E893B65627B397E22619A9F5BB9662 |
| SHA1: | F561B0F66211C1E7B22F94B4935C312AB7087E85 |
| SHA-256: | FFA9B8BC8EF2CDFF5EB4BA1A0BA1710A253A5B42535E2A369D5026967DCF4673 |
| SHA-512: | 3DE3CD6A4E9B06AB3EB324E90A40B5F2AEEA8D7D6A2651C310E993CF79EEB5AC6E2E33C587F46B2DD20CC862354FD1A61AEBB9B990E6805F6629404BA285F8FA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 339747 |
| Entropy (8bit): | 5.53363647964667 |
| Encrypted: | false |
| SSDEEP: | 3072:Vuv7kVKtaVFuzDXG6ZfzeelpRv9xqjne01T2HemAIaDlC6diGVOY50UlRQQIBeDq:svaKtM6ZfTxene0F2HemAaGP6BBe2 |
| MD5: | D2D05D80ACF53F04C1BEB6A387216F5E |
| SHA1: | 6E8B87D352419E28C5F8E3881787DC6C56CEB26E |
| SHA-256: | 4BA0D4EA27446C609D515539A334E3B16A4AC7BF936A996CF7E3927FFDDD569F |
| SHA-512: | 966582697B455B2DDC52210A0F46EFD77EDC67D668E7FC2F14E18DF38E8595472AB76ED17B9D2928E16FA987E3231C2A45D9BD52D9DC2CE7E4C394E2453518E6 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFwPDENALwio0taw23fxitsQJhhiA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.582163174163994 |
| TrID: |
|
| File name: | file.exe |
| File size: | 918'528 bytes |
| MD5: | 1bf42b89a7e2436161c26089f29a0652 |
| SHA1: | 196af2e64f23aea23fc728955864280a2150c02d |
| SHA256: | 9ecce840839e193265eff13feb177e00794c9df0c0a58c92ea6c31affc728fe3 |
| SHA512: | 702a97ca7efbc85dedbb9f277b13cc2e7974190b05d5ff41589f3906731d4d17bfa629b872dd616f522c0ebeb95c33bb5d0e3400a2d006f81b8781388f9efa92 |
| SSDEEP: | 12288:kqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaATf:kqDEvCTbMWu7rQYlBQcBiT6rprG8aYf |
| TLSH: | 35159E0273D1C062FF9B92334B5AF6515BBC69260123E62F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FD55A3 [Wed Oct 2 14:16:03 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007FC2A8C673B3h |
| jmp 00007FC2A8C66CBFh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FC2A8C66E9Dh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FC2A8C66E6Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007FC2A8C69A5Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007FC2A8C69AA8h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007FC2A8C69A91h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9878 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9878 | 0x9a00 | bd2744c8075646a4246cce4c7df391b8 | False | 0.2984476461038961 | data | 5.274724608640071 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xb40 | data | 1.0038194444444444 | ||
| RT_GROUP_ICON | 0xdd2f8 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd370 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd384 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd398 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd3ac | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd488 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 17:20:20.355974913 CEST | 49676 | 443 | 192.168.2.11 | 20.189.173.3 |
| Oct 2, 2024 17:20:20.660235882 CEST | 49676 | 443 | 192.168.2.11 | 20.189.173.3 |
| Oct 2, 2024 17:20:21.269567966 CEST | 49676 | 443 | 192.168.2.11 | 20.189.173.3 |
| Oct 2, 2024 17:20:21.378967047 CEST | 49671 | 443 | 192.168.2.11 | 204.79.197.203 |
| Oct 2, 2024 17:20:22.472702980 CEST | 49676 | 443 | 192.168.2.11 | 20.189.173.3 |
| Oct 2, 2024 17:20:22.878925085 CEST | 49674 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:23.003942013 CEST | 49673 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:24.878894091 CEST | 49676 | 443 | 192.168.2.11 | 20.189.173.3 |
| Oct 2, 2024 17:20:28.627629042 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:28.627672911 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:28.627784967 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:28.628079891 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:28.628098965 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.265372992 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.265772104 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:29.265805960 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.266206026 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.266535997 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:29.266933918 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.266984940 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:29.268069029 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:29.268131018 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.268429995 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:29.268436909 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.323338032 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:29.593137026 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.593158960 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.593242884 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.593287945 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:29.593328953 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:29.595504999 CEST | 49713 | 443 | 192.168.2.11 | 142.250.186.174 |
| Oct 2, 2024 17:20:29.595529079 CEST | 443 | 49713 | 142.250.186.174 | 192.168.2.11 |
| Oct 2, 2024 17:20:29.682701111 CEST | 49676 | 443 | 192.168.2.11 | 20.189.173.3 |
| Oct 2, 2024 17:20:30.979381084 CEST | 49671 | 443 | 192.168.2.11 | 204.79.197.203 |
| Oct 2, 2024 17:20:31.381087065 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:31.381123066 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:31.381182909 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:31.381496906 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:31.381511927 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:32.174642086 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:32.174871922 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:32.174902916 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:32.175962925 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:32.176016092 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:32.177114010 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:32.177180052 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:32.230256081 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:32.230273008 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:32.277158976 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:32.480309010 CEST | 49674 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:32.612473011 CEST | 49673 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:32.690829039 CEST | 49720 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:32.690865993 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:32.691020966 CEST | 49720 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:32.693667889 CEST | 49720 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:32.693682909 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:33.361488104 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:33.361556053 CEST | 49720 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:33.366352081 CEST | 49720 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:33.366358995 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:33.366738081 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:33.418790102 CEST | 49720 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:33.430598021 CEST | 49720 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:33.471405983 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:33.636960983 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:33.637038946 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:33.637090921 CEST | 49720 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:33.637315989 CEST | 49720 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:33.637345076 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:33.637360096 CEST | 49720 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:33.637366056 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:33.672674894 CEST | 49722 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:33.672724009 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:33.672786951 CEST | 49722 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:33.673172951 CEST | 49722 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:33.673187971 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:34.268348932 CEST | 443 | 49706 | 173.222.162.42 | 192.168.2.11 |
| Oct 2, 2024 17:20:34.269093037 CEST | 49706 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:34.315979958 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:34.316323996 CEST | 49722 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:34.318110943 CEST | 49722 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:34.318124056 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:34.318327904 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:34.322158098 CEST | 49722 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:34.367403984 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:34.601191044 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:34.601253033 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:34.601429939 CEST | 49722 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:34.602091074 CEST | 49722 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:34.602091074 CEST | 49722 | 443 | 192.168.2.11 | 184.28.90.27 |
| Oct 2, 2024 17:20:34.602112055 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:34.602119923 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.11 |
| Oct 2, 2024 17:20:36.911420107 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:36.911472082 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:36.914752007 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:36.914752007 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:36.914797068 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.630920887 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.635859966 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.635875940 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.636291981 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.636383057 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.636992931 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.637058973 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.660007954 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.660129070 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.664252996 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.664264917 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.717947960 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.949291945 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.949358940 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.949398041 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.949517965 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.949549913 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.949606895 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.955333948 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.955471039 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.961128950 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.961184978 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.961236000 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.961246967 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.961282969 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.966475010 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.966590881 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.966600895 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.967932940 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:37.967986107 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.968061924 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:37.968297005 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:37.968312979 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.972771883 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.972814083 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.972848892 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:37.972861052 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.972912073 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.034487009 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.034559965 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.034574986 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.034591913 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.034626961 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.037245989 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.037322044 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.040393114 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.040426970 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.040488958 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.040838003 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.040851116 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.043494940 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.043550014 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.043565989 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.043574095 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.043612957 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.050096989 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.050169945 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.056071997 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.056144953 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.056154966 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.062474966 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.062555075 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.062562943 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.068715096 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.068793058 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.068800926 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.068869114 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.068917036 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.068996906 CEST | 49734 | 443 | 192.168.2.11 | 142.250.185.238 |
| Oct 2, 2024 17:20:38.069015026 CEST | 443 | 49734 | 142.250.185.238 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.613404989 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.613732100 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.613751888 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.614178896 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.614245892 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.614913940 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.614994049 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.615909100 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.616007090 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.616254091 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.616262913 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.668668985 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.756069899 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.756329060 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.756345034 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.756772995 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.756840944 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.758100986 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.758189917 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.758333921 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.758433104 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.758557081 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.758564949 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.808756113 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.913739920 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.913820028 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.913881063 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.914522886 CEST | 49737 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.914539099 CEST | 443 | 49737 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.915345907 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.915379047 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:38.915451050 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.915762901 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:38.915776014 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.099112988 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.099317074 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.099397898 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.100538969 CEST | 49738 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.100554943 CEST | 443 | 49738 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.101321936 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.101373911 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.101438046 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.102399111 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.102416039 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.297322989 CEST | 49676 | 443 | 192.168.2.11 | 20.189.173.3 |
| Oct 2, 2024 17:20:39.572936058 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.573313951 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.573329926 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.573882103 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.573956966 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.574599981 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.574656010 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.575865984 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.575927973 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.576077938 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.576086998 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.576103926 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.622200012 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.622231960 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.748647928 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.753117085 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.753145933 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.753739119 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.753802061 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.754452944 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.754492998 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.754652977 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.754828930 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.755597115 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.755608082 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.755682945 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.800823927 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.801305056 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.801386118 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.802042961 CEST | 49742 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:39.802059889 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:39.803417921 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.205395937 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.205537081 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.205605984 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:40.378107071 CEST | 49743 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:40.378142118 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.675242901 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:40.719398975 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.943890095 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.943938971 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.943965912 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.943994045 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.944005966 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:40.944019079 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.944045067 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:40.944103956 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.944140911 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:40.945481062 CEST | 49718 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:20:40.945497990 CEST | 443 | 49718 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:20:41.221487045 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:41.221528053 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:41.221606016 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:41.222609997 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:41.222624063 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:41.903337002 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:41.903573036 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:41.907315016 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:41.907322884 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:41.907813072 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:41.948445082 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:42.918622017 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:42.963407993 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:43.149769068 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:43.149796963 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:43.149806023 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:43.149815083 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:43.149887085 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:43.149924994 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:43.149947882 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:43.149950027 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:43.150007010 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:43.150017977 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:43.150374889 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:43.150964975 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:43.870165110 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:43.870198965 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:43.870209932 CEST | 49747 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:20:43.870217085 CEST | 443 | 49747 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:20:45.659986019 CEST | 49706 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:45.660094023 CEST | 49706 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:45.660475016 CEST | 49756 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:45.660526037 CEST | 443 | 49756 | 173.222.162.42 | 192.168.2.11 |
| Oct 2, 2024 17:20:45.660629034 CEST | 49756 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:45.669210911 CEST | 49756 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:45.669238091 CEST | 443 | 49756 | 173.222.162.42 | 192.168.2.11 |
| Oct 2, 2024 17:20:45.889887094 CEST | 49757 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:45.889955044 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:45.890181065 CEST | 49757 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:45.890459061 CEST | 49757 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:45.890475988 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:45.964894056 CEST | 49706 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:46.568195105 CEST | 49706 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:46.638756990 CEST | 443 | 49706 | 173.222.162.42 | 192.168.2.11 |
| Oct 2, 2024 17:20:46.638783932 CEST | 443 | 49706 | 173.222.162.42 | 192.168.2.11 |
| Oct 2, 2024 17:20:46.638866901 CEST | 443 | 49706 | 173.222.162.42 | 192.168.2.11 |
| Oct 2, 2024 17:20:46.638880014 CEST | 443 | 49706 | 173.222.162.42 | 192.168.2.11 |
| Oct 2, 2024 17:20:47.228163958 CEST | 443 | 49756 | 173.222.162.42 | 192.168.2.11 |
| Oct 2, 2024 17:20:47.228295088 CEST | 49756 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:20:47.275208950 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:47.275583982 CEST | 49757 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:47.275623083 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:47.276376009 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:47.277453899 CEST | 49757 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:47.277625084 CEST | 49757 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:47.277625084 CEST | 49757 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:47.277637005 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:47.277682066 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:47.328160048 CEST | 49757 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:47.626766920 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:47.626893044 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:20:47.627268076 CEST | 49757 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:47.630939960 CEST | 49757 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:20:47.630983114 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:06.375571966 CEST | 443 | 49756 | 173.222.162.42 | 192.168.2.11 |
| Oct 2, 2024 17:21:06.375650883 CEST | 49756 | 443 | 192.168.2.11 | 173.222.162.42 |
| Oct 2, 2024 17:21:08.343225956 CEST | 49760 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:08.343270063 CEST | 443 | 49760 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:08.343334913 CEST | 49760 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:08.343923092 CEST | 49760 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:08.343934059 CEST | 443 | 49760 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:08.811018944 CEST | 49761 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:08.811120987 CEST | 443 | 49761 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:08.811237097 CEST | 49761 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:08.811513901 CEST | 49761 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:08.811547041 CEST | 443 | 49761 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.083880901 CEST | 443 | 49760 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.084192991 CEST | 49760 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.084212065 CEST | 443 | 49760 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.084568977 CEST | 443 | 49760 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.084873915 CEST | 49760 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.084937096 CEST | 443 | 49760 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.085028887 CEST | 49760 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.085042953 CEST | 49760 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.085052967 CEST | 443 | 49760 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.107506990 CEST | 49762 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.107561111 CEST | 443 | 49762 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.107640028 CEST | 49762 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.107938051 CEST | 49762 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.107954025 CEST | 443 | 49762 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.383280039 CEST | 443 | 49760 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.384053946 CEST | 443 | 49760 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.384188890 CEST | 49760 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.440907001 CEST | 49760 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.440931082 CEST | 443 | 49760 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.465761900 CEST | 443 | 49761 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.502064943 CEST | 49761 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.502125025 CEST | 443 | 49761 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.502737999 CEST | 443 | 49761 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.508485079 CEST | 49761 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.508692026 CEST | 49761 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.508697987 CEST | 443 | 49761 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.508709908 CEST | 49761 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.508829117 CEST | 443 | 49761 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.558051109 CEST | 49761 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.771754026 CEST | 443 | 49762 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.772156954 CEST | 49762 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.772188902 CEST | 443 | 49762 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.773447990 CEST | 443 | 49762 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.774420023 CEST | 49762 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.774651051 CEST | 443 | 49762 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.774893999 CEST | 49762 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.774966955 CEST | 49762 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.774971962 CEST | 443 | 49762 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.803013086 CEST | 443 | 49761 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.803903103 CEST | 443 | 49761 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:09.804003954 CEST | 49761 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.804091930 CEST | 49761 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:09.804111958 CEST | 443 | 49761 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:10.076013088 CEST | 443 | 49762 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:10.076549053 CEST | 443 | 49762 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:10.076630116 CEST | 49762 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:10.076778889 CEST | 49762 | 443 | 192.168.2.11 | 172.217.18.14 |
| Oct 2, 2024 17:21:10.076802969 CEST | 443 | 49762 | 172.217.18.14 | 192.168.2.11 |
| Oct 2, 2024 17:21:20.718492985 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:20.718543053 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:20.718643904 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:20.719084024 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:20.719094038 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.386272907 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.386415958 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.388863087 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.388883114 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.389167070 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.396934032 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.439405918 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.645567894 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.645602942 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.645626068 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.645672083 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.645699024 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.645745993 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.645745993 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.646223068 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.646255970 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.646297932 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.646308899 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.646325111 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.646948099 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.647027016 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.648236990 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.648236990 CEST | 49763 | 443 | 192.168.2.11 | 52.165.165.26 |
| Oct 2, 2024 17:21:21.648262024 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:21.648273945 CEST | 443 | 49763 | 52.165.165.26 | 192.168.2.11 |
| Oct 2, 2024 17:21:31.435018063 CEST | 49765 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:21:31.435054064 CEST | 443 | 49765 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:21:31.435148954 CEST | 49765 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:21:31.435492992 CEST | 49765 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:21:31.435499907 CEST | 443 | 49765 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:21:32.063014984 CEST | 443 | 49765 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:21:32.072019100 CEST | 49765 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:21:32.072041988 CEST | 443 | 49765 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:21:32.072594881 CEST | 443 | 49765 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:21:32.076628923 CEST | 49765 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:21:32.076761007 CEST | 443 | 49765 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:21:32.121167898 CEST | 49765 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:21:39.424020052 CEST | 49767 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:39.424067974 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:39.424143076 CEST | 49767 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:39.424360037 CEST | 49767 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:39.424374104 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:39.879570961 CEST | 49768 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:39.879688978 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:39.879843950 CEST | 49768 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:39.880395889 CEST | 49768 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:39.880454063 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.066179037 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.066569090 CEST | 49767 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.066581964 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.066952944 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.067244053 CEST | 49767 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.067305088 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.067426920 CEST | 49767 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.067426920 CEST | 49767 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.067456961 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.287643909 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.288208008 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.288290977 CEST | 49767 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.288593054 CEST | 49767 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.288609028 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.509319067 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.509648085 CEST | 49768 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.509700060 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.510072947 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.510425091 CEST | 49768 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.510487080 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.510605097 CEST | 49768 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.510632038 CEST | 49768 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.510643005 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.811748028 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.811881065 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:40.811925888 CEST | 49768 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.812220097 CEST | 49768 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:21:40.812243938 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:21:41.979520082 CEST | 443 | 49765 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:21:41.979605913 CEST | 443 | 49765 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:21:41.979676008 CEST | 49765 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:21:55.310497999 CEST | 49765 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:21:55.310534000 CEST | 443 | 49765 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:22:10.327480078 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:10.327541113 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:10.327636003 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:10.328041077 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:10.328057051 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:10.358102083 CEST | 49771 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:10.358166933 CEST | 443 | 49771 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:10.358266115 CEST | 49771 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:10.358570099 CEST | 49771 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:10.358581066 CEST | 443 | 49771 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:10.994700909 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.012036085 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.012053013 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.012600899 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.056480885 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.070980072 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.071151018 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.071157932 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.071177959 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.071208954 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.110599041 CEST | 443 | 49771 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.115401983 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.115461111 CEST | 49771 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.115494967 CEST | 443 | 49771 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.115904093 CEST | 443 | 49771 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.122869015 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.139900923 CEST | 49771 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.140000105 CEST | 443 | 49771 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.140155077 CEST | 49771 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.140173912 CEST | 49771 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.140185118 CEST | 443 | 49771 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.300761938 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.301455021 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.301572084 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.301692009 CEST | 49770 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.301712036 CEST | 443 | 49770 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.417561054 CEST | 443 | 49771 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.417726040 CEST | 443 | 49771 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:11.418032885 CEST | 49771 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.418544054 CEST | 49771 | 443 | 192.168.2.11 | 142.250.186.142 |
| Oct 2, 2024 17:22:11.418592930 CEST | 443 | 49771 | 142.250.186.142 | 192.168.2.11 |
| Oct 2, 2024 17:22:31.497610092 CEST | 49772 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:22:31.497711897 CEST | 443 | 49772 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:22:31.498671055 CEST | 49772 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:22:31.498924971 CEST | 49772 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:22:31.498941898 CEST | 443 | 49772 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:22:32.148166895 CEST | 443 | 49772 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:22:32.148566008 CEST | 49772 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:22:32.148587942 CEST | 443 | 49772 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:22:32.148930073 CEST | 443 | 49772 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:22:32.149224043 CEST | 49772 | 443 | 192.168.2.11 | 142.250.184.228 |
| Oct 2, 2024 17:22:32.149271965 CEST | 443 | 49772 | 142.250.184.228 | 192.168.2.11 |
| Oct 2, 2024 17:22:32.199245930 CEST | 49772 | 443 | 192.168.2.11 | 142.250.184.228 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 17:20:27.177752018 CEST | 53 | 65111 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:27.212032080 CEST | 59197 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:20:27.212202072 CEST | 50707 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:20:27.218903065 CEST | 53 | 50707 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:27.218935966 CEST | 53 | 59197 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:27.220187902 CEST | 53 | 50599 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:28.616945982 CEST | 49773 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:20:28.617306948 CEST | 57407 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:20:28.623822927 CEST | 53 | 49773 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:28.624233007 CEST | 53 | 57407 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:28.662432909 CEST | 53 | 60472 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:31.372217894 CEST | 60309 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:20:31.372217894 CEST | 49957 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:20:31.379075050 CEST | 53 | 49957 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:31.379371881 CEST | 53 | 60309 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:34.367332935 CEST | 53 | 55620 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:36.895178080 CEST | 64565 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:20:36.895482063 CEST | 60132 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:20:36.902194023 CEST | 53 | 64565 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:36.902683973 CEST | 53 | 60132 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.940190077 CEST | 62187 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:20:37.940907955 CEST | 64074 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:20:37.948251009 CEST | 53 | 62187 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:37.948704958 CEST | 53 | 64074 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:40.505017996 CEST | 53 | 64518 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:20:46.639990091 CEST | 53 | 57279 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:21:04.533474922 CEST | 53 | 56854 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:21:18.253442049 CEST | 138 | 138 | 192.168.2.11 | 192.168.2.255 |
| Oct 2, 2024 17:21:26.726059914 CEST | 53 | 53782 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:21:27.245752096 CEST | 53 | 53775 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:21:38.915036917 CEST | 53 | 56022 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:21:39.415782928 CEST | 63269 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:21:39.415942907 CEST | 51132 | 53 | 192.168.2.11 | 1.1.1.1 |
| Oct 2, 2024 17:21:39.422930002 CEST | 53 | 63269 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:21:39.422946930 CEST | 53 | 51132 | 1.1.1.1 | 192.168.2.11 |
| Oct 2, 2024 17:21:55.318278074 CEST | 53 | 57387 | 1.1.1.1 | 192.168.2.11 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 17:20:27.212032080 CEST | 192.168.2.11 | 1.1.1.1 | 0xe7ff | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:20:27.212202072 CEST | 192.168.2.11 | 1.1.1.1 | 0x9320 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 17:20:28.616945982 CEST | 192.168.2.11 | 1.1.1.1 | 0x6120 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:20:28.617306948 CEST | 192.168.2.11 | 1.1.1.1 | 0xb866 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 17:20:31.372217894 CEST | 192.168.2.11 | 1.1.1.1 | 0x28fb | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:20:31.372217894 CEST | 192.168.2.11 | 1.1.1.1 | 0x1e85 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 17:20:36.895178080 CEST | 192.168.2.11 | 1.1.1.1 | 0x7949 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:20:36.895482063 CEST | 192.168.2.11 | 1.1.1.1 | 0x42ec | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 17:20:37.940190077 CEST | 192.168.2.11 | 1.1.1.1 | 0x2261 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:20:37.940907955 CEST | 192.168.2.11 | 1.1.1.1 | 0xdfa2 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 17:21:39.415782928 CEST | 192.168.2.11 | 1.1.1.1 | 0x70fd | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:21:39.415942907 CEST | 192.168.2.11 | 1.1.1.1 | 0x4fd5 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 17:20:27.218903065 CEST | 1.1.1.1 | 192.168.2.11 | 0x9320 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 17:20:27.218935966 CEST | 1.1.1.1 | 192.168.2.11 | 0xe7ff | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 216.58.212.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 216.58.212.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.74.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.623822927 CEST | 1.1.1.1 | 192.168.2.11 | 0x6120 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.624233007 CEST | 1.1.1.1 | 192.168.2.11 | 0xb866 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:28.624233007 CEST | 1.1.1.1 | 192.168.2.11 | 0xb866 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 17:20:31.379075050 CEST | 1.1.1.1 | 192.168.2.11 | 0x1e85 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 17:20:31.379371881 CEST | 1.1.1.1 | 192.168.2.11 | 0x28fb | No error (0) | 142.250.184.228 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:36.902194023 CEST | 1.1.1.1 | 192.168.2.11 | 0x7949 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:36.902194023 CEST | 1.1.1.1 | 192.168.2.11 | 0x7949 | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:36.902683973 CEST | 1.1.1.1 | 192.168.2.11 | 0x42ec | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 17:20:37.948251009 CEST | 1.1.1.1 | 192.168.2.11 | 0x2261 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:21:39.422930002 CEST | 1.1.1.1 | 192.168.2.11 | 0x70fd | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.11 | 49713 | 142.250.186.174 | 443 | 8036 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 15:20:29 UTC | 857 | OUT | |
| 2024-10-02 15:20:29 UTC | 2634 | IN |