Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1524249 |
| MD5: | a4da09a845d42f57982ff9177c819a39 |
| SHA1: | 3c78a95a27531287f51251b13cc27cc0ad429413 |
| SHA256: | 52d7013d0601f0308fa745c77172fee02146b6bd6cc12a56dd56653a49fd9641 |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 72 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
file.exe (PID: 7624 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: A4DA09A845D42F57982FF9177C819A39) 
chrome.exe (PID: 7680 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://youtu be.com/acc ount?=http s://accoun ts.google. com/v3/sig nin/challe nge/pwd" - -start-ful lscreen -- no-first-r un --disab le-session -crashed-b ubble --di sable-info bars MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 7892 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2156 --fi eld-trial- handle=211 2,i,100215 3657454459 9090,10325 1267689463 13152,2621 44 /prefet ch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 3088 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=52 36 --field -trial-han dle=2112,i ,100215365 7454459909 0,10325126 7689463131 52,262144 /prefetch: 8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 5372 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5420 --f ield-trial -handle=21 12,i,10021 5365745445 99090,1032 5126768946 313152,262 144 /prefe tch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 1_2_00DCDBBE | |
| Source: | Code function: | 1_2_00D9C2A2 | |
| Source: | Code function: | 1_2_00DD68EE | |
| Source: | Code function: | 1_2_00DD698F | |
| Source: | Code function: | 1_2_00DCD076 | |
| Source: | Code function: | 1_2_00DCD3A9 | |
| Source: | Code function: | 1_2_00DD9642 | |
| Source: | Code function: | 1_2_00DD979D | |
| Source: | Code function: | 1_2_00DD9B2B | |
| Source: | Code function: | 1_2_00DD5C97 | |
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 1_2_00DDCE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 1_2_00DDEAFF | |
| Source: | Code function: | 1_2_00DDED6A | |
| Source: | Code function: | 1_2_00DDEAFF | |
| Source: | Code function: | 1_2_00DCAA57 | |
| Source: | Code function: | 1_2_00DF9576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_daf72802-d | |
| Source: | String found in binary or memory: | memstr_170f8a2d-b | |
| Source: | String found in binary or memory: | memstr_c7031a45-0 | |
| Source: | String found in binary or memory: | memstr_78e4e3da-2 | |
| Source: | Code function: | 1_2_00DCD5EB | |
| Source: | Code function: | 1_2_00DC1201 | |
| Source: | Code function: | 1_2_00DCE8F6 | |
| Source: | Code function: | 1_2_00D6BF40 | |
| Source: | Code function: | 1_2_00DD2046 | |
| Source: | Code function: | 1_2_00D68060 | |
| Source: | Code function: | 1_2_00DC8298 | |
| Source: | Code function: | 1_2_00D9E4FF | |
| Source: | Code function: | 1_2_00D9676B | |
| Source: | Code function: | 1_2_00DF4873 | |
| Source: | Code function: | 1_2_00D6CAF0 | |
| Source: | Code function: | 1_2_00D8CAA0 | |
| Source: | Code function: | 1_2_00D7CC39 | |
| Source: | Code function: | 1_2_00D96DD9 | |
| Source: | Code function: | 1_2_00D691C0 | |
| Source: | Code function: | 1_2_00D7B119 | |
| Source: | Code function: | 1_2_00D81394 | |
| Source: | Code function: | 1_2_00D81706 | |
| Source: | Code function: | 1_2_00D8781B | |
| Source: | Code function: | 1_2_00D819B0 | |
| Source: | Code function: | 1_2_00D7997D | |
| Source: | Code function: | 1_2_00D67920 | |
| Source: | Code function: | 1_2_00D87A4A | |
| Source: | Code function: | 1_2_00D87CA7 | |
| Source: | Code function: | 1_2_00D81C77 | |
| Source: | Code function: | 1_2_00D99EEE | |
| Source: | Code function: | 1_2_00DEBE44 | |
| Source: | Code function: | 1_2_00D81F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 1_2_00DD37B5 | |
| Source: | Code function: | 1_2_00DC10BF | |
| Source: | Code function: | 1_2_00DC16C3 | |
| Source: | Code function: | 1_2_00DD51CD | |
| Source: | Code function: | 1_2_00DCD4DC | |
| Source: | Code function: | 1_2_00DD648E | |
| Source: | Code function: | 1_2_00D642A2 | |
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 1_2_00D642DE | |
| Source: | Code function: | 1_2_00D80A89 | |
| Source: | Code function: | 1_2_00D7F98E | |
| Source: | Code function: | 1_2_00DF1C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_1-97389 | ||
| Source: | API coverage: | ||
| Source: | Code function: | 1_2_00DCDBBE | |
| Source: | Code function: | 1_2_00D9C2A2 | |
| Source: | Code function: | 1_2_00DD68EE | |
| Source: | Code function: | 1_2_00DD698F | |
| Source: | Code function: | 1_2_00DCD076 | |
| Source: | Code function: | 1_2_00DCD3A9 | |
| Source: | Code function: | 1_2_00DD9642 | |
| Source: | Code function: | 1_2_00DD979D | |
| Source: | Code function: | 1_2_00DD9B2B | |
| Source: | Code function: | 1_2_00DD5C97 | |
| Source: | Code function: | 1_2_00D642DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 1_2_00DDEAA2 | |
| Source: | Code function: | 1_2_00D92622 | |
| Source: | Code function: | 1_2_00D642DE | |
| Source: | Code function: | 1_2_00D84CE8 | |
| Source: | Code function: | 1_2_00DC0B62 | |
| Source: | Code function: | 1_2_00D92622 | |
| Source: | Code function: | 1_2_00D8083F | |
| Source: | Code function: | 1_2_00D809D5 | |
| Source: | Code function: | 1_2_00D80C21 | |
| Source: | Code function: | 1_2_00DC1201 | |
| Source: | Code function: | 1_2_00DA2BA5 | |
| Source: | Code function: | 1_2_00DCB226 | |
| Source: | Code function: | 1_2_00DE22DA | |
| Source: | Code function: | 1_2_00DC0B62 | |
| Source: | Code function: | 1_2_00DC1663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 1_2_00D80698 | |
| Source: | Code function: | 1_2_00DD8195 | |
| Source: | Code function: | 1_2_00DBD27A | |
| Source: | Code function: | 1_2_00D9B952 | |
| Source: | Code function: | 1_2_00D642DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 1_2_00DE1204 | |
| Source: | Code function: | 1_2_00DE1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 15 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 2 Valid Accounts | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Virtualization/Sandbox Evasion | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 21 Access Token Manipulation | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 2 Process Injection | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 16% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.184.238 | true | false | unknown | |
| www3.l.google.com | 216.58.206.46 | true | false | unknown | |
| play.google.com | 216.58.206.46 | true | false | unknown | |
| www.google.com | 142.250.184.196 | true | false | unknown | |
| youtube.com | 142.250.185.142 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.184.196 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 216.58.206.46 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.142 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.184.238 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.7 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1524249 |
| Start date and time: | 2024-10-02 17:24:11 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 1s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 13 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal72.troj.evad.winEXE@33/32@12/6 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 216.58.206.35, 142.250.181.238, 66.102.1.84, 34.104.35.123, 142.250.186.99, 142.250.185.67, 142.250.184.234, 142.250.186.106, 142.250.186.42, 172.217.16.202, 142.250.185.202, 142.250.185.170, 142.250.185.234, 142.250.185.138, 216.58.206.42, 172.217.18.10, 142.250.181.234, 142.250.184.202, 142.250.185.106, 142.250.186.170, 216.58.212.170, 142.250.185.74, 172.217.16.138, 142.250.74.202, 93.184.221.240, 142.250.186.35, 74.125.206.84, 142.250.186.174
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Credential Flusher | Browse | ||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Babadeda | Browse |
|
⊘No context
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1416 |
| Entropy (8bit): | 5.275155058463166 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7hqCsNRxoYTY9/qoVk7hz1l2p6vDMW94uEQOeGbCx4VGbgCSFBV87O/BprGJ:o7hv6oy12kvwKEeGbC6GbHSh/Hrw |
| MD5: | 4DB6842CDFAC9E03D7C1CF87E398B357 |
| SHA1: | 08158AB8F5947E048C88A1289E9E8CE9641B7CE9 |
| SHA-256: | 8991D23B586608AE114E150355FF192B30A379EAB1DC3F1444109DDC52B13AC1 |
| SHA-512: | FB7C461DFB96B10E099C3BA41C45AA904BB7D473EF0D44BD6A2E841BC44336DD5F1C9B73919B79A6BF4AA13B806E742F2003A16528E995374E210BB4C3E96EFA |
| Malicious: | false |
| Reputation: | low |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1652 |
| Entropy (8bit): | 5.269909938363071 |
| Encrypted: | false |
| SSDEEP: | 48:o72ZrNZDuZW4yNAbU+15fMxIdf5WENoBCbw7DbG2bEJrw:oyRuZMNAY+1i4HoBNG2Ilw |
| MD5: | 63E5B24335CCDC457DD0B69AD1891CF9 |
| SHA1: | 8DD3AED0737BEDBEE133BA564D3CA43579A138F7 |
| SHA-256: | FB72BE79F85659D5AF831FD644C4702EA5BFC6E6A90CDB156DE0816B179278C0 |
| SHA-512: | EC3A143FED571A7FC490433F11DDBD66752E42F0BAC476F79F9B8310DB0419CAE2B8CD65F1283D590F5979F4CC1FB8B2610F106BF38E0B93F384201B8BF5E5DA |
| Malicious: | false |
| Reputation: | low |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,NwH0H,OmgaI,gychg,w9hDv,EEDORb,Mlhmy,ZfAoz,kWgXee,ovKuLd,yDVVkb,ebZ3mb,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3467 |
| Entropy (8bit): | 5.514745431912774 |
| Encrypted: | false |
| SSDEEP: | 96:ozbld2fNUmeqJNizhNtt1W8t//loyIpXmdVE2w:onSKE8PWe/Cy4X3j |
| MD5: | 8DEF399E8355ABC23E64505281005099 |
| SHA1: | 24FF74C3AEFD7696D84FF148465DF4B1B60B1696 |
| SHA-256: | F128D7218E1286B05DF11310AD3C8F4CF781402698E45448850D2A3A22F5F185 |
| SHA-512: | 33721DD47658D8E12ADF6BD9E9316EB89F5B6297927F7FD60F954E04B829DCBF0E1AE6DDD9A3401F45E0011AE4B1397B960C218238A3D0F633A2173D8E604082 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.355381206612617 |
| Encrypted: | false |
| SSDEEP: | 48:o7FEEM3MtH15jNQ8jsK3rnw0dkckTrKEp/OqLE9xz0W5Bzv3M6hIHYA+JITbwrF8:oq675jOArwoAmI/DLaxNPL5m+m6w |
| MD5: | E2A7251AD83A0D0634FEA2703D10ED07 |
| SHA1: | 90D72011F31FC40D3DA3748F2817F90A29EB5C01 |
| SHA-256: | 1079B49C4AAF5C10E4F2E6A086623F40D200A71FF2A1F64E88AA6C91E4BE7A6F |
| SHA-512: | CD6D75580EA8BD97CF7C7C0E0BD9D9A54FB6EA7DF1DDB5A95E94D38B260F9EE1425C640839ECD229B8D01E145CF2786CA374D31EC537EB8FE17FF415D5B985F5 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.298162049824456 |
| Encrypted: | false |
| SSDEEP: | 48:o7vGoolL3ALFKphnpiu7xOKAcfO/3d/rYh4vZorw:o/QLUFUL4KA+2y0Mw |
| MD5: | CE055F881BDAB4EF6C1C8AA4B3890348 |
| SHA1: | 2671741A70E9F5B608F690AAEEA4972003747654 |
| SHA-256: | 9B91C23691D6032CDFE28863E369624B2EDB033E1487A1D1BB0977E3590E5462 |
| SHA-512: | 8A22250628985C2E570E6FBADFC0D5CB6753F0735130F9E74962A409476C2859C5C81F8A0F5C427A9F13ED399C8E251FA43FF67AD5F16860640D45E7A538E857 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 743936 |
| Entropy (8bit): | 5.791085889652278 |
| Encrypted: | false |
| SSDEEP: | 6144:aVXWBQkPdzg5pTX1ROv/duPzd8C3s891/N:7fd8j91/N |
| MD5: | D20AA383CD31013B68BB10390CBE0230 |
| SHA1: | 2DF35559BBA0B93FE305C4B828324E9F9EFA234D |
| SHA-256: | 9F91BD315E202B9EC035C25EFFCE646CEC9AB1E8599496198AA8BEC437CDD228 |
| SHA-512: | EA023EEB24C48A2F463E0CFC9107C6FCD76BBA9292ED49839AAF0AC7845DBD48AB4876376A6A7D4EE902B0649BFE5E0AC2960D954079A94BF2F64A5BC2CBCD9C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHJL2nU2EL_uUPBIEb5OQMKdqHGhg/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32500 |
| Entropy (8bit): | 5.378903546681047 |
| Encrypted: | false |
| SSDEEP: | 768:zYlbuROstb0e39nKGrkysU0smpu4OLOdzIf1p/5GeSsngurz6aKEEEGo/:zYl61Cysbu4OLOdzIfrIen72ZFo/ |
| MD5: | BF4BF9728A7C302FBA5B14F3D0F1878B |
| SHA1: | 2607CA7A93710D629400077FF3602CB207E6F53D |
| SHA-256: | 8981E7B228DF7D6A8797C0CD1E9B0F1F88337D5F0E1C27A04E7A57D2C4309798 |
| SHA-512: | AC9E170FC3AFDC0CF6BB8E926B93EF129A5FAD1BBA51B60BABCF3555E9B652E98F86A00FB099879DED35DD3FFE72ECFA597E20E6CA8CF402BEDEC40F78412EDA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 358799 |
| Entropy (8bit): | 5.624587482410481 |
| Encrypted: | false |
| SSDEEP: | 6144:T/wM8RGYcBlKmhCxiDlnc0pYMSrBg5X3rU:TD8XxEdA |
| MD5: | A51DFF6CB98C15CBA0A2B688CC0A862F |
| SHA1: | 5CF15DBD322A0F9CF3A820013E185EC2EDD56BB0 |
| SHA-256: | 854215C9FE46B6029883F37C44512F7EB10BA97FC7A623C237DC6824BD92DB1E |
| SHA-512: | D1036F2C4AE71BE22315D5AEC062E1D59EA2570D7138B97F367149C9622BEE35EAC1DBE9818AC7BE107D88683089EBE220951D025CC11908055B108B27D7BD86 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,EFQ78c,EIOG1e,GwYlN,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,y5vRwf,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22833 |
| Entropy (8bit): | 5.425034548615223 |
| Encrypted: | false |
| SSDEEP: | 384:7lFo6ZEdpgtmyiPixV9OX9gMBpHkHnfst9lZulagGcwYHiRFjJzN7:77o6ZviPixV8xpEHn89l4IgGcwYCRtb7 |
| MD5: | 749B18538FE32BFE0815D75F899F5B21 |
| SHA1: | AF95A019211AF69F752A43CAA54A83C2AFD41D28 |
| SHA-256: | 116B2687C1D5E00DB56A79894AB0C12D4E2E000B9379B7E7AD751B84DF611F3F |
| SHA-512: | E4B6F4556AA0FD9979BB52681508F5E26FFB256473803F74F7F5C8D93FA3636D7D0A5835618FBC6123022805CE0D9616A7451A0F302C665E28A6090B5D588505 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.404371326611379 |
| Encrypted: | false |
| SSDEEP: | 192:EEFZpeip4HzZlY0If0Ma23jcUcrhCx6VD1TYPi8:Es/p4jgjUhtD1TY68 |
| MD5: | 21E893B65627B397E22619A9F5BB9662 |
| SHA1: | F561B0F66211C1E7B22F94B4935C312AB7087E85 |
| SHA-256: | FFA9B8BC8EF2CDFF5EB4BA1A0BA1710A253A5B42535E2A369D5026967DCF4673 |
| SHA-512: | 3DE3CD6A4E9B06AB3EB324E90A40B5F2AEEA8D7D6A2651C310E993CF79EEB5AC6E2E33C587F46B2DD20CC862354FD1A61AEBB9B990E6805F6629404BA285F8FA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4066 |
| Entropy (8bit): | 5.363016925556486 |
| Encrypted: | false |
| SSDEEP: | 96:G2CiFZX5BReR68ujioIRVrqtyzBeTV6SfyAKLif9c7w:bCMZXVeR6jiosVrqtyzBaImyAKw9x |
| MD5: | FC5E597D923838E10390DADD12651A81 |
| SHA1: | C9959F8D539DB5DF07B8246EC12539B6A9CC101F |
| SHA-256: | A7EBD5280C50AE93C061EAE1E9727329E015E97531F8F2D82D0E3EA76ADB37B4 |
| SHA-512: | 784CA572808F184A849388723FBB3701E6981D885BBA8A330A933F90BF0B36A2E4A491D4463A27911B1D9F7A7134F23E15F187FC7CB4554EAE9BC252513EED7C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 339747 |
| Entropy (8bit): | 5.53363647964667 |
| Encrypted: | false |
| SSDEEP: | 3072:Vuv7kVKtaVFuzDXG6ZfzeelpRv9xqjne01T2HemAIaDlC6diGVOY50UlRQQIBeDq:svaKtM6ZfTxene0F2HemAaGP6BBe2 |
| MD5: | D2D05D80ACF53F04C1BEB6A387216F5E |
| SHA1: | 6E8B87D352419E28C5F8E3881787DC6C56CEB26E |
| SHA-256: | 4BA0D4EA27446C609D515539A334E3B16A4AC7BF936A996CF7E3927FFDDD569F |
| SHA-512: | 966582697B455B2DDC52210A0F46EFD77EDC67D668E7FC2F14E18DF38E8595472AB76ED17B9D2928E16FA987E3231C2A45D9BD52D9DC2CE7E4C394E2453518E6 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5050 |
| Entropy (8bit): | 5.289052544075544 |
| Encrypted: | false |
| SSDEEP: | 96:o4We0hP7OBFXYvB1sig3Fd8HkaXzLmUrv8Vh1WJlLQXT2v2gqw:655758Fd8HkaPZ0GmAD |
| MD5: | 26E26FD11772DFF5C7004BEA334289CC |
| SHA1: | 638DAAF541BDE31E95AEE4F8ADA677434D7051DB |
| SHA-256: | ADFE3E4960982F5EF4C043052A9990D8683C5FC2B590E817B6B1A5774DDE2CE3 |
| SHA-512: | C31929EB6D1C60D6A84A2574FF60490394A6D6F9B354972F3328952F570D80B3F2AEC916B0E1B66DDB1AC056EB75BFAC477E7AF631D0AD1810EDBAF025465D66 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.582087679492459 |
| TrID: |
|
| File name: | file.exe |
| File size: | 918'528 bytes |
| MD5: | a4da09a845d42f57982ff9177c819a39 |
| SHA1: | 3c78a95a27531287f51251b13cc27cc0ad429413 |
| SHA256: | 52d7013d0601f0308fa745c77172fee02146b6bd6cc12a56dd56653a49fd9641 |
| SHA512: | 801b3bb0f5e4c9202f5f389261fa33c57de0e4408db12fbe2b42558be1d1ac36670abd1ae7ee3f4d663fb4dbf84248c9e5f2fd68d38e9f10a86fe94b527cd26b |
| SSDEEP: | 12288:rqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgabTr:rqDEvCTbMWu7rQYlBQcBiT6rprG8afr |
| TLSH: | B9159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FD58A9 [Wed Oct 2 14:28:57 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F82D04FB413h |
| jmp 00007F82D04FAD1Fh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F82D04FAEFDh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F82D04FAECAh |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F82D04FDABDh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F82D04FDB08h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F82D04FDAF1h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9830 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9830 | 0x9a00 | 92a08592c12691bf1f723d0f4b5a49f8 | False | 0.2964437905844156 | data | 5.272070162002485 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xaf8 | data | 1.003917378917379 | ||
| RT_GROUP_ICON | 0xdd2b0 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd328 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd33c | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd350 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd364 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd440 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 17:25:09.165885925 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 2, 2024 17:25:09.540344954 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 2, 2024 17:25:09.962265015 CEST | 49671 | 443 | 192.168.2.7 | 204.79.197.203 |
| Oct 2, 2024 17:25:10.290380001 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 2, 2024 17:25:11.791034937 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 2, 2024 17:25:14.774684906 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 2, 2024 17:25:16.832081079 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:16.832153082 CEST | 443 | 49699 | 142.250.185.142 | 192.168.2.7 |
| Oct 2, 2024 17:25:16.832216024 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:16.850373983 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:16.850408077 CEST | 443 | 49699 | 142.250.185.142 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.065316916 CEST | 49675 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 2, 2024 17:25:17.080867052 CEST | 49674 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 2, 2024 17:25:17.158998013 CEST | 49672 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 2, 2024 17:25:17.507467985 CEST | 443 | 49699 | 142.250.185.142 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.507810116 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:17.507823944 CEST | 443 | 49699 | 142.250.185.142 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.508214951 CEST | 443 | 49699 | 142.250.185.142 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.508268118 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:17.509063005 CEST | 443 | 49699 | 142.250.185.142 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.509109974 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:17.510673046 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:17.510727882 CEST | 443 | 49699 | 142.250.185.142 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.510994911 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:17.511003017 CEST | 443 | 49699 | 142.250.185.142 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.568303108 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:17.830544949 CEST | 443 | 49699 | 142.250.185.142 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.830853939 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:17.831322908 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:17.831366062 CEST | 443 | 49699 | 142.250.185.142 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.831475973 CEST | 49699 | 443 | 192.168.2.7 | 142.250.185.142 |
| Oct 2, 2024 17:25:17.840770006 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:17.840810061 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.840989113 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:17.841192007 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:17.841206074 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.469644070 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.470083952 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:18.470113993 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.470523119 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.470654964 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:18.471244097 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.471313000 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:18.472343922 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:18.472414970 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.472527981 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:18.515410900 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.518440008 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:18.518465996 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.565301895 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:18.781598091 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.781625032 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.781687021 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:18.781692028 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:18.781734943 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:18.784697056 CEST | 49705 | 443 | 192.168.2.7 | 142.250.184.238 |
| Oct 2, 2024 17:25:18.784723043 CEST | 443 | 49705 | 142.250.184.238 | 192.168.2.7 |
| Oct 2, 2024 17:25:19.571542978 CEST | 49671 | 443 | 192.168.2.7 | 204.79.197.203 |
| Oct 2, 2024 17:25:20.536669970 CEST | 443 | 49698 | 104.98.116.138 | 192.168.2.7 |
| Oct 2, 2024 17:25:20.536861897 CEST | 49698 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 2, 2024 17:25:20.536964893 CEST | 443 | 49698 | 104.98.116.138 | 192.168.2.7 |
| Oct 2, 2024 17:25:20.537004948 CEST | 49698 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 2, 2024 17:25:20.537731886 CEST | 443 | 49698 | 104.98.116.138 | 192.168.2.7 |
| Oct 2, 2024 17:25:20.537772894 CEST | 49698 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 2, 2024 17:25:20.603956938 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:20.604013920 CEST | 443 | 49709 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:20.604093075 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:20.604317904 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:20.604336977 CEST | 443 | 49709 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:20.727910995 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 2, 2024 17:25:20.906586885 CEST | 443 | 49698 | 104.98.116.138 | 192.168.2.7 |
| Oct 2, 2024 17:25:20.906650066 CEST | 49698 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 2, 2024 17:25:21.488430023 CEST | 49710 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:21.488487959 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:21.488590002 CEST | 49710 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:21.515541077 CEST | 49710 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:21.515563965 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:21.541652918 CEST | 443 | 49709 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:21.587212086 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:21.590972900 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:21.590993881 CEST | 443 | 49709 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:21.592109919 CEST | 443 | 49709 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:21.593527079 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:21.597157955 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:21.597238064 CEST | 443 | 49709 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:21.649699926 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:21.649733067 CEST | 443 | 49709 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:21.696536064 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:22.161077023 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:22.161154032 CEST | 49710 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:22.165802956 CEST | 49710 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:22.165815115 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:22.166125059 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:22.212172985 CEST | 49710 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:22.217504978 CEST | 49710 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:22.263395071 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:22.444454908 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:22.444614887 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:22.444663048 CEST | 49710 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:22.444700956 CEST | 49710 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:22.444700956 CEST | 49710 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:22.444716930 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:22.444729090 CEST | 443 | 49710 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:22.565510035 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:22.565551043 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:22.565629959 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:22.565948963 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:22.565954924 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:23.218519926 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:23.219306946 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:23.219964027 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:23.219980955 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:23.220257044 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:23.221447945 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:23.263408899 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:23.492224932 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:23.492294073 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:23.494326115 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:23.494326115 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:23.495352030 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 2, 2024 17:25:23.495371103 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 2, 2024 17:25:27.754709005 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:27.754770041 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:27.754842997 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:27.756261110 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:27.756279945 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.415637016 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.415981054 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:28.415996075 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.417330980 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.417398930 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:28.418150902 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.418198109 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:28.419333935 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:28.419418097 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.419498920 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:28.419507027 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.462502956 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:28.714987040 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:28.715037107 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.715102911 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:28.717201948 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:28.717226982 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.999588966 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.999692917 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.999732018 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.999748945 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:28.999772072 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:28.999799967 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.005656958 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.005707979 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.005717039 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.011845112 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.011878014 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.011900902 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.011909962 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.011970997 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.018081903 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.018157959 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.024350882 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.024422884 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.024461985 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.024518013 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.086401939 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.086462975 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.086482048 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.086496115 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.086535931 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.088515043 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.088566065 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.094422102 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.094477892 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.094959974 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.095016956 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.100852013 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.100920916 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.107369900 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.107429981 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.107498884 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.113622904 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.113677025 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.113701105 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.119961977 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.120016098 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.120028019 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.120280027 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.120335102 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.148175001 CEST | 49727 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.148199081 CEST | 443 | 49727 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.495028973 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.495054007 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.495348930 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.495348930 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.495377064 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.520051956 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.520215988 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:29.548543930 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.548594952 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.548717022 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.550668001 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:29.550683022 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.572974920 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:29.573044062 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.573378086 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.620512009 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:30.202490091 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.202852011 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.202888966 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.203262091 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.203330040 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.203974009 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.204030037 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.204890966 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.204951048 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.205183029 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.205189943 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.236507893 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.236896992 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.236927986 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.237765074 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.237848997 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.238464117 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.238523960 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.238682032 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.238789082 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.238888979 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.238895893 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.246727943 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.291971922 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.506489038 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:30.506716013 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.507133007 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.507217884 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.507394075 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.507411957 CEST | 443 | 49734 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.507445097 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.507466078 CEST | 49734 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.508538961 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.508577108 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.508641958 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.509711027 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.509728909 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.536102057 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.536523104 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.536576033 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.536751986 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.536772966 CEST | 443 | 49733 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.536784887 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.536818981 CEST | 49733 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.537724972 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.537810087 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.537894011 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.538136959 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:30.538167000 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.547400951 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.766733885 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.766778946 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.766787052 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.766797066 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.766832113 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.766865015 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:30.766932964 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.766964912 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:30.766988039 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:30.767024040 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.767095089 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:30.767108917 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.767338037 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:30.767431021 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:31.159840107 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.164293051 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.164315939 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.164726973 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.164782047 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.165452957 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.165503979 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.168483973 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.168580055 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.168934107 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.168945074 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.168965101 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.212882042 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.212893963 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.273113012 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.273608923 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.273655891 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.274046898 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.274120092 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.274816036 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.274892092 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.275619984 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.275691032 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.275780916 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.275803089 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.275839090 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.321377993 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.321414948 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.392751932 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.393487930 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.393569946 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.399202108 CEST | 49739 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.399233103 CEST | 443 | 49739 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.442105055 CEST | 443 | 49709 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.442192078 CEST | 443 | 49709 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.442236900 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:31.500572920 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.501389027 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.501461983 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.516258001 CEST | 49740 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:31.516304970 CEST | 443 | 49740 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.581933022 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:31.581962109 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.581976891 CEST | 49729 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:25:31.581984043 CEST | 443 | 49729 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.719094038 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:31.719136953 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.719158888 CEST | 49709 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:31.719183922 CEST | 443 | 49709 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:31.719197989 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:31.719435930 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:31.719451904 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.363437891 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.365331888 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:32.365350008 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.365688086 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.367687941 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:32.367754936 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.367857933 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:32.411427021 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.633789062 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 2, 2024 17:25:32.636662006 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.636709929 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.636740923 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.636755943 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:32.636782885 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.636816025 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.636821032 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:32.636831045 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.636877060 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:32.637072086 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.637124062 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:32.637165070 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:32.640014887 CEST | 49745 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:25:32.640059948 CEST | 443 | 49745 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:25:36.399295092 CEST | 49748 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:36.399341106 CEST | 443 | 49748 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:36.399488926 CEST | 49748 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:36.400332928 CEST | 49748 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:36.400345087 CEST | 443 | 49748 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:37.031341076 CEST | 443 | 49748 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:37.031869888 CEST | 49748 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:37.031903982 CEST | 443 | 49748 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:37.032277107 CEST | 443 | 49748 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:37.034043074 CEST | 49748 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:37.034099102 CEST | 443 | 49748 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:37.034513950 CEST | 49748 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:37.034528971 CEST | 49748 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:37.034543037 CEST | 443 | 49748 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:37.367244959 CEST | 443 | 49748 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:37.367532015 CEST | 443 | 49748 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:25:37.367625952 CEST | 49748 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:37.368415117 CEST | 49748 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:25:37.368433952 CEST | 443 | 49748 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:00.389873028 CEST | 49751 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:00.389934063 CEST | 443 | 49751 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:00.390033960 CEST | 49751 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:00.390481949 CEST | 49751 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:00.390494108 CEST | 443 | 49751 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:00.795084000 CEST | 49752 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:00.795141935 CEST | 443 | 49752 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:00.795218945 CEST | 49752 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:00.795542002 CEST | 49752 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:00.795564890 CEST | 443 | 49752 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:01.882148981 CEST | 443 | 49751 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:01.882772923 CEST | 49751 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:01.882791996 CEST | 443 | 49751 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:01.883183956 CEST | 443 | 49751 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:01.883618116 CEST | 49751 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:01.883635044 CEST | 49751 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:01.883641005 CEST | 443 | 49751 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:01.883666992 CEST | 49751 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:01.883709908 CEST | 443 | 49751 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:01.931642056 CEST | 49751 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:02.187839985 CEST | 443 | 49751 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:02.188898087 CEST | 443 | 49751 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:02.188973904 CEST | 49751 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:02.189335108 CEST | 49751 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:02.189349890 CEST | 443 | 49751 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:02.231132984 CEST | 49753 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:02.231188059 CEST | 443 | 49753 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:02.231288910 CEST | 49753 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:02.231600046 CEST | 49753 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:02.231614113 CEST | 443 | 49753 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:02.738522053 CEST | 443 | 49752 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:02.747121096 CEST | 49752 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:02.747139931 CEST | 443 | 49752 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:02.748616934 CEST | 443 | 49752 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:02.749376059 CEST | 49752 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:02.749456882 CEST | 443 | 49752 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:02.749567032 CEST | 49752 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:02.749586105 CEST | 49752 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:02.749603033 CEST | 443 | 49752 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.083739996 CEST | 443 | 49753 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.084085941 CEST | 49753 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:03.084109068 CEST | 443 | 49753 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.084486008 CEST | 443 | 49753 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.084844112 CEST | 49753 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:03.084903955 CEST | 443 | 49753 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.085031986 CEST | 49753 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:03.085067987 CEST | 49753 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:03.085072994 CEST | 443 | 49753 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.304532051 CEST | 443 | 49753 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.306230068 CEST | 443 | 49753 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.306344986 CEST | 49753 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:03.307756901 CEST | 49753 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:03.307777882 CEST | 443 | 49753 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.381639957 CEST | 443 | 49752 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.381777048 CEST | 443 | 49752 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:03.381974936 CEST | 49752 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:03.382200956 CEST | 49752 | 443 | 192.168.2.7 | 216.58.206.46 |
| Oct 2, 2024 17:26:03.382221937 CEST | 443 | 49752 | 216.58.206.46 | 192.168.2.7 |
| Oct 2, 2024 17:26:11.411180973 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:11.411235094 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:11.411310911 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:11.411669016 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:11.411678076 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:12.192537069 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:12.192611933 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:12.197849035 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:12.197855949 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:12.198069096 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:12.245035887 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:13.033621073 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:13.079406023 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.292859077 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.292891979 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.292900085 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.292912006 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.292937994 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.293162107 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:13.293179989 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.293237925 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:13.293565989 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.293601990 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.293626070 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:13.293631077 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.293653011 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:13.293678999 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.293718100 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:13.955420017 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:13.955466986 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:13.955483913 CEST | 49754 | 443 | 192.168.2.7 | 4.175.87.197 |
| Oct 2, 2024 17:26:13.955492020 CEST | 443 | 49754 | 4.175.87.197 | 192.168.2.7 |
| Oct 2, 2024 17:26:20.233294010 CEST | 49758 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:26:20.233344078 CEST | 443 | 49758 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:26:20.233417034 CEST | 49758 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:26:20.233946085 CEST | 49758 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:26:20.233959913 CEST | 443 | 49758 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:26:20.886161089 CEST | 443 | 49758 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:26:20.886466026 CEST | 49758 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:26:20.886495113 CEST | 443 | 49758 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:26:20.886831045 CEST | 443 | 49758 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:26:20.887135029 CEST | 49758 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:26:20.887195110 CEST | 443 | 49758 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:26:20.946443081 CEST | 49758 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:26:31.128139973 CEST | 443 | 49758 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:26:31.128212929 CEST | 443 | 49758 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:26:31.128300905 CEST | 49758 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:26:33.464667082 CEST | 49758 | 443 | 192.168.2.7 | 142.250.184.196 |
| Oct 2, 2024 17:26:33.464745998 CEST | 443 | 49758 | 142.250.184.196 | 192.168.2.7 |
| Oct 2, 2024 17:27:19.677705050 CEST | 50148 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:27:19.682566881 CEST | 53 | 50148 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:27:19.682884932 CEST | 50148 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:27:19.682918072 CEST | 50148 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:27:19.687866926 CEST | 53 | 50148 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:27:20.130096912 CEST | 53 | 50148 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:27:20.130346060 CEST | 50148 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:27:20.135524035 CEST | 53 | 50148 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:27:20.136898041 CEST | 50148 | 53 | 192.168.2.7 | 1.1.1.1 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 17:25:16.425014019 CEST | 59204 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:25:16.425426960 CEST | 49798 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:25:16.509430885 CEST | 53 | 60552 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:16.509455919 CEST | 53 | 59204 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:16.509661913 CEST | 53 | 49798 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:16.775554895 CEST | 123 | 123 | 192.168.2.7 | 13.95.65.251 |
| Oct 2, 2024 17:25:16.861501932 CEST | 53 | 59294 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:16.949670076 CEST | 123 | 123 | 13.95.65.251 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.833370924 CEST | 50461 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:25:17.833370924 CEST | 56399 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:25:17.837037086 CEST | 53 | 57716 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.840100050 CEST | 53 | 56399 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:17.840325117 CEST | 53 | 50461 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:20.135124922 CEST | 52319 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:25:20.135432959 CEST | 49171 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:25:20.540595055 CEST | 53 | 52319 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:20.906301022 CEST | 53 | 49171 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:24.669154882 CEST | 53 | 55785 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:27.694005013 CEST | 49274 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:25:27.694286108 CEST | 65442 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:25:27.701082945 CEST | 53 | 49274 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:27.701098919 CEST | 53 | 65442 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.408812046 CEST | 53 | 60612 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.485909939 CEST | 55246 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:25:29.486110926 CEST | 63223 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:25:29.493268967 CEST | 53 | 55246 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:29.493393898 CEST | 53 | 63223 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:34.751878977 CEST | 53 | 59319 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:25:53.539716005 CEST | 53 | 53217 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:26:09.657450914 CEST | 138 | 138 | 192.168.2.7 | 192.168.2.255 |
| Oct 2, 2024 17:26:15.598229885 CEST | 53 | 49260 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:26:16.314699888 CEST | 53 | 57766 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:26:29.412260056 CEST | 53 | 55545 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:26:30.607570887 CEST | 55842 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:26:30.607717991 CEST | 55155 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 2, 2024 17:26:30.614343882 CEST | 53 | 55842 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:26:30.614717007 CEST | 53 | 55155 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:26:43.362147093 CEST | 53 | 65193 | 1.1.1.1 | 192.168.2.7 |
| Oct 2, 2024 17:27:19.675117970 CEST | 53 | 62221 | 1.1.1.1 | 192.168.2.7 |
| Timestamp | Source IP | Dest IP | Checksum | Code | Type |
|---|---|---|---|---|---|
| Oct 2, 2024 17:25:20.906574011 CEST | 192.168.2.7 | 1.1.1.1 | c200 | (Port unreachable) | Destination Unreachable |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 17:25:16.425014019 CEST | 192.168.2.7 | 1.1.1.1 | 0x2f3d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:25:16.425426960 CEST | 192.168.2.7 | 1.1.1.1 | 0x3c9f | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 17:25:17.833370924 CEST | 192.168.2.7 | 1.1.1.1 | 0xc5ef | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:25:17.833370924 CEST | 192.168.2.7 | 1.1.1.1 | 0x8024 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 17:25:20.135124922 CEST | 192.168.2.7 | 1.1.1.1 | 0xc04e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:25:20.135432959 CEST | 192.168.2.7 | 1.1.1.1 | 0x9ea9 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 17:25:27.694005013 CEST | 192.168.2.7 | 1.1.1.1 | 0x63b5 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:25:27.694286108 CEST | 192.168.2.7 | 1.1.1.1 | 0x877f | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 17:25:29.485909939 CEST | 192.168.2.7 | 1.1.1.1 | 0x64ea | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:25:29.486110926 CEST | 192.168.2.7 | 1.1.1.1 | 0x5748 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 17:26:30.607570887 CEST | 192.168.2.7 | 1.1.1.1 | 0x3bc6 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 17:26:30.607717991 CEST | 192.168.2.7 | 1.1.1.1 | 0x22b4 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 17:25:16.509455919 CEST | 1.1.1.1 | 192.168.2.7 | 0x2f3d | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:16.509661913 CEST | 1.1.1.1 | 192.168.2.7 | 0x3c9f | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 17:25:17.840100050 CEST | 1.1.1.1 | 192.168.2.7 | 0x8024 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840100050 CEST | 1.1.1.1 | 192.168.2.7 | 0x8024 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 216.58.212.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:17.840325117 CEST | 1.1.1.1 | 192.168.2.7 | 0xc5ef | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:20.540595055 CEST | 1.1.1.1 | 192.168.2.7 | 0xc04e | No error (0) | 142.250.184.196 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:20.906301022 CEST | 1.1.1.1 | 192.168.2.7 | 0x9ea9 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 17:25:27.701082945 CEST | 1.1.1.1 | 192.168.2.7 | 0x63b5 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:27.701082945 CEST | 1.1.1.1 | 192.168.2.7 | 0x63b5 | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:27.701098919 CEST | 1.1.1.1 | 192.168.2.7 | 0x877f | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 17:25:29.493268967 CEST | 1.1.1.1 | 192.168.2.7 | 0x64ea | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 17:26:30.614343882 CEST | 1.1.1.1 | 192.168.2.7 | 0x3bc6 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.7 | 49699 | 142.250.185.142 | 443 | 7892 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 15:25:17 UTC | 839 | OUT | |
| 2024-10-02 15:25:17 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.7 | 49705 | 142.250.184.238 | 443 | 7892 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 15:25:18 UTC | 857 | OUT | |
| 2024-10-02 15:25:18 UTC | 2634 | IN |