Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1524409 |
| MD5: | 983a1a23eb06ef4323ee7a01425e47ef |
| SHA1: | cbdbfb1f18152b7205e9b4a647b269fe0a413154 |
| SHA256: | c6b13a9fc461010cf268d60923813c067b7b2c382573f16d538067e8210ceba6 |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 68 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Classification
- System is w10x64
file.exe (PID: 6676 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 983A1A23EB06EF4323EE7A01425E47EF) 
taskkill.exe (PID: 6724 cmdline: taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) 
conhost.exe (PID: 6748 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
chrome.exe (PID: 6916 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://youtu be.com/acc ount?=http s://accoun ts.google. com/v3/sig nin/challe nge/pwd" - -start-ful lscreen -- no-first-r un --disab le-session -crashed-b ubble --di sable-info bars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6360 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2348 --fi eld-trial- handle=228 0,i,137782 3141692970 3980,17669 4599641221 29621,2621 44 /prefet ch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7864 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=57 96 --field -trial-han dle=2280,i ,137782314 1692970398 0,17669459 9641221296 21,262144 /prefetch: 8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7872 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=4864 --f ield-trial -handle=22 80,i,13778 2314169297 03980,1766 9459964122 129621,262 144 /prefe tch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_001BDBBE | |
| Source: | Code function: | 0_2_001C68EE | |
| Source: | Code function: | 0_2_001C698F | |
| Source: | Code function: | 0_2_001BD076 | |
| Source: | Code function: | 0_2_001BD3A9 | |
| Source: | Code function: | 0_2_001C9642 | |
| Source: | Code function: | 0_2_001C979D | |
| Source: | Code function: | 0_2_001C9B2B | |
| Source: | Code function: | 0_2_001C5C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_001CCE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_001CEAFF | |
| Source: | Code function: | 0_2_001CED6A | |
| Source: | Code function: | 0_2_001CEAFF | |
| Source: | Code function: | 0_2_001BAA57 | |
| Source: | Code function: | 0_2_001E9576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_2ad8575e-9 | |
| Source: | String found in binary or memory: | memstr_62ba9946-7 | |
| Source: | String found in binary or memory: | memstr_1c14c61d-a | |
| Source: | String found in binary or memory: | memstr_5829edae-1 | |
| Source: | Code function: | 0_2_001BD5EB | |
| Source: | Code function: | 0_2_001B1201 | |
| Source: | Code function: | 0_2_001BE8F6 | |
| Source: | Code function: | 0_2_0015BF40 | |
| Source: | Code function: | 0_2_001C2046 | |
| Source: | Code function: | 0_2_00158060 | |
| Source: | Code function: | 0_2_001B8298 | |
| Source: | Code function: | 0_2_0018E4FF | |
| Source: | Code function: | 0_2_0018676B | |
| Source: | Code function: | 0_2_001E4873 | |
| Source: | Code function: | 0_2_0017CAA0 | |
| Source: | Code function: | 0_2_0015CAF0 | |
| Source: | Code function: | 0_2_0016CC39 | |
| Source: | Code function: | 0_2_00186DD9 | |
| Source: | Code function: | 0_2_0016B119 | |
| Source: | Code function: | 0_2_001591C0 | |
| Source: | Code function: | 0_2_00171394 | |
| Source: | Code function: | 0_2_00171706 | |
| Source: | Code function: | 0_2_0017781B | |
| Source: | Code function: | 0_2_00157920 | |
| Source: | Code function: | 0_2_0016997D | |
| Source: | Code function: | 0_2_001719B0 | |
| Source: | Code function: | 0_2_00177A4A | |
| Source: | Code function: | 0_2_00171C77 | |
| Source: | Code function: | 0_2_00177CA7 | |
| Source: | Code function: | 0_2_001DBE44 | |
| Source: | Code function: | 0_2_00189EEE | |
| Source: | Code function: | 0_2_00171F32 | |
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_001C37B5 | |
| Source: | Code function: | 0_2_001B10BF | |
| Source: | Code function: | 0_2_001B16C3 | |
| Source: | Code function: | 0_2_001C51CD | |
| Source: | Code function: | 0_2_001DA67C | |
| Source: | Code function: | 0_2_001C648E | |
| Source: | Code function: | 0_2_001542A2 | |
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_001542DE | |
| Source: | Code function: | 0_2_00170A89 | |
| Source: | Code function: | 0_2_0016F98E | |
| Source: | Code function: | 0_2_001E1C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-97509 | ||
| Source: | API coverage: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_001BDBBE | |
| Source: | Code function: | 0_2_001C68EE | |
| Source: | Code function: | 0_2_001C698F | |
| Source: | Code function: | 0_2_001BD076 | |
| Source: | Code function: | 0_2_001BD3A9 | |
| Source: | Code function: | 0_2_001C9642 | |
| Source: | Code function: | 0_2_001C979D | |
| Source: | Code function: | 0_2_001C9B2B | |
| Source: | Code function: | 0_2_001C5C97 | |
| Source: | Code function: | 0_2_001542DE | |
Anti Debugging | |
|---|
| Source: | Debugger detection routine: | graph_0-96630 | ||
| Source: | Code function: | 0_2_001CEAA2 | |
| Source: | Code function: | 0_2_00182622 | |
| Source: | Code function: | 0_2_001542DE | |
| Source: | Code function: | 0_2_00174CE8 | |
| Source: | Code function: | 0_2_001B0B62 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_00182622 | |
| Source: | Code function: | 0_2_0017083F | |
| Source: | Code function: | 0_2_001709D5 | |
| Source: | Code function: | 0_2_00170C21 | |
| Source: | Code function: | 0_2_001B1201 | |
| Source: | Code function: | 0_2_00192BA5 | |
| Source: | Code function: | 0_2_0016F98E | |
| Source: | Code function: | 0_2_001D22DA | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_001B0B62 | |
| Source: | Code function: | 0_2_001B1663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00170698 | |
| Source: | Code function: | 0_2_001C8195 | |
| Source: | Code function: | 0_2_001AD27A | |
| Source: | Code function: | 0_2_0018BB6F | |
| Source: | Code function: | 0_2_001542DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 0_2_001D1204 | |
| Source: | Code function: | 0_2_001D1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 2 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 16 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 2 Valid Accounts | LSA Secrets | 22 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 2 Virtualization/Sandbox Evasion | Cached Domain Credentials | 2 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 21 Access Token Manipulation | DCSync | 2 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 2 Process Injection | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 11% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.185.142 | true | false | unknown | |
| www3.l.google.com | 142.250.185.78 | true | false | unknown | |
| play.google.com | 142.250.185.174 | true | false | unknown | |
| www.google.com | 172.217.23.100 | true | false | unknown | |
| youtube.com | 142.250.185.78 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.185.78 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 216.58.206.78 | unknown | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.174 | play.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.142 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.23.100 | www.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.4 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1524409 |
| Start date and time: | 2024-10-02 18:59:51 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 54s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 13 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal68.troj.evad.winEXE@34/32@12/7 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 172.217.16.195, 66.102.1.84, 142.250.185.206, 34.104.35.123, 142.250.184.195, 142.250.185.138, 142.250.184.202, 142.250.185.106, 172.217.16.138, 142.250.184.234, 172.217.18.10, 142.250.185.74, 216.58.206.42, 216.58.212.170, 142.250.185.234, 142.250.186.170, 142.250.185.170, 142.250.186.42, 142.250.181.234, 142.250.186.106, 142.250.185.202, 93.184.221.240, 192.229.221.95, 142.250.186.74, 142.250.186.138, 172.217.16.202, 172.217.18.106, 216.58.212.138, 216.58.206.74, 142.250.185.67, 64.233.166.84, 172.217.16.206
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
|
⊘No context
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.298162049824456 |
| Encrypted: | false |
| SSDEEP: | 48:o7vGoolL3ALFKphnpiu7xOKAcfO/3d/rYh4vZorw:o/QLUFUL4KA+2y0Mw |
| MD5: | CE055F881BDAB4EF6C1C8AA4B3890348 |
| SHA1: | 2671741A70E9F5B608F690AAEEA4972003747654 |
| SHA-256: | 9B91C23691D6032CDFE28863E369624B2EDB033E1487A1D1BB0977E3590E5462 |
| SHA-512: | 8A22250628985C2E570E6FBADFC0D5CB6753F0735130F9E74962A409476C2859C5C81F8A0F5C427A9F13ED399C8E251FA43FF67AD5F16860640D45E7A538E857 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.355381206612617 |
| Encrypted: | false |
| SSDEEP: | 48:o7FEEM3MtH15jNQ8jsK3rnw0dkckTrKEp/OqLE9xz0W5Bzv3M6hIHYA+JITbwrF8:oq675jOArwoAmI/DLaxNPL5m+m6w |
| MD5: | E2A7251AD83A0D0634FEA2703D10ED07 |
| SHA1: | 90D72011F31FC40D3DA3748F2817F90A29EB5C01 |
| SHA-256: | 1079B49C4AAF5C10E4F2E6A086623F40D200A71FF2A1F64E88AA6C91E4BE7A6F |
| SHA-512: | CD6D75580EA8BD97CF7C7C0E0BD9D9A54FB6EA7DF1DDB5A95E94D38B260F9EE1425C640839ECD229B8D01E145CF2786CA374D31EC537EB8FE17FF415D5B985F5 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1652 |
| Entropy (8bit): | 5.269909938363071 |
| Encrypted: | false |
| SSDEEP: | 48:o72ZrNZDuZW4yNAbU+15fMxIdf5WENoBCbw7DbG2bEJrw:oyRuZMNAY+1i4HoBNG2Ilw |
| MD5: | 63E5B24335CCDC457DD0B69AD1891CF9 |
| SHA1: | 8DD3AED0737BEDBEE133BA564D3CA43579A138F7 |
| SHA-256: | FB72BE79F85659D5AF831FD644C4702EA5BFC6E6A90CDB156DE0816B179278C0 |
| SHA-512: | EC3A143FED571A7FC490433F11DDBD66752E42F0BAC476F79F9B8310DB0419CAE2B8CD65F1283D590F5979F4CC1FB8B2610F106BF38E0B93F384201B8BF5E5DA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,NwH0H,OmgaI,gychg,w9hDv,EEDORb,Mlhmy,ZfAoz,kWgXee,ovKuLd,yDVVkb,ebZ3mb,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22833 |
| Entropy (8bit): | 5.425034548615223 |
| Encrypted: | false |
| SSDEEP: | 384:7lFo6ZEdpgtmyiPixV9OX9gMBpHkHnfst9lZulagGcwYHiRFjJzN7:77o6ZviPixV8xpEHn89l4IgGcwYCRtb7 |
| MD5: | 749B18538FE32BFE0815D75F899F5B21 |
| SHA1: | AF95A019211AF69F752A43CAA54A83C2AFD41D28 |
| SHA-256: | 116B2687C1D5E00DB56A79894AB0C12D4E2E000B9379B7E7AD751B84DF611F3F |
| SHA-512: | E4B6F4556AA0FD9979BB52681508F5E26FFB256473803F74F7F5C8D93FA3636D7D0A5835618FBC6123022805CE0D9616A7451A0F302C665E28A6090B5D588505 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.404371326611379 |
| Encrypted: | false |
| SSDEEP: | 192:EEFZpeip4HzZlY0If0Ma23jcUcrhCx6VD1TYPi8:Es/p4jgjUhtD1TY68 |
| MD5: | 21E893B65627B397E22619A9F5BB9662 |
| SHA1: | F561B0F66211C1E7B22F94B4935C312AB7087E85 |
| SHA-256: | FFA9B8BC8EF2CDFF5EB4BA1A0BA1710A253A5B42535E2A369D5026967DCF4673 |
| SHA-512: | 3DE3CD6A4E9B06AB3EB324E90A40B5F2AEEA8D7D6A2651C310E993CF79EEB5AC6E2E33C587F46B2DD20CC862354FD1A61AEBB9B990E6805F6629404BA285F8FA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 743936 |
| Entropy (8bit): | 5.791086230020914 |
| Encrypted: | false |
| SSDEEP: | 6144:YVXWBQkPdzg5pTX1ROv/duPzd8C3s891/N:Nfd8j91/N |
| MD5: | 1A3606C746E7B1C949D9078E8E8C1244 |
| SHA1: | 56A3EB1E93E61ACD7AAD39DC3526CB60E23651B1 |
| SHA-256: | 5F49AE5162183E2EF6F082B29EC99F18DB0212B8ADDB03699B1BFB0AC7869742 |
| SHA-512: | F2D15243311C472331C5F3F083BB6C18D38EC0247A3F3CBAFD96DBA40E4EAE489CDA04176672E39FE3760EF7347596B2A5EAB0FB0125E881EF514475C99863B9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlE6O04h0gj7Nu50q-nmaRKM6WWcJw/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1416 |
| Entropy (8bit): | 5.275155058463166 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7hqCsNRxoYTY9/qoVk7hz1l2p6vDMW94uEQOeGbCx4VGbgCSFBV87O/BprGJ:o7hv6oy12kvwKEeGbC6GbHSh/Hrw |
| MD5: | 4DB6842CDFAC9E03D7C1CF87E398B357 |
| SHA1: | 08158AB8F5947E048C88A1289E9E8CE9641B7CE9 |
| SHA-256: | 8991D23B586608AE114E150355FF192B30A379EAB1DC3F1444109DDC52B13AC1 |
| SHA-512: | FB7C461DFB96B10E099C3BA41C45AA904BB7D473EF0D44BD6A2E841BC44336DD5F1C9B73919B79A6BF4AA13B806E742F2003A16528E995374E210BB4C3E96EFA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4066 |
| Entropy (8bit): | 5.363016925556486 |
| Encrypted: | false |
| SSDEEP: | 96:G2CiFZX5BReR68ujioIRVrqtyzBeTV6SfyAKLif9c7w:bCMZXVeR6jiosVrqtyzBaImyAKw9x |
| MD5: | FC5E597D923838E10390DADD12651A81 |
| SHA1: | C9959F8D539DB5DF07B8246EC12539B6A9CC101F |
| SHA-256: | A7EBD5280C50AE93C061EAE1E9727329E015E97531F8F2D82D0E3EA76ADB37B4 |
| SHA-512: | 784CA572808F184A849388723FBB3701E6981D885BBA8A330A933F90BF0B36A2E4A491D4463A27911B1D9F7A7134F23E15F187FC7CB4554EAE9BC252513EED7C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 358799 |
| Entropy (8bit): | 5.624587482410481 |
| Encrypted: | false |
| SSDEEP: | 6144:T/wM8RGYcBlKmhCxiDlnc0pYMSrBg5X3rU:TD8XxEdA |
| MD5: | A51DFF6CB98C15CBA0A2B688CC0A862F |
| SHA1: | 5CF15DBD322A0F9CF3A820013E185EC2EDD56BB0 |
| SHA-256: | 854215C9FE46B6029883F37C44512F7EB10BA97FC7A623C237DC6824BD92DB1E |
| SHA-512: | D1036F2C4AE71BE22315D5AEC062E1D59EA2570D7138B97F367149C9622BEE35EAC1DBE9818AC7BE107D88683089EBE220951D025CC11908055B108B27D7BD86 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,EFQ78c,EIOG1e,GwYlN,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,y5vRwf,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 339747 |
| Entropy (8bit): | 5.53363647964667 |
| Encrypted: | false |
| SSDEEP: | 3072:Vuv7kVKtaVFuzDXG6ZfzeelpRv9xqjne01T2HemAIaDlC6diGVOY50UlRQQIBeDq:svaKtM6ZfTxene0F2HemAaGP6BBe2 |
| MD5: | D2D05D80ACF53F04C1BEB6A387216F5E |
| SHA1: | 6E8B87D352419E28C5F8E3881787DC6C56CEB26E |
| SHA-256: | 4BA0D4EA27446C609D515539A334E3B16A4AC7BF936A996CF7E3927FFDDD569F |
| SHA-512: | 966582697B455B2DDC52210A0F46EFD77EDC67D668E7FC2F14E18DF38E8595472AB76ED17B9D2928E16FA987E3231C2A45D9BD52D9DC2CE7E4C394E2453518E6 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5050 |
| Entropy (8bit): | 5.289052544075544 |
| Encrypted: | false |
| SSDEEP: | 96:o4We0hP7OBFXYvB1sig3Fd8HkaXzLmUrv8Vh1WJlLQXT2v2gqw:655758Fd8HkaPZ0GmAD |
| MD5: | 26E26FD11772DFF5C7004BEA334289CC |
| SHA1: | 638DAAF541BDE31E95AEE4F8ADA677434D7051DB |
| SHA-256: | ADFE3E4960982F5EF4C043052A9990D8683C5FC2B590E817B6B1A5774DDE2CE3 |
| SHA-512: | C31929EB6D1C60D6A84A2574FF60490394A6D6F9B354972F3328952F570D80B3F2AEC916B0E1B66DDB1AC056EB75BFAC477E7AF631D0AD1810EDBAF025465D66 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3467 |
| Entropy (8bit): | 5.514745431912774 |
| Encrypted: | false |
| SSDEEP: | 96:ozbld2fNUmeqJNizhNtt1W8t//loyIpXmdVE2w:onSKE8PWe/Cy4X3j |
| MD5: | 8DEF399E8355ABC23E64505281005099 |
| SHA1: | 24FF74C3AEFD7696D84FF148465DF4B1B60B1696 |
| SHA-256: | F128D7218E1286B05DF11310AD3C8F4CF781402698E45448850D2A3A22F5F185 |
| SHA-512: | 33721DD47658D8E12ADF6BD9E9316EB89F5B6297927F7FD60F954E04B829DCBF0E1AE6DDD9A3401F45E0011AE4B1397B960C218238A3D0F633A2173D8E604082 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32500 |
| Entropy (8bit): | 5.378903546681047 |
| Encrypted: | false |
| SSDEEP: | 768:zYlbuROstb0e39nKGrkysU0smpu4OLOdzIf1p/5GeSsngurz6aKEEEGo/:zYl61Cysbu4OLOdzIfrIen72ZFo/ |
| MD5: | BF4BF9728A7C302FBA5B14F3D0F1878B |
| SHA1: | 2607CA7A93710D629400077FF3602CB207E6F53D |
| SHA-256: | 8981E7B228DF7D6A8797C0CD1E9B0F1F88337D5F0E1C27A04E7A57D2C4309798 |
| SHA-512: | AC9E170FC3AFDC0CF6BB8E926B93EF129A5FAD1BBA51B60BABCF3555E9B652E98F86A00FB099879DED35DD3FFE72ECFA597E20E6CA8CF402BEDEC40F78412EDA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.582233693166294 |
| TrID: |
|
| File name: | file.exe |
| File size: | 918'528 bytes |
| MD5: | 983a1a23eb06ef4323ee7a01425e47ef |
| SHA1: | cbdbfb1f18152b7205e9b4a647b269fe0a413154 |
| SHA256: | c6b13a9fc461010cf268d60923813c067b7b2c382573f16d538067e8210ceba6 |
| SHA512: | 0b6a58488a57d4af1c21ad6c7e276c7a48e6b112458f553fc7e2bac2503b5fc42431bc5381cf9adc8605967359623f0759fd868ffb3e26401591bc3d997e1c34 |
| SSDEEP: | 12288:PqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDganTL:PqDEvCTbMWu7rQYlBQcBiT6rprG8aTL |
| TLSH: | 6A159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FD7297 [Wed Oct 2 16:19:35 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007FB47D13BE83h |
| jmp 00007FB47D13B78Fh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FB47D13B96Dh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FB47D13B93Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007FB47D13E52Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007FB47D13E578h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007FB47D13E561h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9900 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9900 | 0x9a00 | 2b772f554bc4074376b7de80ff3b6982 | False | 0.3019226866883117 | data | 5.277448268855475 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xbc6 | data | 1.0036496350364963 | ||
| RT_GROUP_ICON | 0xdd380 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd3f8 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd40c | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd420 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd434 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd510 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 19:00:50.898499012 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:50.898551941 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:50.898607969 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:50.899785042 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:50.899800062 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.069084883 CEST | 49675 | 443 | 192.168.2.4 | 173.222.162.32 |
| Oct 2, 2024 19:00:51.551424026 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.551942110 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:51.551959038 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.552401066 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.552462101 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:51.553390980 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.553442001 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:51.557650089 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:51.557746887 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.559902906 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:51.559923887 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.600235939 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:51.852585077 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.852688074 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.852910042 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:51.853228092 CEST | 49732 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:51.853245020 CEST | 443 | 49732 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.863426924 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:51.863482952 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.863575935 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:51.863857985 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:51.863888979 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.568443060 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.582029104 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:52.582066059 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.582649946 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.582742929 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:52.583359003 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.583415031 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:52.612472057 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:52.612641096 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:52.612649918 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.659404039 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.661525965 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:52.661572933 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.708410025 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:52.915081978 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.915164948 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:52.915188074 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.915200949 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:52.915255070 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:52.919553041 CEST | 49734 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:00:52.919565916 CEST | 443 | 49734 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:00:55.222531080 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:00:55.222589970 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:00:55.222652912 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:00:55.222839117 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:00:55.222855091 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:00:55.883508921 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:00:55.883734941 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:00:55.883763075 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:00:55.884685993 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:00:55.884751081 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:00:55.925347090 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:00:55.925508976 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:00:55.975574017 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:00:55.975589037 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:00:56.020895958 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:00:59.595680952 CEST | 49755 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:00:59.595719099 CEST | 443 | 49755 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:00:59.595803976 CEST | 49755 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:00:59.598339081 CEST | 49755 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:00:59.598351955 CEST | 443 | 49755 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:00:59.727281094 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:59.727324009 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:00:59.727395058 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:59.727828026 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:00:59.727838993 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.252151012 CEST | 443 | 49755 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.252302885 CEST | 49755 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:00.366313934 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.392584085 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.392653942 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.393307924 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.393384933 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.394025087 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.394083977 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.398821115 CEST | 49755 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:00.398834944 CEST | 443 | 49755 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.399805069 CEST | 443 | 49755 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.438499928 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.438925028 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.439349890 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.439409971 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.451936960 CEST | 49755 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:00.486951113 CEST | 49755 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:00.488550901 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.531409025 CEST | 443 | 49755 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.672152042 CEST | 443 | 49755 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.672337055 CEST | 443 | 49755 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.672398090 CEST | 49755 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:00.672507048 CEST | 49755 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:00.672507048 CEST | 49755 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:00.672528028 CEST | 443 | 49755 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.672538042 CEST | 443 | 49755 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.687371016 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.687545061 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.687611103 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.687644005 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.687695980 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.692981958 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.693104029 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.699189901 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.699276924 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.699296951 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.699347973 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.705423117 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.705490112 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.711653948 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.711724997 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.711752892 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.711813927 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.767782927 CEST | 49759 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:00.767867088 CEST | 443 | 49759 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.767950058 CEST | 49759 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:00.768304110 CEST | 49759 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:00.768327951 CEST | 443 | 49759 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.775548935 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.775621891 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.775665045 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.775712013 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.776019096 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.776072025 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.783473015 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.783540964 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.783565998 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.783617973 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.789338112 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.789400101 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.794596910 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.794660091 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.794682026 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.800853014 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.800904989 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.800918102 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.807559013 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.807614088 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.807631969 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.807888985 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:00.807950974 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.808015108 CEST | 49756 | 443 | 192.168.2.4 | 142.250.185.78 |
| Oct 2, 2024 19:01:00.808048964 CEST | 443 | 49756 | 142.250.185.78 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.443876982 CEST | 443 | 49759 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.443984985 CEST | 49759 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:01.452440977 CEST | 49759 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:01.452474117 CEST | 443 | 49759 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.452769995 CEST | 443 | 49759 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.453850985 CEST | 49759 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:01.495438099 CEST | 443 | 49759 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.747569084 CEST | 443 | 49759 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.747638941 CEST | 443 | 49759 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.747703075 CEST | 49759 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:01.781202078 CEST | 49759 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:01.781233072 CEST | 443 | 49759 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.781244993 CEST | 49759 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:01:01.781251907 CEST | 443 | 49759 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.832036018 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:01.832091093 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.832149029 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:01.832479000 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:01.832489967 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.896907091 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:01.896956921 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.897016048 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:01.916538000 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:01.916558981 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.461762905 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.468525887 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.468535900 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.469187021 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.469250917 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.470242023 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.470305920 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.471451044 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.471539974 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.472009897 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.472021103 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.513377905 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.545026064 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.546793938 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.546803951 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.547195911 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.547254086 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.548012972 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.548064947 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.549513102 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.549582005 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.556035042 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.556041956 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.599534988 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.761703014 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.762214899 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.762269020 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.764193058 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.764215946 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.766172886 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.766216993 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.766292095 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.766813993 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.766832113 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.843847036 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.843966007 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.844027996 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.873557091 CEST | 49763 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.873584032 CEST | 443 | 49763 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.875680923 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.875725985 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:02.875881910 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.876815081 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:02.876827002 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.343283892 CEST | 49672 | 443 | 192.168.2.4 | 173.222.162.32 |
| Oct 2, 2024 19:01:03.343373060 CEST | 443 | 49672 | 173.222.162.32 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.475723028 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.476130962 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.476149082 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.477699041 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.477797985 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.478825092 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.478884935 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.479157925 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.479218960 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.479271889 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.479271889 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.479290962 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.524370909 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.524379015 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.560266972 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.560519934 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.560532093 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.560976028 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.561036110 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.561731100 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.561777115 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.561973095 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.562037945 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.562150002 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.562160015 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.562174082 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.571048021 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.602302074 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.602312088 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.704380989 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.704724073 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.704778910 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.705657005 CEST | 49765 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.705677032 CEST | 443 | 49765 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.783330917 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.784457922 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.784579992 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.785444021 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:03.785468102 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:03.837894917 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:01:03.883404016 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:04.160641909 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:04.160712004 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:04.160759926 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:04.160785913 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:01:04.160805941 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:04.160846949 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:01:04.160854101 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:04.160957098 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:04.161072016 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:01:04.167298079 CEST | 49740 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:01:04.167314053 CEST | 443 | 49740 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:04.215734959 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:04.215842009 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:04.215934038 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:04.221970081 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:04.222007036 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:05.109705925 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:05.109885931 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:05.219377041 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:05.219480038 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:05.219851971 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:05.264374971 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:06.244827032 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:06.287400007 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:06.511349916 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:06.511373997 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:06.511380911 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:06.511430025 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:06.511440992 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:06.511491060 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:06.511516094 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:06.511574030 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:06.511574984 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:06.511594057 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:06.511621952 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:06.511642933 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:06.511873007 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:06.511938095 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:06.511986971 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:07.210269928 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:07.210314035 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:07.210333109 CEST | 49769 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:07.210344076 CEST | 443 | 49769 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:08.727724075 CEST | 49775 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:08.727767944 CEST | 443 | 49775 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:08.727890015 CEST | 49775 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:08.728210926 CEST | 49775 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:08.728224993 CEST | 443 | 49775 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:09.542891026 CEST | 443 | 49775 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:09.543320894 CEST | 49775 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:09.543351889 CEST | 443 | 49775 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:09.543796062 CEST | 443 | 49775 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:09.544090033 CEST | 49775 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:09.544173956 CEST | 443 | 49775 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:09.544234991 CEST | 49775 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:09.544258118 CEST | 49775 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:09.544267893 CEST | 443 | 49775 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:09.874568939 CEST | 443 | 49775 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:09.875149965 CEST | 443 | 49775 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:09.875211000 CEST | 49775 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:09.885853052 CEST | 49775 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:09.885895967 CEST | 443 | 49775 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:32.087793112 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:32.087855101 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:32.087943077 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:32.088172913 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:32.088191986 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:32.723623037 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:32.724097013 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:32.724114895 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:32.724486113 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:32.724780083 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:32.724837065 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:32.724922895 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:32.724941015 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:32.724946976 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:32.930612087 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:32.930705070 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:32.930813074 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:32.931209087 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:32.931226969 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.034229994 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.034926891 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.035000086 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.035161972 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.035180092 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.165591955 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.165651083 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.165750027 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.166479111 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.166493893 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.594170094 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.594516039 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.594578028 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.595865965 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.596519947 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.596714973 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.596733093 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.596756935 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.596827984 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.646248102 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.898339987 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.899169922 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.899260998 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.899399042 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.899442911 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.987958908 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.988713980 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.988743067 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.989109993 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.989522934 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.989592075 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:33.989701033 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.989723921 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:33.989737034 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:34.207262039 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:34.207653999 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:34.207732916 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:34.239334106 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 19:01:34.239362955 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 19:01:43.564158916 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:43.564208984 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:43.564332008 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:43.564688921 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:43.564703941 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.344053984 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.344142914 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:44.351213932 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:44.351223946 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.352202892 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.360353947 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:44.403412104 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.725258112 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.725286961 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.725305080 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.725393057 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:44.725415945 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.725471020 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:44.726257086 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.726296902 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.726319075 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:44.726325989 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.726352930 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:44.726963997 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.727029085 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:44.731017113 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:44.731031895 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:44.731057882 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 19:01:44.731062889 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 19:01:55.225718975 CEST | 49787 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:01:55.225764036 CEST | 443 | 49787 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:55.225863934 CEST | 49787 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:01:55.226099014 CEST | 49787 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:01:55.226114035 CEST | 443 | 49787 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:55.880779982 CEST | 443 | 49787 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:55.881612062 CEST | 49787 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:01:55.881633043 CEST | 443 | 49787 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:55.882097006 CEST | 443 | 49787 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:55.882359028 CEST | 49787 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:01:55.882440090 CEST | 443 | 49787 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:01:55.929183006 CEST | 49787 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:02:02.900083065 CEST | 49789 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:02.900115967 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:02.900180101 CEST | 49789 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:02.900424004 CEST | 49789 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:02.900437117 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:03.556391001 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:03.556688070 CEST | 49789 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:03.556704998 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:03.558374882 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:03.558778048 CEST | 49789 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:03.558836937 CEST | 49789 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:03.558842897 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:03.558856964 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:03.558859110 CEST | 49789 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:03.599112034 CEST | 49789 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:03.599117994 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:03.857779980 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:03.858982086 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:03.859040976 CEST | 49789 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:03.859268904 CEST | 49789 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:03.859286070 CEST | 443 | 49789 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:04.557351112 CEST | 49790 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:04.557382107 CEST | 443 | 49790 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:04.557465076 CEST | 49790 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:04.557787895 CEST | 49790 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:04.557802916 CEST | 443 | 49790 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.199815989 CEST | 443 | 49790 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.200298071 CEST | 49790 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:05.200325012 CEST | 443 | 49790 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.200650930 CEST | 443 | 49790 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.201083899 CEST | 49790 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:05.201143980 CEST | 443 | 49790 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.201286077 CEST | 49790 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:05.201353073 CEST | 49790 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:05.201359987 CEST | 443 | 49790 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.507905006 CEST | 443 | 49790 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.508217096 CEST | 443 | 49790 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.508297920 CEST | 49790 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:05.508527040 CEST | 49790 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:05.508569956 CEST | 443 | 49790 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.783701897 CEST | 443 | 49787 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.783879995 CEST | 443 | 49787 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:02:05.783927917 CEST | 49787 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:02:19.319885015 CEST | 49787 | 443 | 192.168.2.4 | 172.217.23.100 |
| Oct 2, 2024 19:02:19.319921017 CEST | 443 | 49787 | 172.217.23.100 | 192.168.2.4 |
| Oct 2, 2024 19:02:32.880994081 CEST | 49792 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:32.881050110 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:32.881177902 CEST | 49792 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:32.881846905 CEST | 49792 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:32.881861925 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:33.521349907 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:33.538386106 CEST | 49792 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:33.538420916 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:33.539721966 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:33.549936056 CEST | 49792 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:33.550096989 CEST | 49792 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:33.550101995 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:33.550117970 CEST | 49792 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:33.550127029 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:33.591423988 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:33.599826097 CEST | 49792 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:33.823932886 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:33.824286938 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:33.824350119 CEST | 49792 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:33.824511051 CEST | 49792 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:33.824526072 CEST | 443 | 49792 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:36.698565006 CEST | 49793 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:36.698615074 CEST | 443 | 49793 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:36.698697090 CEST | 49793 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:36.699129105 CEST | 49793 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:36.699143887 CEST | 443 | 49793 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:37.497634888 CEST | 443 | 49793 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:37.498145103 CEST | 49793 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:37.498167992 CEST | 443 | 49793 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:37.499078035 CEST | 443 | 49793 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:37.499504089 CEST | 49793 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:37.499572039 CEST | 443 | 49793 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:37.499696016 CEST | 49793 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:37.499717951 CEST | 49793 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:37.499732018 CEST | 443 | 49793 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:37.797348022 CEST | 443 | 49793 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:37.798361063 CEST | 443 | 49793 | 216.58.206.78 | 192.168.2.4 |
| Oct 2, 2024 19:02:37.798424006 CEST | 49793 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:37.798754930 CEST | 49793 | 443 | 192.168.2.4 | 216.58.206.78 |
| Oct 2, 2024 19:02:37.798775911 CEST | 443 | 49793 | 216.58.206.78 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 19:00:50.874485016 CEST | 53 | 64883 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:50.874564886 CEST | 59491 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:00:50.874741077 CEST | 62880 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:00:50.882329941 CEST | 53 | 59491 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:50.882652044 CEST | 53 | 62880 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:50.883830070 CEST | 53 | 58395 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.855597019 CEST | 55288 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:00:51.855767012 CEST | 56576 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:00:51.862611055 CEST | 53 | 56576 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.862627983 CEST | 53 | 55288 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:51.909847975 CEST | 53 | 58062 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:55.176172018 CEST | 59819 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:00:55.176172018 CEST | 50383 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:00:55.183310986 CEST | 53 | 50383 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:55.195928097 CEST | 53 | 59819 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:57.399734020 CEST | 53 | 49300 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:59.718614101 CEST | 54744 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:00:59.718799114 CEST | 49779 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:00:59.725483894 CEST | 53 | 54744 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:00:59.726516962 CEST | 53 | 49779 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.823766947 CEST | 53551 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:01:01.823899031 CEST | 59731 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:01:01.830883026 CEST | 53 | 59731 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:01:01.831181049 CEST | 53 | 53551 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:01:04.208775043 CEST | 138 | 138 | 192.168.2.4 | 192.168.2.255 |
| Oct 2, 2024 19:01:08.915172100 CEST | 53 | 56620 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:01:11.623591900 CEST | 53 | 51062 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:01:27.702934027 CEST | 53 | 49655 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:01:50.528521061 CEST | 53 | 52615 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:01:50.528546095 CEST | 53 | 52358 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:02:01.814846039 CEST | 53 | 51077 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:02:02.723546982 CEST | 58768 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:02:02.723728895 CEST | 63973 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:02:02.899522066 CEST | 53 | 63973 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:02:02.899535894 CEST | 53 | 58768 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:02:19.328676939 CEST | 53 | 55415 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 19:00:50.874564886 CEST | 192.168.2.4 | 1.1.1.1 | 0x9ba2 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:00:50.874741077 CEST | 192.168.2.4 | 1.1.1.1 | 0x132 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:00:51.855597019 CEST | 192.168.2.4 | 1.1.1.1 | 0xba1b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:00:51.855767012 CEST | 192.168.2.4 | 1.1.1.1 | 0xdd45 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:00:55.176172018 CEST | 192.168.2.4 | 1.1.1.1 | 0xd827 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:00:55.176172018 CEST | 192.168.2.4 | 1.1.1.1 | 0x5d82 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:00:59.718614101 CEST | 192.168.2.4 | 1.1.1.1 | 0xf830 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:00:59.718799114 CEST | 192.168.2.4 | 1.1.1.1 | 0x5225 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:01:01.823766947 CEST | 192.168.2.4 | 1.1.1.1 | 0x5477 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:01:01.823899031 CEST | 192.168.2.4 | 1.1.1.1 | 0xc81a | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:02:02.723546982 CEST | 192.168.2.4 | 1.1.1.1 | 0xe61f | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:02:02.723728895 CEST | 192.168.2.4 | 1.1.1.1 | 0x2645 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 19:00:50.882329941 CEST | 1.1.1.1 | 192.168.2.4 | 0x9ba2 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:50.882652044 CEST | 1.1.1.1 | 192.168.2.4 | 0x132 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 19:00:51.862611055 CEST | 1.1.1.1 | 192.168.2.4 | 0xdd45 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862611055 CEST | 1.1.1.1 | 192.168.2.4 | 0xdd45 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 216.58.212.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:51.862627983 CEST | 1.1.1.1 | 192.168.2.4 | 0xba1b | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:55.183310986 CEST | 1.1.1.1 | 192.168.2.4 | 0x5d82 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 19:00:55.195928097 CEST | 1.1.1.1 | 192.168.2.4 | 0xd827 | No error (0) | 172.217.23.100 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:59.725483894 CEST | 1.1.1.1 | 192.168.2.4 | 0xf830 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:59.725483894 CEST | 1.1.1.1 | 192.168.2.4 | 0xf830 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:00:59.726516962 CEST | 1.1.1.1 | 192.168.2.4 | 0x5225 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:01:01.831181049 CEST | 1.1.1.1 | 192.168.2.4 | 0x5477 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:02:02.899535894 CEST | 1.1.1.1 | 192.168.2.4 | 0xe61f | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49732 | 142.250.185.78 | 443 | 6360 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 17:00:51 UTC | 851 | OUT | |
| 2024-10-02 17:00:51 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49734 | 142.250.185.142 | 443 | 6360 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 17:00:52 UTC | 869 | OUT | |
| 2024-10-02 17:00:52 UTC | 2634 | IN |