Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1524413 |
| MD5: | 17e81ded92e36f3d9cb2e548e9765cbe |
| SHA1: | 7bad6623b670b99f64e4796c96bd3151efe94c10 |
| SHA256: | 96dcbbee1239cbb0d455b0b00532cd8d8b8bbe292f1ad5926670c91c88acc154 |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 68 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Classification
- System is w10x64
file.exe (PID: 4872 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 17E81DED92E36F3D9CB2E548E9765CBE) 
taskkill.exe (PID: 7000 cmdline: taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) 
conhost.exe (PID: 7108 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
chrome.exe (PID: 1020 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://youtu be.com/acc ount?=http s://accoun ts.google. com/v3/sig nin/challe nge/pwd" - -start-ful lscreen -- no-first-r un --disab le-session -crashed-b ubble --di sable-info bars MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 7232 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2392 --fi eld-trial- handle=235 2,i,159691 2591739810 2169,18062 4384570607 57556,2621 44 /prefet ch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 2984 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=55 28 --field -trial-han dle=2352,i ,159691259 1739810216 9,18062438 4570607575 56,262144 /prefetch: 8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 316 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5580 --f ield-trial -handle=23 52,i,15969 1259173981 02169,1806 2438457060 757556,262 144 /prefe tch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_000DDBBE | |
| Source: | Code function: | 0_2_000AC2A2 | |
| Source: | Code function: | 0_2_000E68EE | |
| Source: | Code function: | 0_2_000E698F | |
| Source: | Code function: | 0_2_000DD076 | |
| Source: | Code function: | 0_2_000DD3A9 | |
| Source: | Code function: | 0_2_000E9642 | |
| Source: | Code function: | 0_2_000E979D | |
| Source: | Code function: | 0_2_000E9B2B | |
| Source: | Code function: | 0_2_000E5C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_000ECE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_000EEAFF | |
| Source: | Code function: | 0_2_000EED6A | |
| Source: | Code function: | 0_2_000EEAFF | |
| Source: | Code function: | 0_2_000DAA57 | |
| Source: | Code function: | 0_2_00109576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_5d348c21-9 | |
| Source: | String found in binary or memory: | memstr_7fde3694-8 | |
| Source: | String found in binary or memory: | memstr_cdc47121-3 | |
| Source: | String found in binary or memory: | memstr_512eb57d-1 | |
| Source: | Code function: | 0_2_000DD5EB | |
| Source: | Code function: | 0_2_000D1201 | |
| Source: | Code function: | 0_2_000DE8F6 | |
| Source: | Code function: | 0_2_000E2046 | |
| Source: | Code function: | 0_2_00078060 | |
| Source: | Code function: | 0_2_000D8298 | |
| Source: | Code function: | 0_2_000AE4FF | |
| Source: | Code function: | 0_2_000A676B | |
| Source: | Code function: | 0_2_00104873 | |
| Source: | Code function: | 0_2_0009CAA0 | |
| Source: | Code function: | 0_2_0007CAF0 | |
| Source: | Code function: | 0_2_0008CC39 | |
| Source: | Code function: | 0_2_000A6DD9 | |
| Source: | Code function: | 0_2_0008B119 | |
| Source: | Code function: | 0_2_000791C0 | |
| Source: | Code function: | 0_2_00091394 | |
| Source: | Code function: | 0_2_00091706 | |
| Source: | Code function: | 0_2_0009781B | |
| Source: | Code function: | 0_2_00077920 | |
| Source: | Code function: | 0_2_0008997D | |
| Source: | Code function: | 0_2_000919B0 | |
| Source: | Code function: | 0_2_00097A4A | |
| Source: | Code function: | 0_2_00091C77 | |
| Source: | Code function: | 0_2_00097CA7 | |
| Source: | Code function: | 0_2_000FBE44 | |
| Source: | Code function: | 0_2_000A9EEE | |
| Source: | Code function: | 0_2_00091F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_000E37B5 | |
| Source: | Code function: | 0_2_000D10BF | |
| Source: | Code function: | 0_2_000D16C3 | |
| Source: | Code function: | 0_2_000E51CD | |
| Source: | Code function: | 0_2_000FA67C | |
| Source: | Code function: | 0_2_000E648E | |
| Source: | Code function: | 0_2_000742A2 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_000742DE | |
| Source: | Code function: | 0_2_00090A89 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_0008F98E | |
| Source: | Code function: | 0_2_00101C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-96403 | ||
| Source: | API coverage: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_000DDBBE | |
| Source: | Code function: | 0_2_000AC2A2 | |
| Source: | Code function: | 0_2_000E68EE | |
| Source: | Code function: | 0_2_000E698F | |
| Source: | Code function: | 0_2_000DD076 | |
| Source: | Code function: | 0_2_000DD3A9 | |
| Source: | Code function: | 0_2_000E9642 | |
| Source: | Code function: | 0_2_000E979D | |
| Source: | Code function: | 0_2_000E9B2B | |
| Source: | Code function: | 0_2_000E5C97 | |
| Source: | Code function: | 0_2_000742DE | |
Anti Debugging | |
|---|
| Source: | Debugger detection routine: | graph_0-96550 | ||
| Source: | Code function: | 0_2_000EEAA2 | |
| Source: | Code function: | 0_2_000A2622 | |
| Source: | Code function: | 0_2_000742DE | |
| Source: | Code function: | 0_2_00094CE8 | |
| Source: | Code function: | 0_2_000D0B62 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_000A2622 | |
| Source: | Code function: | 0_2_0009083F | |
| Source: | Code function: | 0_2_000909D5 | |
| Source: | Code function: | 0_2_00090C21 | |
| Source: | Code function: | 0_2_000D1201 | |
| Source: | Code function: | 0_2_000B2BA5 | |
| Source: | Code function: | 0_2_0008F98E | |
| Source: | Code function: | 0_2_000F22DA | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_000D0B62 | |
| Source: | Code function: | 0_2_000D1663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00090698 | |
| Source: | Code function: | 0_2_000E8195 | |
| Source: | Code function: | 0_2_000CD27A | |
| Source: | Code function: | 0_2_000AB952 | |
| Source: | Code function: | 0_2_000742DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 0_2_000F1204 | |
| Source: | Code function: | 0_2_000F1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 2 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 16 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 1 Masquerading | LSA Secrets | 22 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | Cached Domain Credentials | 2 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 2 Virtualization/Sandbox Evasion | DCSync | 2 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 21 Access Token Manipulation | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 2 Process Injection | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 11% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 216.58.206.46 | true | false | unknown | |
| www3.l.google.com | 142.250.185.110 | true | false | unknown | |
| play.google.com | 142.250.185.142 | true | false | unknown | |
| www.google.com | 216.58.206.68 | true | false | unknown | |
| youtube.com | 142.250.185.78 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.185.78 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.110 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 216.58.206.46 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 216.58.206.68 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.142 | play.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.9 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1524413 |
| Start date and time: | 2024-10-02 19:03:54 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 57s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 15 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal68.troj.evad.winEXE@42/36@12/7 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 172.217.16.195, 74.125.71.84, 142.250.184.206, 34.104.35.123, 142.250.186.99, 142.250.185.234, 142.250.185.202, 172.217.18.106, 216.58.212.138, 142.250.186.138, 142.250.185.74, 216.58.206.74, 142.250.185.170, 142.250.74.202, 142.250.186.74, 142.250.186.42, 172.217.18.10, 142.250.186.106, 172.217.16.202, 142.250.185.138, 142.250.185.106, 142.250.185.227, 216.58.212.170, 142.250.184.234, 142.250.184.202, 142.250.181.234, 142.250.186.170, 216.58.206.42, 192.229.221.95, 142.250.186.67, 64.233.167.84, 142.250.186.174
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Credential Flusher | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2673 |
| Entropy (8bit): | 3.9815714560277438 |
| Encrypted: | false |
| SSDEEP: | 48:8FdaZTXwqHmidAKZdA1P4ehwiZUklqeh1y+3:8C8LOmy |
| MD5: | B25FA5DDF11334CAE2A248DB6BE8BAA4 |
| SHA1: | E7E3A8A9FEEDE8A38FE9F8EAFE07E110FE4DB29C |
| SHA-256: | AB0FEEC1797EC2CEC53A55C1BDD4FBF77ABB1EF8A5FB30CF67C95C18FFDA8CFC |
| SHA-512: | 8890E9470736842835A320AC7AFD5C398A89F818EDB9313AC76F976C1FA28EF02D618086B8AF8D4B95B28D42450E0B11C73E8708DD33D7664B045410625282E9 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2675 |
| Entropy (8bit): | 3.997701998426123 |
| Encrypted: | false |
| SSDEEP: | 48:8WdaZTXwqHmidAKZdA1+4eh/iZUkAQkqehWy+2:8f86F9QLy |
| MD5: | E84FD941DD753B0EB0A32712AEE9F8FA |
| SHA1: | C2113769BCB40D09816682EFB3398DCC621ADD18 |
| SHA-256: | 9E62D47CB0C652E3A1D766227ED73D06CABCAB9A186569C84EB0A62C5DAA0E2C |
| SHA-512: | EF969F22437EE3EEE72B36C811C2467DEBF8CBCE4018F4854BE1DF240878228557F1CCB2C46FE312228EF060CDC7C4CA666274E087B7A94F0E9B7B6D4E7C2780 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2689 |
| Entropy (8bit): | 4.006162035631228 |
| Encrypted: | false |
| SSDEEP: | 48:8WdaZTXwVHmidAKZdA1404eh7sFiZUkmgqeh7sEy+BX:8f8WInqy |
| MD5: | 214E76306C05741BF264358A14CB023F |
| SHA1: | 689792FE28C96487A70DF03CAAE513C67AC70669 |
| SHA-256: | F93A651E44D57E9CC4FC53EFE77ECC307F073C644265618C6BFCE627143CE1F5 |
| SHA-512: | C0619D729427D48B88D4FC070C460F858C165651A7B528186240A20F067E58FF1709AEC0DD3562DC2510F6BE45D3B4327CFAE85E26C383C21C2114654C623C29 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.9973792530372303 |
| Encrypted: | false |
| SSDEEP: | 48:8MdaZTXwqHmidAKZdA1p4ehDiZUkwqehCy+R:898t58y |
| MD5: | B88A4C3372031099896592ECAB0C4B07 |
| SHA1: | 11B142FED21F1D85E9C54909D316A78462BB6531 |
| SHA-256: | 72B422F164B901B47FAD77184A97FE9064309E5BC2700BE9524B3CCF9A39F8C6 |
| SHA-512: | 220287570DF2551019193B9B3CE16E909147BA9289A8058A3E21D231B1EC624065E464BEA3A2AC14766610AA5F0AC8751B323F39E92A30419CC68289985692FA |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.983384486453405 |
| Encrypted: | false |
| SSDEEP: | 48:8/daZTXwqHmidAKZdA1X4ehBiZUk1W1qehIy+C:8s8Tb9oy |
| MD5: | 776CFC9FD950959F18D6C23C51E0E406 |
| SHA1: | 9CFA7A379C56294AA42D413B88F4B9CA42CD36AB |
| SHA-256: | 7D86E4F93C0F024437243AF648EE072E9BFBB10FE1C2BBB4D69A4371F94DB0E2 |
| SHA-512: | 62D2633F2F58277DAECBF3699A8A15EF198A033D1C81A11585ED3E160DA4CCD20F7FEE983271E6D9F9288001048E446C7570D6278E3314323F7C7C6199E85494 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9931629131599196 |
| Encrypted: | false |
| SSDEEP: | 48:8JdaZTXwqHmidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTbqy+yT+:8m88TcJTbxWOvTbqy7T |
| MD5: | 9CD93C70A1F44F06D7F332A99E42AEF8 |
| SHA1: | AD664A6257229EE8C489E9B4242C339407BFE0B8 |
| SHA-256: | EB9A71F78EA8CF201E939203F086B8116AF394157A47D960059E6D9BCBF6E1F4 |
| SHA-512: | B1403642E52B3A9F1B0EEDFA44773ED3465A0A797D6348AF08AD5444CFE9F5E07950EC85789311A9901B4BD817FCB0346DDA9E4D743E836097F7B79CDF6DD4ED |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.298162049824456 |
| Encrypted: | false |
| SSDEEP: | 48:o7vGoolL3ALFKphnpiu7xOKAcfO/3d/rYh4vZorw:o/QLUFUL4KA+2y0Mw |
| MD5: | CE055F881BDAB4EF6C1C8AA4B3890348 |
| SHA1: | 2671741A70E9F5B608F690AAEEA4972003747654 |
| SHA-256: | 9B91C23691D6032CDFE28863E369624B2EDB033E1487A1D1BB0977E3590E5462 |
| SHA-512: | 8A22250628985C2E570E6FBADFC0D5CB6753F0735130F9E74962A409476C2859C5C81F8A0F5C427A9F13ED399C8E251FA43FF67AD5F16860640D45E7A538E857 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4066 |
| Entropy (8bit): | 5.363016925556486 |
| Encrypted: | false |
| SSDEEP: | 96:G2CiFZX5BReR68ujioIRVrqtyzBeTV6SfyAKLif9c7w:bCMZXVeR6jiosVrqtyzBaImyAKw9x |
| MD5: | FC5E597D923838E10390DADD12651A81 |
| SHA1: | C9959F8D539DB5DF07B8246EC12539B6A9CC101F |
| SHA-256: | A7EBD5280C50AE93C061EAE1E9727329E015E97531F8F2D82D0E3EA76ADB37B4 |
| SHA-512: | 784CA572808F184A849388723FBB3701E6981D885BBA8A330A933F90BF0B36A2E4A491D4463A27911B1D9F7A7134F23E15F187FC7CB4554EAE9BC252513EED7C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 698314 |
| Entropy (8bit): | 5.595120835898624 |
| Encrypted: | false |
| SSDEEP: | 6144:TJvaKtQfcxene0F2HhPM8RGYcBlKmd5r6XISxi7SlncOpYMSrBg5X3O4mAEFD7:TJyKtkIct842ISxXJ09 |
| MD5: | F82438F9EAD5F57493C673008EED9E09 |
| SHA1: | E4681E68FD66D8C76C6ACBC21E2C45F36FD645BC |
| SHA-256: | B4B092F54EAAA82BFAA159B8D61FB867B51C3067CBD60F4904A205A11F503250 |
| SHA-512: | 89027A7B1B3A080D40411F2E6E3B62BF57AC60879223566E71BD41D900C17051F0A058EFE04F8F1FED5E05DC54617D7A86F83D21BDED0F79347795C8B980B4B2 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 743936 |
| Entropy (8bit): | 5.791085889652278 |
| Encrypted: | false |
| SSDEEP: | 6144:aVXWBQkPdzg5pTX1ROv/duPzd8C3s891/N:7fd8j91/N |
| MD5: | D20AA383CD31013B68BB10390CBE0230 |
| SHA1: | 2DF35559BBA0B93FE305C4B828324E9F9EFA234D |
| SHA-256: | 9F91BD315E202B9EC035C25EFFCE646CEC9AB1E8599496198AA8BEC437CDD228 |
| SHA-512: | EA023EEB24C48A2F463E0CFC9107C6FCD76BBA9292ED49839AAF0AC7845DBD48AB4876376A6A7D4EE902B0649BFE5E0AC2960D954079A94BF2F64A5BC2CBCD9C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHJL2nU2EL_uUPBIEb5OQMKdqHGhg/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32500 |
| Entropy (8bit): | 5.378903546681047 |
| Encrypted: | false |
| SSDEEP: | 768:zYlbuROstb0e39nKGrkysU0smpu4OLOdzIf1p/5GeSsngurz6aKEEEGo/:zYl61Cysbu4OLOdzIfrIen72ZFo/ |
| MD5: | BF4BF9728A7C302FBA5B14F3D0F1878B |
| SHA1: | 2607CA7A93710D629400077FF3602CB207E6F53D |
| SHA-256: | 8981E7B228DF7D6A8797C0CD1E9B0F1F88337D5F0E1C27A04E7A57D2C4309798 |
| SHA-512: | AC9E170FC3AFDC0CF6BB8E926B93EF129A5FAD1BBA51B60BABCF3555E9B652E98F86A00FB099879DED35DD3FFE72ECFA597E20E6CA8CF402BEDEC40F78412EDA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5050 |
| Entropy (8bit): | 5.289052544075544 |
| Encrypted: | false |
| SSDEEP: | 96:o4We0hP7OBFXYvB1sig3Fd8HkaXzLmUrv8Vh1WJlLQXT2v2gqw:655758Fd8HkaPZ0GmAD |
| MD5: | 26E26FD11772DFF5C7004BEA334289CC |
| SHA1: | 638DAAF541BDE31E95AEE4F8ADA677434D7051DB |
| SHA-256: | ADFE3E4960982F5EF4C043052A9990D8683C5FC2B590E817B6B1A5774DDE2CE3 |
| SHA-512: | C31929EB6D1C60D6A84A2574FF60490394A6D6F9B354972F3328952F570D80B3F2AEC916B0E1B66DDB1AC056EB75BFAC477E7AF631D0AD1810EDBAF025465D66 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.291808298251231 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DuZvuhqCsNRxoYTY9/qoVk7hz1l2p6vDMW94uEQOeGbCx4VGbgCSFBV87OU:o7DuZWhv6oy12kvwKEeGbC6GbHSh/Hrw |
| MD5: | 4CA7ADFE744A690411EA4D3EA8DB9E4B |
| SHA1: | 2CF1777A199E25378D330DA68BED1871B5C5BC32 |
| SHA-256: | 128129BA736B3094323499B0498A5B3A909C1529717461C34B70080A5B1603BD |
| SHA-512: | 8BD3477AF41D1F0FE74AFFCB177BEC0F5F4FDCBBA6BD29D9C2567E6FFDEF5DEB7FF74BF348F33209C39D7BB4958E748DF6731D3DC8F6947352276BC92EAF9E79 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.355381206612617 |
| Encrypted: | false |
| SSDEEP: | 48:o7FEEM3MtH15jNQ8jsK3rnw0dkckTrKEp/OqLE9xz0W5Bzv3M6hIHYA+JITbwrF8:oq675jOArwoAmI/DLaxNPL5m+m6w |
| MD5: | E2A7251AD83A0D0634FEA2703D10ED07 |
| SHA1: | 90D72011F31FC40D3DA3748F2817F90A29EB5C01 |
| SHA-256: | 1079B49C4AAF5C10E4F2E6A086623F40D200A71FF2A1F64E88AA6C91E4BE7A6F |
| SHA-512: | CD6D75580EA8BD97CF7C7C0E0BD9D9A54FB6EA7DF1DDB5A95E94D38B260F9EE1425C640839ECD229B8D01E145CF2786CA374D31EC537EB8FE17FF415D5B985F5 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22833 |
| Entropy (8bit): | 5.425034548615223 |
| Encrypted: | false |
| SSDEEP: | 384:7lFo6ZEdpgtmyiPixV9OX9gMBpHkHnfst9lZulagGcwYHiRFjJzN7:77o6ZviPixV8xpEHn89l4IgGcwYCRtb7 |
| MD5: | 749B18538FE32BFE0815D75F899F5B21 |
| SHA1: | AF95A019211AF69F752A43CAA54A83C2AFD41D28 |
| SHA-256: | 116B2687C1D5E00DB56A79894AB0C12D4E2E000B9379B7E7AD751B84DF611F3F |
| SHA-512: | E4B6F4556AA0FD9979BB52681508F5E26FFB256473803F74F7F5C8D93FA3636D7D0A5835618FBC6123022805CE0D9616A7451A0F302C665E28A6090B5D588505 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.404371326611379 |
| Encrypted: | false |
| SSDEEP: | 192:EEFZpeip4HzZlY0If0Ma23jcUcrhCx6VD1TYPi8:Es/p4jgjUhtD1TY68 |
| MD5: | 21E893B65627B397E22619A9F5BB9662 |
| SHA1: | F561B0F66211C1E7B22F94B4935C312AB7087E85 |
| SHA-256: | FFA9B8BC8EF2CDFF5EB4BA1A0BA1710A253A5B42535E2A369D5026967DCF4673 |
| SHA-512: | 3DE3CD6A4E9B06AB3EB324E90A40B5F2AEEA8D7D6A2651C310E993CF79EEB5AC6E2E33C587F46B2DD20CC862354FD1A61AEBB9B990E6805F6629404BA285F8FA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3467 |
| Entropy (8bit): | 5.514745431912774 |
| Encrypted: | false |
| SSDEEP: | 96:ozbld2fNUmeqJNizhNtt1W8t//loyIpXmdVE2w:onSKE8PWe/Cy4X3j |
| MD5: | 8DEF399E8355ABC23E64505281005099 |
| SHA1: | 24FF74C3AEFD7696D84FF148465DF4B1B60B1696 |
| SHA-256: | F128D7218E1286B05DF11310AD3C8F4CF781402698E45448850D2A3A22F5F185 |
| SHA-512: | 33721DD47658D8E12ADF6BD9E9316EB89F5B6297927F7FD60F954E04B829DCBF0E1AE6DDD9A3401F45E0011AE4B1397B960C218238A3D0F633A2173D8E604082 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.257113147606035 |
| Encrypted: | false |
| SSDEEP: | 48:o72ZrNZ4yNAbU+15fMxIdf5WENoBCbw7DbG2bEJrw:oyNNAY+1i4HoBNG2Ilw |
| MD5: | F06E2DC5CC446B39F878B5F8E4D78418 |
| SHA1: | 9F1F34FDD8F8DAB942A9B95D9F720587B6F6AD48 |
| SHA-256: | 118E4D2FE7CEF205F9AFC87636554C6D8220882B158333EE3D1990282D158B8F |
| SHA-512: | 893C4F883CD1C88C6AAF5A6E7F232D62823A53E1FFDE5C1C52BB066D75781DD041F4D281CDBF18070D921CE862652D8863E2B9D5E0190CFA4128890D62C44168 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=5IFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEr6KOaFsGvhdDsnkaRQWWkVkg2lQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.582342635860022 |
| TrID: |
|
| File name: | file.exe |
| File size: | 918'528 bytes |
| MD5: | 17e81ded92e36f3d9cb2e548e9765cbe |
| SHA1: | 7bad6623b670b99f64e4796c96bd3151efe94c10 |
| SHA256: | 96dcbbee1239cbb0d455b0b00532cd8d8b8bbe292f1ad5926670c91c88acc154 |
| SHA512: | c7895e2c90370d4a6636c73962f44c9289ebdfd0aeb08edb02c90e211ff406d0a2002155f30fee8dac0cd408c8471ca1cb4a2eaed8b0e41aa542c713ff9065ed |
| SSDEEP: | 12288:9qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaMTQ:9qDEvCTbMWu7rQYlBQcBiT6rprG8acQ |
| TLSH: | 55159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FD7470 [Wed Oct 2 16:27:28 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F78089DF943h |
| jmp 00007F78089DF24Fh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F78089DF42Dh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F78089DF3FAh |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F78089E1FEDh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F78089E2038h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F78089E2021h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9934 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9934 | 0x9a00 | dad245c2c495499b64826ad558d63db0 | False | 0.3033938717532468 | data | 5.280185543668453 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xbfc | data | 1.0035853976531943 | ||
| RT_GROUP_ICON | 0xdd3b4 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd42c | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd440 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd454 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd468 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd544 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 19:04:44.303410053 CEST | 49676 | 443 | 192.168.2.9 | 23.206.229.209 |
| Oct 2, 2024 19:04:44.304339886 CEST | 49675 | 443 | 192.168.2.9 | 23.206.229.209 |
| Oct 2, 2024 19:04:44.568718910 CEST | 49674 | 443 | 192.168.2.9 | 23.206.229.209 |
| Oct 2, 2024 19:04:44.678128958 CEST | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Oct 2, 2024 19:04:49.490573883 CEST | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Oct 2, 2024 19:04:50.678184032 CEST | 49673 | 443 | 192.168.2.9 | 204.79.197.203 |
| Oct 2, 2024 19:04:52.188419104 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:52.188426971 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.188474894 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:52.189538002 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:52.189553022 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.847599030 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.848227024 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:52.848248959 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.848814011 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.848869085 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:52.849801064 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.849853039 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:52.860198975 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:52.860327005 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.868448019 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:52.868467093 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.914699078 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:53.136317968 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.137397051 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.137449980 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:53.140940905 CEST | 49708 | 443 | 192.168.2.9 | 142.250.185.78 |
| Oct 2, 2024 19:04:53.140958071 CEST | 443 | 49708 | 142.250.185.78 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.151284933 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:53.151324987 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.151381969 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:53.151565075 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:53.151581049 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.799434900 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.799704075 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:53.799724102 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.800111055 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.800173044 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:53.800832987 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.800882101 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:53.802069902 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:53.802128077 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.802325964 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:53.802339077 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.852233887 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:53.914722919 CEST | 49676 | 443 | 192.168.2.9 | 23.206.229.209 |
| Oct 2, 2024 19:04:53.914813042 CEST | 49675 | 443 | 192.168.2.9 | 23.206.229.209 |
| Oct 2, 2024 19:04:54.118947983 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:54.119003057 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:54.119062901 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:54.119075060 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:54.119199991 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:54.119324923 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:54.122311115 CEST | 49712 | 443 | 192.168.2.9 | 216.58.206.46 |
| Oct 2, 2024 19:04:54.122328997 CEST | 443 | 49712 | 216.58.206.46 | 192.168.2.9 |
| Oct 2, 2024 19:04:54.173662901 CEST | 49674 | 443 | 192.168.2.9 | 23.206.229.209 |
| Oct 2, 2024 19:04:55.907233953 CEST | 443 | 49704 | 23.206.229.209 | 192.168.2.9 |
| Oct 2, 2024 19:04:55.907378912 CEST | 49704 | 443 | 192.168.2.9 | 23.206.229.209 |
| Oct 2, 2024 19:04:56.752278090 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:04:56.752310991 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:04:56.752405882 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:04:56.752598047 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:04:56.752612114 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:04:57.391828060 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:04:57.394931078 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:04:57.394942045 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:04:57.396352053 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:04:57.396400928 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:04:57.397969007 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:04:57.398062944 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:04:57.437659979 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:04:57.437666893 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:04:57.487108946 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:04:57.921194077 CEST | 49722 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:57.921238899 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:57.921300888 CEST | 49722 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:57.923942089 CEST | 49722 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:57.923955917 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.579094887 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.579164028 CEST | 49722 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:58.585279942 CEST | 49722 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:58.585314989 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.585591078 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.633508921 CEST | 49722 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:58.651597977 CEST | 49722 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:58.699408054 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.851243973 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.851326942 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.851460934 CEST | 49722 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:58.877912045 CEST | 49722 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:58.877948046 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.877963066 CEST | 49722 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:58.877969980 CEST | 443 | 49722 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.937927008 CEST | 49727 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:58.937958002 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.938102007 CEST | 49727 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:58.938934088 CEST | 49727 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:58.938946962 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:59.102195024 CEST | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Oct 2, 2024 19:04:59.577079058 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:59.577970982 CEST | 49727 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:59.578849077 CEST | 49727 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:59.578854084 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:59.579108000 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:59.581099033 CEST | 49727 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:59.623394966 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:59.853065014 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:59.853135109 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:59.853188992 CEST | 49727 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:59.860562086 CEST | 49727 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:59.860562086 CEST | 49727 | 443 | 192.168.2.9 | 184.28.90.27 |
| Oct 2, 2024 19:04:59.860575914 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:04:59.860584021 CEST | 443 | 49727 | 184.28.90.27 | 192.168.2.9 |
| Oct 2, 2024 19:05:01.448230028 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:01.448272943 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:01.448573112 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:01.448919058 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:01.448936939 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.132370949 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.132644892 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.132663965 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.133068085 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.133214951 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.133802891 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.134135962 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.134987116 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.135081053 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.135257959 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.135265112 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.180104971 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.475404024 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.475456953 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.475661993 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.475687981 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.475712061 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.476015091 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.481385946 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.481440067 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.481455088 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.487742901 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.487778902 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.488687992 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.488703966 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.488800049 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.493927002 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.494128942 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.505769014 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.505803108 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.506045103 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.506063938 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.507404089 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.646138906 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.646214962 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.646235943 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.646260977 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.646384001 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.649120092 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.649152994 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.649692059 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.649705887 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.651410103 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.655452013 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.655764103 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.659780979 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.659948111 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.659965038 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.663569927 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.667417049 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.667438984 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.671027899 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.671137094 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.671149969 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.671253920 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.673681974 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.801667929 CEST | 49737 | 443 | 192.168.2.9 | 142.250.185.110 |
| Oct 2, 2024 19:05:02.801693916 CEST | 443 | 49737 | 142.250.185.110 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.854659081 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:02.854708910 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.854902029 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:02.855115891 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:02.855134010 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.934107065 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:02.934132099 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.934303999 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:02.934685946 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:02.934695959 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.492587090 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.493326902 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.493355036 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.493686914 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.493738890 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.494398117 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.494443893 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.495938063 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.496020079 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.496228933 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.496236086 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.541507959 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.578022003 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.578200102 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.578226089 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.578732014 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.578799009 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.579751015 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.579801083 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.579942942 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.580012083 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.580094099 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.580106974 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.634478092 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.793353081 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.793981075 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.794023037 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.794578075 CEST | 49740 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.794589996 CEST | 443 | 49740 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.795770884 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.795803070 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.796211004 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.796608925 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.796619892 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.877404928 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.879441977 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.879779100 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.881663084 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.881694078 CEST | 443 | 49742 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.881711006 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.881782055 CEST | 49742 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.883413076 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.883445024 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:03.883534908 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.889249086 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:03.889270067 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.447593927 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.448000908 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.448014975 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.448381901 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.448441982 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.449069977 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.449114084 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.449250937 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.449296951 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.449707985 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.449714899 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.449738026 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.452610970 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:04.452647924 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.452845097 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:04.454183102 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:04.454194069 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.491405010 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.493004084 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.620893002 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.621182919 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.621198893 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.621715069 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.621777058 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.622718096 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.622776985 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.623019934 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.623100042 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.623272896 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.623281002 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.623327017 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.664870977 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.664887905 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.668627977 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.669822931 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.669872046 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.670574903 CEST | 49745 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.670598030 CEST | 443 | 49745 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.838870049 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.840173960 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:04.840394974 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.841377974 CEST | 49746 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:04.841398954 CEST | 443 | 49746 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.235373020 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.235493898 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.284672022 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.284698009 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.285137892 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.295243025 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:05:05.336751938 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.339397907 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.359632015 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.403405905 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.572120905 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.572175980 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.572207928 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.572236061 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.572279930 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:05:05.572309017 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.572321892 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:05:05.572824001 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.572918892 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:05:05.574402094 CEST | 49717 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:05:05.574419022 CEST | 443 | 49717 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616245985 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616278887 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616287947 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616313934 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616347075 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616344929 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.616358042 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616375923 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616390944 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616405964 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.616415024 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616437912 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.616441965 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616482019 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.616482973 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.616516113 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.627846956 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.627872944 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:05.627912998 CEST | 49749 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:05.627918959 CEST | 443 | 49749 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:10.590776920 CEST | 49756 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:10.590821981 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:10.590898991 CEST | 49756 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:10.597672939 CEST | 49756 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:10.597693920 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:11.334566116 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:11.334861040 CEST | 49756 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:11.334882021 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:11.335246086 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:11.335547924 CEST | 49756 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:11.335602999 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:11.335864067 CEST | 49756 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:11.335875034 CEST | 49756 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:11.335884094 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:11.667691946 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:11.668097973 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:11.668148041 CEST | 49756 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:11.669543028 CEST | 49756 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:11.669560909 CEST | 443 | 49756 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:32.965708971 CEST | 49757 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:32.965740919 CEST | 443 | 49757 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:32.965807915 CEST | 49757 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:32.966126919 CEST | 49757 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:32.966137886 CEST | 443 | 49757 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:33.500904083 CEST | 49758 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:33.500969887 CEST | 443 | 49758 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:33.501049042 CEST | 49758 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:33.501368999 CEST | 49758 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:33.501389027 CEST | 443 | 49758 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:33.797434092 CEST | 443 | 49757 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:33.797739983 CEST | 49757 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:33.797753096 CEST | 443 | 49757 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:33.798124075 CEST | 443 | 49757 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:33.798547029 CEST | 49757 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:33.798609972 CEST | 443 | 49757 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:33.798908949 CEST | 49757 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:33.798908949 CEST | 49757 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:33.798933983 CEST | 443 | 49757 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:33.893527031 CEST | 49759 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:33.893582106 CEST | 443 | 49759 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:33.893675089 CEST | 49759 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:33.893939972 CEST | 49759 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:33.893954039 CEST | 443 | 49759 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.177335978 CEST | 443 | 49757 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.178700924 CEST | 443 | 49757 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.178750992 CEST | 49757 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.179164886 CEST | 49757 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.179182053 CEST | 443 | 49757 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.284169912 CEST | 443 | 49758 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.284529924 CEST | 49758 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.284547091 CEST | 443 | 49758 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.284929037 CEST | 443 | 49758 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.285224915 CEST | 49758 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.285283089 CEST | 443 | 49758 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.285367012 CEST | 49758 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.285381079 CEST | 49758 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.285437107 CEST | 443 | 49758 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.529141903 CEST | 443 | 49759 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.529512882 CEST | 49759 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.529531002 CEST | 443 | 49759 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.530591965 CEST | 443 | 49759 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.531066895 CEST | 49759 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.531125069 CEST | 443 | 49759 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.531212091 CEST | 49759 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.531229019 CEST | 49759 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.531234026 CEST | 443 | 49759 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.582514048 CEST | 443 | 49758 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.582659960 CEST | 443 | 49758 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.582740068 CEST | 49758 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.583081961 CEST | 49758 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.583101988 CEST | 443 | 49758 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.743779898 CEST | 443 | 49759 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.745224953 CEST | 443 | 49759 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:34.745321035 CEST | 49759 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.745399952 CEST | 49759 | 443 | 192.168.2.9 | 142.250.185.142 |
| Oct 2, 2024 19:05:34.745418072 CEST | 443 | 49759 | 142.250.185.142 | 192.168.2.9 |
| Oct 2, 2024 19:05:39.578320026 CEST | 49705 | 80 | 192.168.2.9 | 93.184.221.240 |
| Oct 2, 2024 19:05:39.583460093 CEST | 80 | 49705 | 93.184.221.240 | 192.168.2.9 |
| Oct 2, 2024 19:05:39.583524942 CEST | 49705 | 80 | 192.168.2.9 | 93.184.221.240 |
| Oct 2, 2024 19:05:42.405879974 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:42.405925035 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:42.406008959 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:42.406364918 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:42.406378031 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.181755066 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.181863070 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.183223009 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.183234930 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.183501959 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.184591055 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.227395058 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.511703014 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.511723042 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.511737108 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.511784077 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.511794090 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.511816025 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.511836052 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.512341022 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.512382030 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.512391090 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.512398005 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.512422085 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.513109922 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.513158083 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.518229008 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.518245935 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:43.518256903 CEST | 49760 | 443 | 192.168.2.9 | 20.114.59.183 |
| Oct 2, 2024 19:05:43.518263102 CEST | 443 | 49760 | 20.114.59.183 | 192.168.2.9 |
| Oct 2, 2024 19:05:56.807476997 CEST | 49762 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:05:56.807590961 CEST | 443 | 49762 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:56.807693958 CEST | 49762 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:05:56.807991982 CEST | 49762 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:05:56.808027029 CEST | 443 | 49762 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:57.484734058 CEST | 443 | 49762 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:57.485239983 CEST | 49762 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:05:57.485328913 CEST | 443 | 49762 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:57.485678911 CEST | 443 | 49762 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:57.486022949 CEST | 49762 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:05:57.486099958 CEST | 443 | 49762 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:05:57.541193008 CEST | 49762 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:06:07.394222975 CEST | 443 | 49762 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:06:07.394294024 CEST | 443 | 49762 | 216.58.206.68 | 192.168.2.9 |
| Oct 2, 2024 19:06:07.394484043 CEST | 49762 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:06:20.303411961 CEST | 49762 | 443 | 192.168.2.9 | 216.58.206.68 |
| Oct 2, 2024 19:06:20.303456068 CEST | 443 | 49762 | 216.58.206.68 | 192.168.2.9 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 19:04:52.090497017 CEST | 56561 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:04:52.090627909 CEST | 65079 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:04:52.097738981 CEST | 53 | 60385 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.098035097 CEST | 53 | 56561 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.098227978 CEST | 53 | 65079 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:04:52.152753115 CEST | 53 | 52971 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.143362999 CEST | 63936 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:04:53.143490076 CEST | 59272 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:04:53.150686979 CEST | 53 | 59272 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.150702953 CEST | 53 | 63936 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:04:53.193403006 CEST | 53 | 51201 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:04:56.744388103 CEST | 55051 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:04:56.744559050 CEST | 62902 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:04:56.751178026 CEST | 53 | 55051 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:04:56.751358032 CEST | 53 | 62902 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:04:56.939943075 CEST | 53 | 51021 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:04:58.920550108 CEST | 53 | 54540 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:05:01.427745104 CEST | 58128 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:05:01.428200960 CEST | 57875 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:05:01.434961081 CEST | 53 | 58128 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:05:01.436538935 CEST | 53 | 57875 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.843913078 CEST | 53932 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:05:02.844264030 CEST | 54245 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:05:02.850888014 CEST | 53 | 53932 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:05:02.851666927 CEST | 53 | 54245 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:05:10.212270021 CEST | 53 | 51638 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:05:29.298360109 CEST | 53 | 53498 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:05:39.583101988 CEST | 138 | 138 | 192.168.2.9 | 192.168.2.255 |
| Oct 2, 2024 19:05:52.067354918 CEST | 53 | 52398 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:05:52.518435001 CEST | 53 | 50883 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:06:03.544791937 CEST | 61608 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:06:03.544981956 CEST | 65210 | 53 | 192.168.2.9 | 1.1.1.1 |
| Oct 2, 2024 19:06:03.551692009 CEST | 53 | 61608 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:06:03.552076101 CEST | 53 | 65210 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:06:03.600754976 CEST | 53 | 54938 | 1.1.1.1 | 192.168.2.9 |
| Oct 2, 2024 19:06:20.311574936 CEST | 53 | 58489 | 1.1.1.1 | 192.168.2.9 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 19:04:52.090497017 CEST | 192.168.2.9 | 1.1.1.1 | 0x1622 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:04:52.090627909 CEST | 192.168.2.9 | 1.1.1.1 | 0x444 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:04:53.143362999 CEST | 192.168.2.9 | 1.1.1.1 | 0xdfbb | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:04:53.143490076 CEST | 192.168.2.9 | 1.1.1.1 | 0x3469 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:04:56.744388103 CEST | 192.168.2.9 | 1.1.1.1 | 0x2c79 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:04:56.744559050 CEST | 192.168.2.9 | 1.1.1.1 | 0xce1e | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:05:01.427745104 CEST | 192.168.2.9 | 1.1.1.1 | 0x6e8c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:05:01.428200960 CEST | 192.168.2.9 | 1.1.1.1 | 0xe36f | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:05:02.843913078 CEST | 192.168.2.9 | 1.1.1.1 | 0xd43 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:05:02.844264030 CEST | 192.168.2.9 | 1.1.1.1 | 0x6c2f | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:06:03.544791937 CEST | 192.168.2.9 | 1.1.1.1 | 0x6938 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:06:03.544981956 CEST | 192.168.2.9 | 1.1.1.1 | 0x73a0 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 19:04:52.098035097 CEST | 1.1.1.1 | 192.168.2.9 | 0x1622 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:52.098227978 CEST | 1.1.1.1 | 192.168.2.9 | 0x444 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 19:04:53.150686979 CEST | 1.1.1.1 | 192.168.2.9 | 0x3469 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150686979 CEST | 1.1.1.1 | 192.168.2.9 | 0x3469 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 172.217.23.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:53.150702953 CEST | 1.1.1.1 | 192.168.2.9 | 0xdfbb | No error (0) | 172.217.18.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:56.751178026 CEST | 1.1.1.1 | 192.168.2.9 | 0x2c79 | No error (0) | 216.58.206.68 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:04:56.751358032 CEST | 1.1.1.1 | 192.168.2.9 | 0xce1e | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 19:05:01.434961081 CEST | 1.1.1.1 | 192.168.2.9 | 0x6e8c | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:05:01.434961081 CEST | 1.1.1.1 | 192.168.2.9 | 0x6e8c | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:05:01.436538935 CEST | 1.1.1.1 | 192.168.2.9 | 0xe36f | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:05:02.850888014 CEST | 1.1.1.1 | 192.168.2.9 | 0xd43 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:06:03.551692009 CEST | 1.1.1.1 | 192.168.2.9 | 0x6938 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.9 | 49708 | 142.250.185.78 | 443 | 7232 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 17:04:52 UTC | 847 | OUT | |
| 2024-10-02 17:04:53 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.9 | 49712 | 216.58.206.46 | 443 | 7232 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 17:04:53 UTC | 865 | OUT | |
| 2024-10-02 17:04:54 UTC | 2634 | IN |