Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1524436 |
| MD5: | 1cc0eec2a3105dbf316fdc0fbaac2bc9 |
| SHA1: | 5edd2ae6665330de970ac886d99242da9afdc2cd |
| SHA256: | 4e0d0b1dfb20de40249c8015e0b85ae809cdea9fe4191101eccf19448511b115 |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Classification
- System is w10x64
file.exe (PID: 7632 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 1CC0EEC2A3105DBF316FDC0FBAAC2BC9) 
taskkill.exe (PID: 7648 cmdline: taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) 
conhost.exe (PID: 7656 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
chrome.exe (PID: 7712 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://youtu be.com/acc ount?=http s://accoun ts.google. com/v3/sig nin/challe nge/pwd" - -start-ful lscreen -- no-first-r un --disab le-session -crashed-b ubble --di sable-info bars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7980 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2372 --fi eld-trial- handle=235 6,i,868525 2082371654 683,154401 4238395662 7020,26214 4 /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 8176 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=53 72 --field -trial-han dle=2356,i ,868525208 2371654683 ,154401423 8395662702 0,262144 / prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7416 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5324 --f ield-trial -handle=23 56,i,86852 5208237165 4683,15440 1423839566 27020,2621 44 /prefet ch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_007DDBBE | |
| Source: | Code function: | 0_2_007E68EE | |
| Source: | Code function: | 0_2_007E698F | |
| Source: | Code function: | 0_2_007DD076 | |
| Source: | Code function: | 0_2_007DD3A9 | |
| Source: | Code function: | 0_2_007E9642 | |
| Source: | Code function: | 0_2_007E979D | |
| Source: | Code function: | 0_2_007E9B2B | |
| Source: | Code function: | 0_2_007E5C97 | |
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_007ECE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_007EEAFF | |
| Source: | Code function: | 0_2_007EED6A | |
| Source: | Code function: | 0_2_007EEAFF | |
| Source: | Code function: | 0_2_007DAA57 | |
| Source: | Code function: | 0_2_00809576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_0ae955cd-4 | |
| Source: | String found in binary or memory: | memstr_2b9b836c-8 | |
| Source: | String found in binary or memory: | memstr_da86bdb6-3 | |
| Source: | String found in binary or memory: | memstr_71711395-f | |
| Source: | Code function: | 0_2_007DD5EB | |
| Source: | Code function: | 0_2_007D1201 | |
| Source: | Code function: | 0_2_007DE8F6 | |
| Source: | Code function: | 0_2_00778060 | |
| Source: | Code function: | 0_2_007E2046 | |
| Source: | Code function: | 0_2_007D8298 | |
| Source: | Code function: | 0_2_007AE4FF | |
| Source: | Code function: | 0_2_007A676B | |
| Source: | Code function: | 0_2_00804873 | |
| Source: | Code function: | 0_2_0077CAF0 | |
| Source: | Code function: | 0_2_0079CAA0 | |
| Source: | Code function: | 0_2_0078CC39 | |
| Source: | Code function: | 0_2_007A6DD9 | |
| Source: | Code function: | 0_2_0078B119 | |
| Source: | Code function: | 0_2_007791C0 | |
| Source: | Code function: | 0_2_00791394 | |
| Source: | Code function: | 0_2_00791706 | |
| Source: | Code function: | 0_2_0079781B | |
| Source: | Code function: | 0_2_0078997D | |
| Source: | Code function: | 0_2_00777920 | |
| Source: | Code function: | 0_2_007919B0 | |
| Source: | Code function: | 0_2_00797A4A | |
| Source: | Code function: | 0_2_00791C77 | |
| Source: | Code function: | 0_2_00797CA7 | |
| Source: | Code function: | 0_2_007FBE44 | |
| Source: | Code function: | 0_2_007A9EEE | |
| Source: | Code function: | 0_2_00791F32 | |
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_007E37B5 | |
| Source: | Code function: | 0_2_007D10BF | |
| Source: | Code function: | 0_2_007D16C3 | |
| Source: | Code function: | 0_2_007E51CD | |
| Source: | Code function: | 0_2_007FA67C | |
| Source: | Code function: | 0_2_007E648E | |
| Source: | Code function: | 0_2_007742A2 | |
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_007742DE | |
| Source: | Code function: | 0_2_00790A89 | |
| Source: | Code function: | 0_2_0078F98E | |
| Source: | Code function: | 0_2_00801C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-95891 | ||
| Source: | API coverage: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_007DDBBE | |
| Source: | Code function: | 0_2_007E68EE | |
| Source: | Code function: | 0_2_007E698F | |
| Source: | Code function: | 0_2_007DD076 | |
| Source: | Code function: | 0_2_007DD3A9 | |
| Source: | Code function: | 0_2_007E9642 | |
| Source: | Code function: | 0_2_007E979D | |
| Source: | Code function: | 0_2_007E9B2B | |
| Source: | Code function: | 0_2_007E5C97 | |
| Source: | Code function: | 0_2_007742DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_007EEAA2 | |
| Source: | Code function: | 0_2_007A2622 | |
| Source: | Code function: | 0_2_007742DE | |
| Source: | Code function: | 0_2_00794CE8 | |
| Source: | Code function: | 0_2_007D0B62 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_007A2622 | |
| Source: | Code function: | 0_2_0079083F | |
| Source: | Code function: | 0_2_007909D5 | |
| Source: | Code function: | 0_2_00790C21 | |
| Source: | Code function: | 0_2_007D1201 | |
| Source: | Code function: | 0_2_007B2BA5 | |
| Source: | Code function: | 0_2_007DB226 | |
| Source: | Code function: | 0_2_007F22DA | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_007D0B62 | |
| Source: | Code function: | 0_2_007D1663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00790698 | |
| Source: | Code function: | 0_2_007E8195 | |
| Source: | Code function: | 0_2_007CD27A | |
| Source: | Code function: | 0_2_007ABB6F | |
| Source: | Code function: | 0_2_007742DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 0_2_007F1204 | |
| Source: | Code function: | 0_2_007F1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 2 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 16 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 2 Valid Accounts | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Virtualization/Sandbox Evasion | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 21 Access Token Manipulation | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 2 Process Injection | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.185.142 | true | false | unknown | |
| www3.l.google.com | 142.250.184.238 | true | false | unknown | |
| play.google.com | 142.250.184.206 | true | false | unknown | |
| www.google.com | 142.250.186.132 | true | false | unknown | |
| youtube.com | 142.250.184.238 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 172.217.18.4 | unknown | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.142 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.132 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.184.238 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.184.206 | play.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.4 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1524436 |
| Start date and time: | 2024-10-02 19:23:09 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 52s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 12 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal64.troj.evad.winEXE@34/32@14/7 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.184.227, 216.58.206.46, 66.102.1.84, 34.104.35.123, 172.217.23.99, 142.250.186.163, 142.250.185.234, 142.250.186.170, 142.250.184.234, 172.217.18.10, 142.250.185.138, 172.217.16.202, 142.250.185.202, 142.250.186.42, 142.250.181.234, 142.250.185.170, 142.250.186.74, 142.250.186.106, 142.250.184.202, 142.250.185.106, 216.58.212.170, 216.58.206.42, 172.217.18.106, 142.250.74.202, 216.58.206.74, 172.217.23.106, 142.250.186.138, 93.184.221.240, 192.229.221.95, 74.125.71.84, 142.250.186.78
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
|
⊘No context
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.298162049824456 |
| Encrypted: | false |
| SSDEEP: | 48:o7vGoolL3ALFKphnpiu7xOKAcfO/3d/rYh4vZorw:o/QLUFUL4KA+2y0Mw |
| MD5: | CE055F881BDAB4EF6C1C8AA4B3890348 |
| SHA1: | 2671741A70E9F5B608F690AAEEA4972003747654 |
| SHA-256: | 9B91C23691D6032CDFE28863E369624B2EDB033E1487A1D1BB0977E3590E5462 |
| SHA-512: | 8A22250628985C2E570E6FBADFC0D5CB6753F0735130F9E74962A409476C2859C5C81F8A0F5C427A9F13ED399C8E251FA43FF67AD5F16860640D45E7A538E857 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.355381206612617 |
| Encrypted: | false |
| SSDEEP: | 48:o7FEEM3MtH15jNQ8jsK3rnw0dkckTrKEp/OqLE9xz0W5Bzv3M6hIHYA+JITbwrF8:oq675jOArwoAmI/DLaxNPL5m+m6w |
| MD5: | E2A7251AD83A0D0634FEA2703D10ED07 |
| SHA1: | 90D72011F31FC40D3DA3748F2817F90A29EB5C01 |
| SHA-256: | 1079B49C4AAF5C10E4F2E6A086623F40D200A71FF2A1F64E88AA6C91E4BE7A6F |
| SHA-512: | CD6D75580EA8BD97CF7C7C0E0BD9D9A54FB6EA7DF1DDB5A95E94D38B260F9EE1425C640839ECD229B8D01E145CF2786CA374D31EC537EB8FE17FF415D5B985F5 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1652 |
| Entropy (8bit): | 5.269909938363071 |
| Encrypted: | false |
| SSDEEP: | 48:o72ZrNZDuZW4yNAbU+15fMxIdf5WENoBCbw7DbG2bEJrw:oyRuZMNAY+1i4HoBNG2Ilw |
| MD5: | 63E5B24335CCDC457DD0B69AD1891CF9 |
| SHA1: | 8DD3AED0737BEDBEE133BA564D3CA43579A138F7 |
| SHA-256: | FB72BE79F85659D5AF831FD644C4702EA5BFC6E6A90CDB156DE0816B179278C0 |
| SHA-512: | EC3A143FED571A7FC490433F11DDBD66752E42F0BAC476F79F9B8310DB0419CAE2B8CD65F1283D590F5979F4CC1FB8B2610F106BF38E0B93F384201B8BF5E5DA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,NwH0H,OmgaI,gychg,w9hDv,EEDORb,Mlhmy,ZfAoz,kWgXee,ovKuLd,yDVVkb,ebZ3mb,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22833 |
| Entropy (8bit): | 5.425034548615223 |
| Encrypted: | false |
| SSDEEP: | 384:7lFo6ZEdpgtmyiPixV9OX9gMBpHkHnfst9lZulagGcwYHiRFjJzN7:77o6ZviPixV8xpEHn89l4IgGcwYCRtb7 |
| MD5: | 749B18538FE32BFE0815D75F899F5B21 |
| SHA1: | AF95A019211AF69F752A43CAA54A83C2AFD41D28 |
| SHA-256: | 116B2687C1D5E00DB56A79894AB0C12D4E2E000B9379B7E7AD751B84DF611F3F |
| SHA-512: | E4B6F4556AA0FD9979BB52681508F5E26FFB256473803F74F7F5C8D93FA3636D7D0A5835618FBC6123022805CE0D9616A7451A0F302C665E28A6090B5D588505 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.404371326611379 |
| Encrypted: | false |
| SSDEEP: | 192:EEFZpeip4HzZlY0If0Ma23jcUcrhCx6VD1TYPi8:Es/p4jgjUhtD1TY68 |
| MD5: | 21E893B65627B397E22619A9F5BB9662 |
| SHA1: | F561B0F66211C1E7B22F94B4935C312AB7087E85 |
| SHA-256: | FFA9B8BC8EF2CDFF5EB4BA1A0BA1710A253A5B42535E2A369D5026967DCF4673 |
| SHA-512: | 3DE3CD6A4E9B06AB3EB324E90A40B5F2AEEA8D7D6A2651C310E993CF79EEB5AC6E2E33C587F46B2DD20CC862354FD1A61AEBB9B990E6805F6629404BA285F8FA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 743936 |
| Entropy (8bit): | 5.791086230020914 |
| Encrypted: | false |
| SSDEEP: | 6144:YVXWBQkPdzg5pTX1ROv/duPzd8C3s891/N:Nfd8j91/N |
| MD5: | 1A3606C746E7B1C949D9078E8E8C1244 |
| SHA1: | 56A3EB1E93E61ACD7AAD39DC3526CB60E23651B1 |
| SHA-256: | 5F49AE5162183E2EF6F082B29EC99F18DB0212B8ADDB03699B1BFB0AC7869742 |
| SHA-512: | F2D15243311C472331C5F3F083BB6C18D38EC0247A3F3CBAFD96DBA40E4EAE489CDA04176672E39FE3760EF7347596B2A5EAB0FB0125E881EF514475C99863B9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlE6O04h0gj7Nu50q-nmaRKM6WWcJw/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1416 |
| Entropy (8bit): | 5.275155058463166 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7hqCsNRxoYTY9/qoVk7hz1l2p6vDMW94uEQOeGbCx4VGbgCSFBV87O/BprGJ:o7hv6oy12kvwKEeGbC6GbHSh/Hrw |
| MD5: | 4DB6842CDFAC9E03D7C1CF87E398B357 |
| SHA1: | 08158AB8F5947E048C88A1289E9E8CE9641B7CE9 |
| SHA-256: | 8991D23B586608AE114E150355FF192B30A379EAB1DC3F1444109DDC52B13AC1 |
| SHA-512: | FB7C461DFB96B10E099C3BA41C45AA904BB7D473EF0D44BD6A2E841BC44336DD5F1C9B73919B79A6BF4AA13B806E742F2003A16528E995374E210BB4C3E96EFA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4066 |
| Entropy (8bit): | 5.363016925556486 |
| Encrypted: | false |
| SSDEEP: | 96:G2CiFZX5BReR68ujioIRVrqtyzBeTV6SfyAKLif9c7w:bCMZXVeR6jiosVrqtyzBaImyAKw9x |
| MD5: | FC5E597D923838E10390DADD12651A81 |
| SHA1: | C9959F8D539DB5DF07B8246EC12539B6A9CC101F |
| SHA-256: | A7EBD5280C50AE93C061EAE1E9727329E015E97531F8F2D82D0E3EA76ADB37B4 |
| SHA-512: | 784CA572808F184A849388723FBB3701E6981D885BBA8A330A933F90BF0B36A2E4A491D4463A27911B1D9F7A7134F23E15F187FC7CB4554EAE9BC252513EED7C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 358799 |
| Entropy (8bit): | 5.624587482410481 |
| Encrypted: | false |
| SSDEEP: | 6144:T/wM8RGYcBlKmhCxiDlnc0pYMSrBg5X3rU:TD8XxEdA |
| MD5: | A51DFF6CB98C15CBA0A2B688CC0A862F |
| SHA1: | 5CF15DBD322A0F9CF3A820013E185EC2EDD56BB0 |
| SHA-256: | 854215C9FE46B6029883F37C44512F7EB10BA97FC7A623C237DC6824BD92DB1E |
| SHA-512: | D1036F2C4AE71BE22315D5AEC062E1D59EA2570D7138B97F367149C9622BEE35EAC1DBE9818AC7BE107D88683089EBE220951D025CC11908055B108B27D7BD86 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,EFQ78c,EIOG1e,GwYlN,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,y5vRwf,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 339747 |
| Entropy (8bit): | 5.53363647964667 |
| Encrypted: | false |
| SSDEEP: | 3072:Vuv7kVKtaVFuzDXG6ZfzeelpRv9xqjne01T2HemAIaDlC6diGVOY50UlRQQIBeDq:svaKtM6ZfTxene0F2HemAaGP6BBe2 |
| MD5: | D2D05D80ACF53F04C1BEB6A387216F5E |
| SHA1: | 6E8B87D352419E28C5F8E3881787DC6C56CEB26E |
| SHA-256: | 4BA0D4EA27446C609D515539A334E3B16A4AC7BF936A996CF7E3927FFDDD569F |
| SHA-512: | 966582697B455B2DDC52210A0F46EFD77EDC67D668E7FC2F14E18DF38E8595472AB76ED17B9D2928E16FA987E3231C2A45D9BD52D9DC2CE7E4C394E2453518E6 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5050 |
| Entropy (8bit): | 5.289052544075544 |
| Encrypted: | false |
| SSDEEP: | 96:o4We0hP7OBFXYvB1sig3Fd8HkaXzLmUrv8Vh1WJlLQXT2v2gqw:655758Fd8HkaPZ0GmAD |
| MD5: | 26E26FD11772DFF5C7004BEA334289CC |
| SHA1: | 638DAAF541BDE31E95AEE4F8ADA677434D7051DB |
| SHA-256: | ADFE3E4960982F5EF4C043052A9990D8683C5FC2B590E817B6B1A5774DDE2CE3 |
| SHA-512: | C31929EB6D1C60D6A84A2574FF60490394A6D6F9B354972F3328952F570D80B3F2AEC916B0E1B66DDB1AC056EB75BFAC477E7AF631D0AD1810EDBAF025465D66 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3467 |
| Entropy (8bit): | 5.514745431912774 |
| Encrypted: | false |
| SSDEEP: | 96:ozbld2fNUmeqJNizhNtt1W8t//loyIpXmdVE2w:onSKE8PWe/Cy4X3j |
| MD5: | 8DEF399E8355ABC23E64505281005099 |
| SHA1: | 24FF74C3AEFD7696D84FF148465DF4B1B60B1696 |
| SHA-256: | F128D7218E1286B05DF11310AD3C8F4CF781402698E45448850D2A3A22F5F185 |
| SHA-512: | 33721DD47658D8E12ADF6BD9E9316EB89F5B6297927F7FD60F954E04B829DCBF0E1AE6DDD9A3401F45E0011AE4B1397B960C218238A3D0F633A2173D8E604082 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32500 |
| Entropy (8bit): | 5.378903546681047 |
| Encrypted: | false |
| SSDEEP: | 768:zYlbuROstb0e39nKGrkysU0smpu4OLOdzIf1p/5GeSsngurz6aKEEEGo/:zYl61Cysbu4OLOdzIfrIen72ZFo/ |
| MD5: | BF4BF9728A7C302FBA5B14F3D0F1878B |
| SHA1: | 2607CA7A93710D629400077FF3602CB207E6F53D |
| SHA-256: | 8981E7B228DF7D6A8797C0CD1E9B0F1F88337D5F0E1C27A04E7A57D2C4309798 |
| SHA-512: | AC9E170FC3AFDC0CF6BB8E926B93EF129A5FAD1BBA51B60BABCF3555E9B652E98F86A00FB099879DED35DD3FFE72ECFA597E20E6CA8CF402BEDEC40F78412EDA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.582478564789801 |
| TrID: |
|
| File name: | file.exe |
| File size: | 918'528 bytes |
| MD5: | 1cc0eec2a3105dbf316fdc0fbaac2bc9 |
| SHA1: | 5edd2ae6665330de970ac886d99242da9afdc2cd |
| SHA256: | 4e0d0b1dfb20de40249c8015e0b85ae809cdea9fe4191101eccf19448511b115 |
| SHA512: | fa5aea0be6f2a6b6eebc28c51fb8e6d5798df79a7b27df7e208a0e4984292242255dd54c94a1bee338034151f9817eaa36103cb537d61a9d35a11ef33cd1d39d |
| SSDEEP: | 12288:DqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaBTG:DqDEvCTbMWu7rQYlBQcBiT6rprG8aVG |
| TLSH: | DB159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FD8129 [Wed Oct 2 17:21:45 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007FA1D08BFFD3h |
| jmp 00007FA1D08BF8DFh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FA1D08BFABDh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FA1D08BFA8Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007FA1D08C267Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007FA1D08C26C8h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007FA1D08C26B1h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9944 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9944 | 0x9a00 | 0d02492706b10f5353a260827c305701 | False | 0.3037997159090909 | data | 5.281111615804736 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xc0c | data | 1.0035667963683528 | ||
| RT_GROUP_ICON | 0xdd3c4 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd43c | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd450 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd464 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd478 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd554 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 19:24:03.353795052 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:03.353832960 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:03.353880882 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:03.355113029 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:03.355149031 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:03.990503073 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:03.992302895 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:03.992316008 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:03.992679119 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:03.992733002 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:03.993516922 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:03.993556023 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:03.995837927 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:03.995898008 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:03.997369051 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:03.997379065 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:04.038039923 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:04.285315990 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:04.285516024 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:04.285573959 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:04.286350965 CEST | 49732 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:04.286364079 CEST | 443 | 49732 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:04.298224926 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:04.298249960 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:04.298306942 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:04.298671961 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:04.298686981 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:04.350543976 CEST | 49675 | 443 | 192.168.2.4 | 173.222.162.32 |
| Oct 2, 2024 19:24:05.019434929 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.043402910 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:05.043435097 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.044826031 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.045908928 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:05.047302961 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.047406912 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:05.049241066 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:05.049241066 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:05.049264908 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.049433947 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.101558924 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:05.101581097 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.147429943 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:05.322061062 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.322118998 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.322210073 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:05.322222948 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.322288990 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:05.322817087 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:05.324707031 CEST | 49736 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 19:24:05.324722052 CEST | 443 | 49736 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.236485958 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:07.236504078 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.236557961 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:07.236767054 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:07.236778021 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.821887016 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:07.821928978 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.821991920 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:07.823550940 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:07.823574066 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.890825987 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.891314983 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:07.891382933 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.892271996 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.892337084 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:07.893369913 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:07.893431902 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.946033001 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:07.946052074 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.992917061 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:08.484481096 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:08.484553099 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:08.488857985 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:08.488874912 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:08.489306927 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:08.539752960 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:08.560575962 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:08.607429028 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:08.749891996 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:08.750063896 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:08.750140905 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:08.750236034 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:08.750236988 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:08.750287056 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:08.750315905 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:08.795494080 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:08.795598984 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:08.795819044 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:08.796053886 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:08.796094894 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:09.462654114 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:09.462802887 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:09.465389013 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:09.465437889 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:09.465956926 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:09.467271090 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:09.511396885 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:09.743221045 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:09.743319035 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:09.746588945 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:09.996844053 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:09.996874094 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:09.996891975 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 19:24:09.996900082 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 19:24:12.492230892 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:12.492275953 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:12.492341995 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:12.493601084 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:12.493616104 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.214219093 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.214557886 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.214586020 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.215151072 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.215219021 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.216218948 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.216281891 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.217449903 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.217544079 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.217645884 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.217660904 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.273056030 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.537508965 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.537606001 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.537620068 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:13.537653923 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.537657976 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.537681103 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.537689924 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.537719965 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.537754059 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:13.541980028 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:13.542021036 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.543201923 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.543258905 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.543287992 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.549487114 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.549527884 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.549552917 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.549577951 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.549618959 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.555835009 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.555887938 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.562164068 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.562207937 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.562247992 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.562271118 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.562311888 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.612762928 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:13.612807035 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.613032103 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:13.613225937 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:13.613240004 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.633083105 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.633152008 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.633202076 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.633244991 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.633284092 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.633302927 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.633304119 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.633304119 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.633337021 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.633378029 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.638808966 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.638922930 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.645514965 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.645567894 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.645586967 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.668560982 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.668608904 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.668637991 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.668643951 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.668672085 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.668689966 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.673973083 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.674037933 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.674123049 CEST | 49759 | 443 | 192.168.2.4 | 142.250.184.238 |
| Oct 2, 2024 19:24:13.674144030 CEST | 443 | 49759 | 142.250.184.238 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.172396898 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.172746897 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.172785044 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.173299074 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.173367977 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.174297094 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.174350977 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.175263882 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.175364017 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.175576925 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.175590038 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.227869987 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.456201077 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.456423998 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.456434965 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.456950903 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.457020998 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.457971096 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.458031893 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.458138943 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.458214998 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.458442926 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.458450079 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.491576910 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.491904020 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.491991043 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.493132114 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.493160963 CEST | 443 | 49761 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.493176937 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.493236065 CEST | 49761 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.495085001 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.495127916 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.495193958 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.495949030 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.495965004 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.501379013 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.760138035 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.760236979 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.760310888 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.794105053 CEST | 49763 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.794131994 CEST | 443 | 49763 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.795237064 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.795346975 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:14.795437098 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.795768023 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:14.795779943 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.134372950 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.134694099 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.134721994 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.135077953 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.135152102 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.135813951 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.135869026 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.136004925 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.136055946 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.136168003 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.136174917 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.136187077 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.179140091 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.179184914 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.352976084 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.354636908 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.354706049 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.355221033 CEST | 49765 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.355233908 CEST | 443 | 49765 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.422213078 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.422580957 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.422620058 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.422976017 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.423041105 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.423674107 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.423732996 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.423882961 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.424047947 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.424057007 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.424068928 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.424088001 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.467672110 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.467715025 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.510337114 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.641486883 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.642920971 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.642996073 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.643966913 CEST | 49766 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:15.643996000 CEST | 443 | 49766 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.248440981 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:16.295413971 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.521365881 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.521420002 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.521450043 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.521475077 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:16.521488905 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.521500111 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.521537066 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:16.521553993 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.521673918 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:16.521790981 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.521846056 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.521892071 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:16.526580095 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:16.526597023 CEST | 443 | 49741 | 142.250.186.132 | 192.168.2.4 |
| Oct 2, 2024 19:24:16.526612043 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:16.526647091 CEST | 49741 | 443 | 192.168.2.4 | 142.250.186.132 |
| Oct 2, 2024 19:24:18.790286064 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:18.790335894 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:18.790456057 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:18.791614056 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:18.791630030 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:19.389389992 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:19.389468908 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:19.392939091 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:19.392956972 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:19.393301964 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:19.446898937 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:20.142170906 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:20.187392950 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.337682009 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.337704897 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.337712049 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.337740898 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.337753057 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.337764978 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.337781906 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:20.337781906 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:20.337806940 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.337821007 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:20.337856054 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:20.338603973 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.338663101 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:20.338670969 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.338758945 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:20.339807987 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:21.050494909 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:21.050520897 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.050533056 CEST | 49774 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:21.050538063 CEST | 443 | 49774 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.309814930 CEST | 49779 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:21.309868097 CEST | 443 | 49779 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.310204983 CEST | 49779 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:21.310506105 CEST | 49779 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:21.310518980 CEST | 443 | 49779 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.589925051 CEST | 80 | 49723 | 178.79.208.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.590068102 CEST | 49723 | 80 | 192.168.2.4 | 178.79.208.1 |
| Oct 2, 2024 19:24:21.590241909 CEST | 49723 | 80 | 192.168.2.4 | 178.79.208.1 |
| Oct 2, 2024 19:24:21.595091105 CEST | 80 | 49723 | 178.79.208.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.942147017 CEST | 443 | 49779 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.942464113 CEST | 49779 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:21.942487955 CEST | 443 | 49779 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.942810059 CEST | 443 | 49779 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.943202972 CEST | 49779 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:21.943267107 CEST | 443 | 49779 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.943423986 CEST | 49779 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:21.943423986 CEST | 49779 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:21.943453074 CEST | 443 | 49779 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:22.265971899 CEST | 443 | 49779 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:22.266927958 CEST | 443 | 49779 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:22.267009974 CEST | 49779 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:22.328310966 CEST | 49779 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:22.328335047 CEST | 443 | 49779 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:33.581281900 CEST | 62746 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:33.586412907 CEST | 53 | 62746 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:33.586532116 CEST | 62746 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:33.591481924 CEST | 53 | 62746 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:34.042057037 CEST | 62746 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:34.048090935 CEST | 53 | 62746 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:34.048199892 CEST | 62746 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:43.902271986 CEST | 62747 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:43.902313948 CEST | 443 | 62747 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:43.902445078 CEST | 62747 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:43.902990103 CEST | 62747 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:43.903008938 CEST | 443 | 62747 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:43.964338064 CEST | 62748 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:43.964378119 CEST | 443 | 62748 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:43.964468956 CEST | 62748 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:43.965146065 CEST | 62748 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:43.965162992 CEST | 443 | 62748 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.607639074 CEST | 443 | 62748 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.608019114 CEST | 62748 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.608059883 CEST | 443 | 62748 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.608669996 CEST | 443 | 62748 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.609117985 CEST | 62748 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.609205008 CEST | 443 | 62748 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.609358072 CEST | 62748 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.609388113 CEST | 62748 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.609395981 CEST | 443 | 62748 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.635656118 CEST | 443 | 62747 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.636007071 CEST | 62747 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.636030912 CEST | 443 | 62747 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.636698961 CEST | 443 | 62747 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.637152910 CEST | 62747 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.637238026 CEST | 443 | 62747 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.637372971 CEST | 62747 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.637387991 CEST | 62747 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.637403965 CEST | 443 | 62747 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.821669102 CEST | 443 | 62748 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.821970940 CEST | 443 | 62748 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.822053909 CEST | 62748 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.822277069 CEST | 62748 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.822302103 CEST | 443 | 62748 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.945589066 CEST | 443 | 62747 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.946620941 CEST | 443 | 62747 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:44.946707010 CEST | 62747 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.947263002 CEST | 62747 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:44.947284937 CEST | 443 | 62747 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:45.355446100 CEST | 62749 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:45.355561972 CEST | 443 | 62749 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:45.355817080 CEST | 62749 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:45.356136084 CEST | 62749 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:45.356165886 CEST | 443 | 62749 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:46.027157068 CEST | 443 | 62749 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:46.027676105 CEST | 62749 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:46.027746916 CEST | 443 | 62749 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:46.028275967 CEST | 443 | 62749 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:46.028886080 CEST | 62749 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:46.028975964 CEST | 443 | 62749 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:46.029231071 CEST | 62749 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:46.029264927 CEST | 62749 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:46.029277086 CEST | 443 | 62749 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:46.255243063 CEST | 443 | 62749 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:46.255848885 CEST | 443 | 62749 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:46.256042957 CEST | 62749 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:46.256424904 CEST | 62749 | 443 | 192.168.2.4 | 142.250.184.206 |
| Oct 2, 2024 19:24:46.256491899 CEST | 443 | 62749 | 142.250.184.206 | 192.168.2.4 |
| Oct 2, 2024 19:24:57.800357103 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:57.800404072 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:57.800483942 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:57.800839901 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:57.800851107 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.408963919 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.409116983 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:58.419159889 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:58.419179916 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.420084000 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.427894115 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:58.475394011 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.664398909 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.664453983 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.664494991 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.664602995 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:58.664618015 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.664635897 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.664671898 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:58.664676905 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.664702892 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:58.664737940 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:58.665330887 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.665433884 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.665478945 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:58.672246933 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:58.672270060 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:24:58.672285080 CEST | 62750 | 443 | 192.168.2.4 | 20.12.23.50 |
| Oct 2, 2024 19:24:58.672290087 CEST | 443 | 62750 | 20.12.23.50 | 192.168.2.4 |
| Oct 2, 2024 19:25:07.299072027 CEST | 62752 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:25:07.299139977 CEST | 443 | 62752 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:25:07.299253941 CEST | 62752 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:25:07.299446106 CEST | 62752 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:25:07.299468040 CEST | 443 | 62752 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:25:07.959867001 CEST | 443 | 62752 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:25:07.960350037 CEST | 62752 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:25:07.960361004 CEST | 443 | 62752 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:25:07.961472988 CEST | 443 | 62752 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:25:07.961795092 CEST | 62752 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:25:07.961962938 CEST | 443 | 62752 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:25:08.008956909 CEST | 62752 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:25:10.804727077 CEST | 49724 | 80 | 192.168.2.4 | 88.221.110.106 |
| Oct 2, 2024 19:25:10.812949896 CEST | 80 | 49724 | 88.221.110.106 | 192.168.2.4 |
| Oct 2, 2024 19:25:10.813102007 CEST | 49724 | 80 | 192.168.2.4 | 88.221.110.106 |
| Oct 2, 2024 19:25:17.864425898 CEST | 443 | 62752 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:25:17.864521027 CEST | 443 | 62752 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:25:17.864562988 CEST | 62752 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:25:30.601983070 CEST | 62752 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:25:30.602055073 CEST | 443 | 62752 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:26:07.352982044 CEST | 62759 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:26:07.353037119 CEST | 443 | 62759 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:26:07.353566885 CEST | 62759 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:26:07.353566885 CEST | 62759 | 443 | 192.168.2.4 | 172.217.18.4 |
| Oct 2, 2024 19:26:07.353614092 CEST | 443 | 62759 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:26:07.994535923 CEST | 443 | 62759 | 172.217.18.4 | 192.168.2.4 |
| Oct 2, 2024 19:26:08.038897991 CEST | 62759 | 443 | 192.168.2.4 | 172.217.18.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 19:24:03.334824085 CEST | 50505 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:03.334956884 CEST | 60515 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:03.343002081 CEST | 53 | 61591 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:03.343460083 CEST | 53 | 60515 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:03.343647003 CEST | 53 | 50505 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:03.349344015 CEST | 53 | 59254 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:04.290518045 CEST | 53506 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:04.290630102 CEST | 52202 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:04.297583103 CEST | 53 | 53506 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:04.297815084 CEST | 53 | 52202 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:04.321902990 CEST | 53 | 55208 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.227897882 CEST | 56315 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:07.228018045 CEST | 65035 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:07.235044956 CEST | 53 | 56315 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:07.235719919 CEST | 53 | 65035 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:10.001609087 CEST | 53 | 55164 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:12.484332085 CEST | 50334 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:12.484464884 CEST | 58309 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:12.491400003 CEST | 53 | 50334 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:12.491420984 CEST | 53 | 58309 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.517786980 CEST | 58530 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:13.517947912 CEST | 65476 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:24:13.524643898 CEST | 53 | 65476 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:13.524878025 CEST | 53 | 58530 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:15.283921957 CEST | 53 | 60415 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:21.241682053 CEST | 53 | 58108 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:22.533901930 CEST | 138 | 138 | 192.168.2.4 | 192.168.2.255 |
| Oct 2, 2024 19:24:33.580831051 CEST | 53 | 65087 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:24:40.111283064 CEST | 53 | 50228 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:25:02.596137047 CEST | 53 | 49173 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:25:02.705770016 CEST | 53 | 60418 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:25:07.290992975 CEST | 60085 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:25:07.291117907 CEST | 52544 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:25:07.297868013 CEST | 53 | 60085 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:25:07.298258066 CEST | 53 | 52544 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:25:14.333589077 CEST | 53 | 59770 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:25:14.612617016 CEST | 49430 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:25:14.612689018 CEST | 58745 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 19:25:14.619513035 CEST | 53 | 58745 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:25:14.619868994 CEST | 53 | 49430 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 19:25:30.609286070 CEST | 53 | 60859 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 19:24:03.334824085 CEST | 192.168.2.4 | 1.1.1.1 | 0xabb8 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:24:03.334956884 CEST | 192.168.2.4 | 1.1.1.1 | 0xbdd4 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:24:04.290518045 CEST | 192.168.2.4 | 1.1.1.1 | 0x8dc8 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:24:04.290630102 CEST | 192.168.2.4 | 1.1.1.1 | 0xace2 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:24:07.227897882 CEST | 192.168.2.4 | 1.1.1.1 | 0xa6a6 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:24:07.228018045 CEST | 192.168.2.4 | 1.1.1.1 | 0x2147 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:24:12.484332085 CEST | 192.168.2.4 | 1.1.1.1 | 0x96ec | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:24:12.484464884 CEST | 192.168.2.4 | 1.1.1.1 | 0xf481 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:24:13.517786980 CEST | 192.168.2.4 | 1.1.1.1 | 0x4bcc | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:24:13.517947912 CEST | 192.168.2.4 | 1.1.1.1 | 0x989f | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:25:07.290992975 CEST | 192.168.2.4 | 1.1.1.1 | 0xc5ac | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:25:07.291117907 CEST | 192.168.2.4 | 1.1.1.1 | 0x9a9b | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 19:25:14.612617016 CEST | 192.168.2.4 | 1.1.1.1 | 0xbe95 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 19:25:14.612689018 CEST | 192.168.2.4 | 1.1.1.1 | 0x16de | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 19:24:03.343460083 CEST | 1.1.1.1 | 192.168.2.4 | 0xbdd4 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 19:24:03.343647003 CEST | 1.1.1.1 | 192.168.2.4 | 0xabb8 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 172.217.23.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 172.217.18.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297583103 CEST | 1.1.1.1 | 192.168.2.4 | 0x8dc8 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297815084 CEST | 1.1.1.1 | 192.168.2.4 | 0xace2 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:04.297815084 CEST | 1.1.1.1 | 192.168.2.4 | 0xace2 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 19:24:07.235044956 CEST | 1.1.1.1 | 192.168.2.4 | 0xa6a6 | No error (0) | 142.250.186.132 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:07.235719919 CEST | 1.1.1.1 | 192.168.2.4 | 0x2147 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 19:24:12.491400003 CEST | 1.1.1.1 | 192.168.2.4 | 0x96ec | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:12.491400003 CEST | 1.1.1.1 | 192.168.2.4 | 0x96ec | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:12.491420984 CEST | 1.1.1.1 | 192.168.2.4 | 0xf481 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 19:24:13.524878025 CEST | 1.1.1.1 | 192.168.2.4 | 0x4bcc | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:25:07.297868013 CEST | 1.1.1.1 | 192.168.2.4 | 0xc5ac | No error (0) | 172.217.18.4 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 19:25:07.298258066 CEST | 1.1.1.1 | 192.168.2.4 | 0x9a9b | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 19:25:14.619868994 CEST | 1.1.1.1 | 192.168.2.4 | 0xbe95 | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49732 | 142.250.184.238 | 443 | 7980 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 17:24:03 UTC | 851 | OUT | |
| 2024-10-02 17:24:04 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49736 | 142.250.185.142 | 443 | 7980 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 17:24:05 UTC | 869 | OUT | |
| 2024-10-02 17:24:05 UTC | 2634 | IN |