Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1524530 |
| MD5: | 015f30ab4a592ca2cfcd7419793a0974 |
| SHA1: | b483c989c924e274e920a41a2283422bb7b9a62c |
| SHA256: | bd70def4378a1772742bf8943b919e5faed5b8c3bb08f9fff4f8bfdcf3da7ee6 |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Classification
- System is w10x64
file.exe (PID: 7140 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 015F30AB4A592CA2CFCD7419793A0974) 
taskkill.exe (PID: 6196 cmdline: taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) 
conhost.exe (PID: 6176 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 5968 cmdline:
taskkill / F /IM msed ge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 3716 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 5596 cmdline:
taskkill / F /IM fire fox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 4928 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 2924 cmdline:
taskkill / F /IM oper a.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 6156 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 5480 cmdline:
taskkill / F /IM brav e.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 3704 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
chrome.exe (PID: 6160 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://youtu be.com/acc ount?=http s://accoun ts.google. com/v3/sig nin/challe nge/pwd" - -start-ful lscreen -- no-first-r un --disab le-session -crashed-b ubble --di sable-info bars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 2668 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2056 --fi eld-trial- handle=198 8,i,271449 5616838969 432,123830 5855396355 1388,26214 4 /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7940 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=53 20 --field -trial-han dle=1988,i ,271449561 6838969432 ,123830585 5396355138 8,262144 / prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7948 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5480 --f ield-trial -handle=19 88,i,27144 9561683896 9432,12383 0585539635 51388,2621 44 /prefet ch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0086DBBE | |
| Source: | Code function: | 0_2_008768EE | |
| Source: | Code function: | 0_2_0087698F | |
| Source: | Code function: | 0_2_0086D076 | |
| Source: | Code function: | 0_2_0086D3A9 | |
| Source: | Code function: | 0_2_00879642 | |
| Source: | Code function: | 0_2_0087979D | |
| Source: | Code function: | 0_2_00879B2B | |
| Source: | Code function: | 0_2_00875C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_0087CE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0087EAFF | |
| Source: | Code function: | 0_2_0087ED6A | |
| Source: | Code function: | 0_2_0087EAFF | |
| Source: | Code function: | 0_2_0086AA57 | |
| Source: | Code function: | 0_2_00899576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_40f243c8-4 | |
| Source: | String found in binary or memory: | memstr_b71be217-7 | |
| Source: | String found in binary or memory: | memstr_415e04af-e | |
| Source: | String found in binary or memory: | memstr_06f69019-3 | |
| Source: | Code function: | 0_2_0086D5EB | |
| Source: | Code function: | 0_2_00861201 | |
| Source: | Code function: | 0_2_0086E8F6 | |
| Source: | Code function: | 0_2_0080BF40 | |
| Source: | Code function: | 0_2_00872046 | |
| Source: | Code function: | 0_2_00808060 | |
| Source: | Code function: | 0_2_00868298 | |
| Source: | Code function: | 0_2_0083E4FF | |
| Source: | Code function: | 0_2_0083676B | |
| Source: | Code function: | 0_2_00894873 | |
| Source: | Code function: | 0_2_0082CAA0 | |
| Source: | Code function: | 0_2_0080CAF0 | |
| Source: | Code function: | 0_2_0081CC39 | |
| Source: | Code function: | 0_2_00836DD9 | |
| Source: | Code function: | 0_2_008091C0 | |
| Source: | Code function: | 0_2_0081B119 | |
| Source: | Code function: | 0_2_00821394 | |
| Source: | Code function: | 0_2_00821706 | |
| Source: | Code function: | 0_2_0082781B | |
| Source: | Code function: | 0_2_008219B0 | |
| Source: | Code function: | 0_2_00807920 | |
| Source: | Code function: | 0_2_0081997D | |
| Source: | Code function: | 0_2_00827A4A | |
| Source: | Code function: | 0_2_00827CA7 | |
| Source: | Code function: | 0_2_00821C77 | |
| Source: | Code function: | 0_2_00839EEE | |
| Source: | Code function: | 0_2_0088BE44 | |
| Source: | Code function: | 0_2_00821F32 | |
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_008737B5 | |
| Source: | Code function: | 0_2_008610BF | |
| Source: | Code function: | 0_2_008616C3 | |
| Source: | Code function: | 0_2_008751CD | |
| Source: | Code function: | 0_2_0088A67C | |
| Source: | Code function: | 0_2_0087648E | |
| Source: | Code function: | 0_2_008042A2 | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_008042DE | |
| Source: | Code function: | 0_2_00820A89 | |
| Source: | Code function: | 0_2_0081F98E | |
| Source: | Code function: | 0_2_00891C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-96445 | ||
| Source: | API coverage: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_0086DBBE | |
| Source: | Code function: | 0_2_008768EE | |
| Source: | Code function: | 0_2_0087698F | |
| Source: | Code function: | 0_2_0086D076 | |
| Source: | Code function: | 0_2_0086D3A9 | |
| Source: | Code function: | 0_2_00879642 | |
| Source: | Code function: | 0_2_0087979D | |
| Source: | Code function: | 0_2_00879B2B | |
| Source: | Code function: | 0_2_00875C97 | |
| Source: | Code function: | 0_2_008042DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_0087EAA2 | |
| Source: | Code function: | 0_2_00832622 | |
| Source: | Code function: | 0_2_008042DE | |
| Source: | Code function: | 0_2_00824CE8 | |
| Source: | Code function: | 0_2_00860B62 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_00832622 | |
| Source: | Code function: | 0_2_0082083F | |
| Source: | Code function: | 0_2_008209D5 | |
| Source: | Code function: | 0_2_00820C21 | |
| Source: | Code function: | 0_2_00861201 | |
| Source: | Code function: | 0_2_00842BA5 | |
| Source: | Code function: | 0_2_0086B226 | |
| Source: | Code function: | 0_2_008822DA | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00860B62 | |
| Source: | Code function: | 0_2_00861663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00820698 | |
| Source: | Code function: | 0_2_00878195 | |
| Source: | Code function: | 0_2_0085D27A | |
| Source: | Code function: | 0_2_0083BB6F | |
| Source: | Code function: | 0_2_008042DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 0_2_00881204 | |
| Source: | Code function: | 0_2_00881806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 2 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 16 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 2 Valid Accounts | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Virtualization/Sandbox Evasion | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 21 Access Token Manipulation | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 2 Process Injection | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.186.110 | true | false | unknown | |
| www3.l.google.com | 142.250.186.174 | true | false | unknown | |
| play.google.com | 142.250.185.174 | true | false | unknown | |
| www.google.com | 142.250.184.228 | true | false | unknown | |
| youtube.com | 142.250.185.142 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.186.174 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.18.14 | unknown | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.174 | play.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.142 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.110 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.184.228 | www.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.4 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1524530 |
| Start date and time: | 2024-10-02 23:03:05 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 8s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 21 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal64.troj.evad.winEXE@46/32@12/8 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 172.217.18.3, 142.250.185.206, 64.233.184.84, 34.104.35.123, 142.250.184.227, 142.250.186.163, 216.58.212.138, 142.250.184.234, 172.217.23.106, 142.250.181.234, 142.250.184.202, 142.250.185.170, 216.58.206.42, 142.250.186.138, 216.58.206.74, 142.250.185.234, 142.250.185.202, 142.250.185.138, 142.250.186.170, 142.250.74.202, 142.250.185.106, 142.250.185.74, 142.250.186.106, 142.250.186.42, 172.217.16.202, 142.250.186.74, 216.58.212.170, 172.217.18.10, 172.217.16.138, 88.221.110.91, 192.229.221.95, 216.58.206.35, 74.125.71.84, 142.250.186.78
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | XWorm | Browse | ||
| Get hash | malicious | Amadey, Credential Flusher, Stealc | Browse | |||
| Get hash | malicious | Tycoon2FA | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HtmlDropper | Browse | |||
| Get hash | malicious | Phisher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Phisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | Amadey, Credential Flusher, Stealc | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Phisher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Phisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HtmlDropper | Browse |
|
⊘No context
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 652451 |
| Entropy (8bit): | 5.599799481050377 |
| Encrypted: | false |
| SSDEEP: | 6144:T9vbKtSfcxene0F2HZPM8RGYcBlKmM5r6bISxiDlnc0pYMSrBg5X3O4mAEzD7:T9jKtqIcP8XgISxEd0b |
| MD5: | FCEEAAAD0B59B9E3EE242C8A7D2F70AC |
| SHA1: | 3CE31E474F797B2619836FCF342FE7BE0C64AD44 |
| SHA-256: | A95E47E1246A54C9FC3E6D84DCBB85E3E6EFC454DBD2F0AE85DAD72A0EDC4A5C |
| SHA-512: | 0AF4011AEC6BE19B7B5596708B02A39BEA02DE20D8835E33A7E709EB38D63275483F4CB402B3A4D5520363F2539E66AA921F7E437A85C7D3334D4497939D2D4F |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc,soHxf/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.298162049824456 |
| Encrypted: | false |
| SSDEEP: | 48:o7vGoolL3ALFKphnpiu7xOKAcfO/3d/rYh4vZorw:o/QLUFUL4KA+2y0Mw |
| MD5: | CE055F881BDAB4EF6C1C8AA4B3890348 |
| SHA1: | 2671741A70E9F5B608F690AAEEA4972003747654 |
| SHA-256: | 9B91C23691D6032CDFE28863E369624B2EDB033E1487A1D1BB0977E3590E5462 |
| SHA-512: | 8A22250628985C2E570E6FBADFC0D5CB6753F0735130F9E74962A409476C2859C5C81F8A0F5C427A9F13ED399C8E251FA43FF67AD5F16860640D45E7A538E857 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.355381206612617 |
| Encrypted: | false |
| SSDEEP: | 48:o7FEEM3MtH15jNQ8jsK3rnw0dkckTrKEp/OqLE9xz0W5Bzv3M6hIHYA+JITbwrF8:oq675jOArwoAmI/DLaxNPL5m+m6w |
| MD5: | E2A7251AD83A0D0634FEA2703D10ED07 |
| SHA1: | 90D72011F31FC40D3DA3748F2817F90A29EB5C01 |
| SHA-256: | 1079B49C4AAF5C10E4F2E6A086623F40D200A71FF2A1F64E88AA6C91E4BE7A6F |
| SHA-512: | CD6D75580EA8BD97CF7C7C0E0BD9D9A54FB6EA7DF1DDB5A95E94D38B260F9EE1425C640839ECD229B8D01E145CF2786CA374D31EC537EB8FE17FF415D5B985F5 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22833 |
| Entropy (8bit): | 5.425034548615223 |
| Encrypted: | false |
| SSDEEP: | 384:7lFo6ZEdpgtmyiPixV9OX9gMBpHkHnfst9lZulagGcwYHiRFjJzN7:77o6ZviPixV8xpEHn89l4IgGcwYCRtb7 |
| MD5: | 749B18538FE32BFE0815D75F899F5B21 |
| SHA1: | AF95A019211AF69F752A43CAA54A83C2AFD41D28 |
| SHA-256: | 116B2687C1D5E00DB56A79894AB0C12D4E2E000B9379B7E7AD751B84DF611F3F |
| SHA-512: | E4B6F4556AA0FD9979BB52681508F5E26FFB256473803F74F7F5C8D93FA3636D7D0A5835618FBC6123022805CE0D9616A7451A0F302C665E28A6090B5D588505 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4066 |
| Entropy (8bit): | 5.363016925556486 |
| Encrypted: | false |
| SSDEEP: | 96:G2CiFZX5BReR68ujioIRVrqtyzBeTV6SfyAKLif9c7w:bCMZXVeR6jiosVrqtyzBaImyAKw9x |
| MD5: | FC5E597D923838E10390DADD12651A81 |
| SHA1: | C9959F8D539DB5DF07B8246EC12539B6A9CC101F |
| SHA-256: | A7EBD5280C50AE93C061EAE1E9727329E015E97531F8F2D82D0E3EA76ADB37B4 |
| SHA-512: | 784CA572808F184A849388723FBB3701E6981D885BBA8A330A933F90BF0B36A2E4A491D4463A27911B1D9F7A7134F23E15F187FC7CB4554EAE9BC252513EED7C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.291808298251231 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DuZvuhqCsNRxoYTY9/qoVk7hz1l2p6vDMW94uEQOeGbCx4VGbgCSFBV87OU:o7DuZWhv6oy12kvwKEeGbC6GbHSh/Hrw |
| MD5: | 4CA7ADFE744A690411EA4D3EA8DB9E4B |
| SHA1: | 2CF1777A199E25378D330DA68BED1871B5C5BC32 |
| SHA-256: | 128129BA736B3094323499B0498A5B3A909C1529717461C34B70080A5B1603BD |
| SHA-512: | 8BD3477AF41D1F0FE74AFFCB177BEC0F5F4FDCBBA6BD29D9C2567E6FFDEF5DEB7FF74BF348F33209C39D7BB4958E748DF6731D3DC8F6947352276BC92EAF9E79 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 743936 |
| Entropy (8bit): | 5.791086230020914 |
| Encrypted: | false |
| SSDEEP: | 6144:YVXWBQkPdzg5pTX1ROv/duPzd8C3s891/N:Nfd8j91/N |
| MD5: | 1A3606C746E7B1C949D9078E8E8C1244 |
| SHA1: | 56A3EB1E93E61ACD7AAD39DC3526CB60E23651B1 |
| SHA-256: | 5F49AE5162183E2EF6F082B29EC99F18DB0212B8ADDB03699B1BFB0AC7869742 |
| SHA-512: | F2D15243311C472331C5F3F083BB6C18D38EC0247A3F3CBAFD96DBA40E4EAE489CDA04176672E39FE3760EF7347596B2A5EAB0FB0125E881EF514475C99863B9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlE6O04h0gj7Nu50q-nmaRKM6WWcJw/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 8053 |
| Entropy (8bit): | 5.39187659584276 |
| Encrypted: | false |
| SSDEEP: | 96:oxxRcFgkRCIPpAgTr7fhT5rbEb9PdimzZlY0If0Ma23jcUdZl6rhCXKMikrw:EEFZpeip4HzZlY0If0Ma23jcUcrhC6i8 |
| MD5: | 5261AFCC98EB0E51A8B63EE51C4C789E |
| SHA1: | D97390439B8378F68DF22FE7443981ED02D4068B |
| SHA-256: | 9238373DF26FE8EFCC95DDCE9828630D15FAB5C9B321C36CC1726A6248A75C36 |
| SHA-512: | F6E408B551EEB504EA6C7F981B05AD9297A7FAD1746C0E6D3D6F367C43F36A4A96896BC4B9F60C163F4B84FDD57DD2A39CB3BC6990B6319FF3AA069AC41B9495 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 47223 |
| Entropy (8bit): | 5.485255863863186 |
| Encrypted: | false |
| SSDEEP: | 768:OxTAxQeYbC7ZwD1HqN9/aOlmkq6qdCPR9zwhBFi5fcjWFkazh/vdsth3Hywh6Ri1:4AhNW/QqXywxVkYWcAPqBDnDj |
| MD5: | EEF69871228E244E61EF87034AE72B27 |
| SHA1: | EB660C1B7F4E0F5378D169B9B4205253E8CCA82D |
| SHA-256: | D747A90E5298CA64C986B75CC01656FD9AE3D6B02289E392A59EA2D29B0A7936 |
| SHA-512: | 8389B7C9D03218F5BF4099A2A8EBE3D53194B944FF8DCD7B02DDE04296B099F08AA2B86E0D437D48C8597C305C966CA5F9A69E081D7DBF17129FF2C515FD02D5 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=soHxf" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3467 |
| Entropy (8bit): | 5.514745431912774 |
| Encrypted: | false |
| SSDEEP: | 96:ozbld2fNUmeqJNizhNtt1W8t//loyIpXmdVE2w:onSKE8PWe/Cy4X3j |
| MD5: | 8DEF399E8355ABC23E64505281005099 |
| SHA1: | 24FF74C3AEFD7696D84FF148465DF4B1B60B1696 |
| SHA-256: | F128D7218E1286B05DF11310AD3C8F4CF781402698E45448850D2A3A22F5F185 |
| SHA-512: | 33721DD47658D8E12ADF6BD9E9316EB89F5B6297927F7FD60F954E04B829DCBF0E1AE6DDD9A3401F45E0011AE4B1397B960C218238A3D0F633A2173D8E604082 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.257113147606035 |
| Encrypted: | false |
| SSDEEP: | 48:o72ZrNZ4yNAbU+15fMxIdf5WENoBCbw7DbG2bEJrw:oyNNAY+1i4HoBNG2Ilw |
| MD5: | F06E2DC5CC446B39F878B5F8E4D78418 |
| SHA1: | 9F1F34FDD8F8DAB942A9B95D9F720587B6F6AD48 |
| SHA-256: | 118E4D2FE7CEF205F9AFC87636554C6D8220882B158333EE3D1990282D158B8F |
| SHA-512: | 893C4F883CD1C88C6AAF5A6E7F232D62823A53E1FFDE5C1C52BB066D75781DD041F4D281CDBF18070D921CE862652D8863E2B9D5E0190CFA4128890D62C44168 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5050 |
| Entropy (8bit): | 5.289052544075544 |
| Encrypted: | false |
| SSDEEP: | 96:o4We0hP7OBFXYvB1sig3Fd8HkaXzLmUrv8Vh1WJlLQXT2v2gqw:655758Fd8HkaPZ0GmAD |
| MD5: | 26E26FD11772DFF5C7004BEA334289CC |
| SHA1: | 638DAAF541BDE31E95AEE4F8ADA677434D7051DB |
| SHA-256: | ADFE3E4960982F5EF4C043052A9990D8683C5FC2B590E817B6B1A5774DDE2CE3 |
| SHA-512: | C31929EB6D1C60D6A84A2574FF60490394A6D6F9B354972F3328952F570D80B3F2AEC916B0E1B66DDB1AC056EB75BFAC477E7AF631D0AD1810EDBAF025465D66 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32500 |
| Entropy (8bit): | 5.378903546681047 |
| Encrypted: | false |
| SSDEEP: | 768:zYlbuROstb0e39nKGrkysU0smpu4OLOdzIf1p/5GeSsngurz6aKEEEGo/:zYl61Cysbu4OLOdzIfrIen72ZFo/ |
| MD5: | BF4BF9728A7C302FBA5B14F3D0F1878B |
| SHA1: | 2607CA7A93710D629400077FF3602CB207E6F53D |
| SHA-256: | 8981E7B228DF7D6A8797C0CD1E9B0F1F88337D5F0E1C27A04E7A57D2C4309798 |
| SHA-512: | AC9E170FC3AFDC0CF6BB8E926B93EF129A5FAD1BBA51B60BABCF3555E9B652E98F86A00FB099879DED35DD3FFE72ECFA597E20E6CA8CF402BEDEC40F78412EDA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.583306698690746 |
| TrID: |
|
| File name: | file.exe |
| File size: | 919'040 bytes |
| MD5: | 015f30ab4a592ca2cfcd7419793a0974 |
| SHA1: | b483c989c924e274e920a41a2283422bb7b9a62c |
| SHA256: | bd70def4378a1772742bf8943b919e5faed5b8c3bb08f9fff4f8bfdcf3da7ee6 |
| SHA512: | 7ba7bc07ae65a835fd6a52a0b744d755d5e1acab37622960ce3753a5c4d568c644ab37ecfbc51186f12b1313bd535c897d0287e955dcce6fc47c535de2762f3d |
| SSDEEP: | 12288:gqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgalTy:gqDEvCTbMWu7rQYlBQcBiT6rprG8aRy |
| TLSH: | AB159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FDB4C8 [Wed Oct 2 21:02:00 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F9C7CFD90C3h |
| jmp 00007F9C7CFD89CFh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F9C7CFD8BADh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F9C7CFD8B7Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F9C7CFDB76Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F9C7CFDB7B8h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F9C7CFDB7A1h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9a10 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9a10 | 0x9c00 | 5f7b793ce474177a4f4fbee156c72c2d | False | 0.3053385416666667 | data | 5.32540113626387 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xcd8 | data | 1.003345498783455 | ||
| RT_GROUP_ICON | 0xdd490 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd508 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd51c | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd530 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd544 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd620 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 23:04:00.281747103 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:00.281810045 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.281891108 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:00.283267975 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:00.283289909 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.506000996 CEST | 49675 | 443 | 192.168.2.4 | 173.222.162.32 |
| Oct 2, 2024 23:04:00.928704023 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.929198980 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:00.929230928 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.929779053 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.929856062 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:00.931217909 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.931265116 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:00.932924032 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:00.932993889 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.934128046 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:00.934135914 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.974745035 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:01.206677914 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.206831932 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.206882000 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:01.214287996 CEST | 49730 | 443 | 192.168.2.4 | 142.250.185.142 |
| Oct 2, 2024 23:04:01.214320898 CEST | 443 | 49730 | 142.250.185.142 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.228442907 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:01.228501081 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.228560925 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:01.229017019 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:01.229032993 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.874026060 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.874402046 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:01.874427080 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.875165939 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.875231028 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:01.876194000 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.876240969 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:01.877605915 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:01.877685070 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.877898932 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:01.877906084 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.927851915 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:02.191418886 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:02.191447020 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:02.191526890 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:02.191574097 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:02.192125082 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:02.192188025 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:02.194370985 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:02.194402933 CEST | 443 | 49736 | 142.250.186.110 | 192.168.2.4 |
| Oct 2, 2024 23:04:02.194443941 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:02.194468021 CEST | 49736 | 443 | 192.168.2.4 | 142.250.186.110 |
| Oct 2, 2024 23:04:04.548825979 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:04.548877954 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:04.548969984 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:04.549120903 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:04.549137115 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:04.863094091 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:04.863153934 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:04.863250017 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:04.864702940 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:04.864722013 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:05.185885906 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:05.186113119 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:05.186124086 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:05.187562943 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:05.187632084 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:05.188730955 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:05.188813925 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:05.242463112 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:05.242477894 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:05.289393902 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:05.511727095 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:05.511786938 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:05.518433094 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:05.518450975 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:05.518666983 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:05.560260057 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:05.607400894 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:06.739980936 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:06.740165949 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:06.740197897 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:06.740211964 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:06.740214109 CEST | 49742 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:06.740248919 CEST | 443 | 49742 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:06.763309956 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:06.763410091 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:06.763623953 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:06.763813019 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:06.763849020 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:07.423015118 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:07.423084021 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:07.431123972 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:07.431173086 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:07.431416988 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:07.433289051 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:07.475441933 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:07.699394941 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:07.699449062 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:07.699498892 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:07.700176001 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:07.700200081 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:07.700213909 CEST | 49745 | 443 | 192.168.2.4 | 184.28.90.27 |
| Oct 2, 2024 23:04:07.700221062 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.132621050 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:10.132680893 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.132873058 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:10.133073092 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:10.133091927 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.771420956 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.773364067 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:10.773400068 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.773771048 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.773833990 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:10.774369001 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.774420023 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:10.775413990 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:10.775473118 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.775547981 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:10.775561094 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.818569899 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.092629910 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.092762947 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.092839956 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.092844009 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.092886925 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.092928886 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.098177910 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.098244905 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.098262072 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.104587078 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.104605913 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.104635954 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.104651928 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.104712009 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.110841036 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.110909939 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.117696047 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.117775917 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.117780924 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.117794991 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.117851973 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.180840969 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.180913925 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.180948019 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.181010008 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.181055069 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.181540966 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.181588888 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.187725067 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.187777042 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.188184977 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.188235044 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.193886995 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.193936110 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.200215101 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.200261116 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.200275898 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.206513882 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.206554890 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.206571102 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.216394901 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.216464043 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.216481924 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.216514111 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.216590881 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.230294943 CEST | 49757 | 443 | 192.168.2.4 | 142.250.186.174 |
| Oct 2, 2024 23:04:11.230321884 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.235641956 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.235682011 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.235924959 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.236274004 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.236285925 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.452661991 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.452708006 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.452783108 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.455702066 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.455718040 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.872028112 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.872354984 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.872380018 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.872692108 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.872750044 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.873289108 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.873333931 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.874177933 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.874232054 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.874378920 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:11.874387980 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.927160025 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.090143919 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.090495110 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.090524912 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.091046095 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.091123104 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.092067957 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.092134953 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.092286110 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.092366934 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.092485905 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.092495918 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.144125938 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.172399044 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.172864914 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.173145056 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.173203945 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.173203945 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.173234940 CEST | 443 | 49761 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.173286915 CEST | 49761 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.174415112 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.174458981 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.174534082 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.174810886 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.174829006 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.389219046 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.389520884 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.389580965 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.389954090 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.389970064 CEST | 443 | 49762 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.389978886 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.390022039 CEST | 49762 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.391408920 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.391444921 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.391510963 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.392281055 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.392296076 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.836657047 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.836970091 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.836987972 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.838257074 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.838340998 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.839207888 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.839265108 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.839565039 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.839637041 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.839870930 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.839879990 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.839906931 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.881728888 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:12.881736994 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.059070110 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.059488058 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:13.059513092 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.060036898 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.060110092 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:13.061111927 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.061180115 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:13.061403036 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:13.061484098 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.061745882 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:13.061755896 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.062006950 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:13.073236942 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.074870110 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.074949026 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:13.075794935 CEST | 49764 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:13.075820923 CEST | 443 | 49764 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.107397079 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.287611008 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.287977934 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.288055897 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:13.293596029 CEST | 49766 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:13.293617964 CEST | 443 | 49766 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.442744970 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:13.455559015 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:13.455591917 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.455670118 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:13.458774090 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:13.458786964 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.487396955 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.708985090 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.709121943 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.709217072 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.709320068 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.709372997 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:13.709453106 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.709516048 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:13.709830999 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:13.709891081 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:13.732901096 CEST | 49741 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:04:13.732945919 CEST | 443 | 49741 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:04:14.253295898 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:14.254051924 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:14.256036043 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:14.256047964 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:14.256448030 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:14.303554058 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:14.946283102 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:14.991401911 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.202923059 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.202955961 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.202965975 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.202979088 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.203052998 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.203066111 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:15.203074932 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.203083992 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:15.203109980 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:15.203119993 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:15.203623056 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.203685045 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:15.203687906 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.203720093 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.206068039 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:15.847114086 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:15.847114086 CEST | 49772 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:15.847156048 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:15.847168922 CEST | 443 | 49772 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:18.005381107 CEST | 49723 | 80 | 192.168.2.4 | 199.232.214.172 |
| Oct 2, 2024 23:04:18.011591911 CEST | 80 | 49723 | 199.232.214.172 | 192.168.2.4 |
| Oct 2, 2024 23:04:18.011653900 CEST | 49723 | 80 | 192.168.2.4 | 199.232.214.172 |
| Oct 2, 2024 23:04:19.275791883 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:19.275892019 CEST | 443 | 49781 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:19.275993109 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:19.276377916 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:19.276416063 CEST | 443 | 49781 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:19.939618111 CEST | 443 | 49781 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:19.940187931 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:19.940256119 CEST | 443 | 49781 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:19.940789938 CEST | 443 | 49781 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:19.941124916 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:19.941219091 CEST | 443 | 49781 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:19.941296101 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:19.941488028 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:19.941517115 CEST | 443 | 49781 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:20.272171974 CEST | 443 | 49781 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:20.273190975 CEST | 443 | 49781 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:20.273339987 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:20.275131941 CEST | 49781 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:20.275176048 CEST | 443 | 49781 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:42.369533062 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:42.369626999 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:42.369750977 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:42.369986057 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:42.370027065 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:42.572761059 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:42.572832108 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:42.573160887 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:42.581461906 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:42.581475019 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.227560997 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.228009939 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.228080988 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.228576899 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.228888035 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.228974104 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.229077101 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.229077101 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.229125023 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.337440014 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.337539911 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.337639093 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.337910891 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.337948084 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.348936081 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.349167109 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.349189043 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.349701881 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.349989891 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.350064993 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.350148916 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.350174904 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.350276947 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.622138023 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.622459888 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.622654915 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.623047113 CEST | 49782 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.623075008 CEST | 443 | 49782 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.655659914 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.656918049 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.657007933 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.657099962 CEST | 49783 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.657123089 CEST | 443 | 49783 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.974678040 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.974977016 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.975039959 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.976330996 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.976660013 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.976831913 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.976850986 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:43.976876020 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:43.976876020 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:44.022058010 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:44.022074938 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:44.276010036 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:44.276706934 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:44.276787996 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:44.276946068 CEST | 49784 | 443 | 192.168.2.4 | 142.250.185.174 |
| Oct 2, 2024 23:04:44.276979923 CEST | 443 | 49784 | 142.250.185.174 | 192.168.2.4 |
| Oct 2, 2024 23:04:52.316869974 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:52.316915989 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:52.316994905 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:52.317339897 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:52.317353964 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.110162020 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.110244989 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.115539074 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.115555048 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.115803957 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.130255938 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.175403118 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.442313910 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.442368984 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.442411900 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.442573071 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.442573071 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.442599058 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.442663908 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.443150043 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.443195105 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.443223000 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.443229914 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.443247080 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.443367958 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.443428040 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.448466063 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.448481083 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:04:53.448514938 CEST | 49785 | 443 | 192.168.2.4 | 4.175.87.197 |
| Oct 2, 2024 23:04:53.448519945 CEST | 443 | 49785 | 4.175.87.197 | 192.168.2.4 |
| Oct 2, 2024 23:05:04.594790936 CEST | 49787 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:05:04.594849110 CEST | 443 | 49787 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:05:04.595022917 CEST | 49787 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:05:04.595320940 CEST | 49787 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:05:04.595334053 CEST | 443 | 49787 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:05:05.244635105 CEST | 443 | 49787 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:05:05.244951963 CEST | 49787 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:05:05.245018005 CEST | 443 | 49787 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:05:05.246174097 CEST | 443 | 49787 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:05:05.246454954 CEST | 49787 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:05:05.246642113 CEST | 443 | 49787 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:05:05.287499905 CEST | 49787 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:05:06.943614960 CEST | 49724 | 80 | 192.168.2.4 | 199.232.214.172 |
| Oct 2, 2024 23:05:06.949151039 CEST | 80 | 49724 | 199.232.214.172 | 192.168.2.4 |
| Oct 2, 2024 23:05:06.949445009 CEST | 49724 | 80 | 192.168.2.4 | 199.232.214.172 |
| Oct 2, 2024 23:05:13.456995010 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:13.457048893 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:13.457151890 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:13.457410097 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:13.457427979 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:13.698959112 CEST | 49790 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:13.699027061 CEST | 443 | 49790 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:13.699152946 CEST | 49790 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:13.699604034 CEST | 49790 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:13.699637890 CEST | 443 | 49790 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.115775108 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.116415024 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.116436958 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.117630005 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.117943048 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.118103981 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.118103981 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.118123055 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.118201971 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.162565947 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.339096069 CEST | 443 | 49790 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.344129086 CEST | 49790 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.344152927 CEST | 443 | 49790 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.344674110 CEST | 443 | 49790 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.345143080 CEST | 49790 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.345232964 CEST | 443 | 49790 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.345381975 CEST | 49790 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.345412016 CEST | 49790 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.345424891 CEST | 443 | 49790 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.415868998 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.416826010 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.417006969 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.417045116 CEST | 49789 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.417073011 CEST | 443 | 49789 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.640192032 CEST | 443 | 49790 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.640948057 CEST | 443 | 49790 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:14.641159058 CEST | 49790 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.684915066 CEST | 49790 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:14.684950113 CEST | 443 | 49790 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:15.162516117 CEST | 443 | 49787 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:05:15.162610054 CEST | 443 | 49787 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:05:15.162981987 CEST | 49787 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:05:27.273175955 CEST | 49787 | 443 | 192.168.2.4 | 142.250.184.228 |
| Oct 2, 2024 23:05:27.273219109 CEST | 443 | 49787 | 142.250.184.228 | 192.168.2.4 |
| Oct 2, 2024 23:05:43.534053087 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:43.534143925 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:43.534277916 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:43.534672022 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:43.534704924 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:44.204514980 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:44.205202103 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:44.205226898 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:44.208085060 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:44.208867073 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:44.209033012 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:44.209115028 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:44.209141970 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:44.209146976 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:44.523756981 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:44.529819965 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:44.529908895 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:44.530002117 CEST | 49792 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:44.530024052 CEST | 443 | 49792 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:45.825851917 CEST | 49793 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:45.825921059 CEST | 443 | 49793 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:45.826091051 CEST | 49793 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:45.826492071 CEST | 49793 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:45.826508045 CEST | 443 | 49793 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:46.497572899 CEST | 443 | 49793 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:46.497951984 CEST | 49793 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:46.497983932 CEST | 443 | 49793 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:46.498594999 CEST | 443 | 49793 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:46.498851061 CEST | 49793 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:46.498927116 CEST | 443 | 49793 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:46.499006033 CEST | 49793 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:46.499020100 CEST | 49793 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:46.499037027 CEST | 443 | 49793 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:46.813985109 CEST | 443 | 49793 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:46.814560890 CEST | 443 | 49793 | 172.217.18.14 | 192.168.2.4 |
| Oct 2, 2024 23:05:46.814610958 CEST | 49793 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:46.814688921 CEST | 49793 | 443 | 192.168.2.4 | 172.217.18.14 |
| Oct 2, 2024 23:05:46.814703941 CEST | 443 | 49793 | 172.217.18.14 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 2, 2024 23:04:00.251230001 CEST | 55279 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:04:00.251631975 CEST | 62878 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:04:00.259574890 CEST | 53 | 60634 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.259654045 CEST | 53 | 62878 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.259691000 CEST | 53 | 55279 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:00.302149057 CEST | 53 | 63016 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.218239069 CEST | 51564 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:04:01.218583107 CEST | 63256 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:04:01.226655960 CEST | 53 | 63256 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.227796078 CEST | 53 | 51564 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:01.468046904 CEST | 53 | 49543 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:04.540512085 CEST | 65035 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:04:04.540854931 CEST | 56217 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:04:04.547617912 CEST | 53 | 65035 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:04.547878027 CEST | 53 | 56217 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:07.649677992 CEST | 53 | 62012 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.106193066 CEST | 62806 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:04:10.106376886 CEST | 50045 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:04:10.113301039 CEST | 53 | 62806 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:10.113972902 CEST | 53 | 50045 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.150007010 CEST | 58977 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:04:11.150572062 CEST | 61683 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:04:11.157416105 CEST | 53 | 58977 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:11.158200026 CEST | 53 | 61683 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:12.428210974 CEST | 53 | 52633 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:18.525789976 CEST | 53 | 57677 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:18.635691881 CEST | 138 | 138 | 192.168.2.4 | 192.168.2.255 |
| Oct 2, 2024 23:04:37.311717987 CEST | 53 | 54340 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:59.770596981 CEST | 53 | 55580 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:04:59.787590981 CEST | 53 | 63295 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:05:12.277290106 CEST | 53 | 65196 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:05:13.449323893 CEST | 57686 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:05:13.449462891 CEST | 54207 | 53 | 192.168.2.4 | 1.1.1.1 |
| Oct 2, 2024 23:05:13.456233025 CEST | 53 | 57686 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:05:13.456402063 CEST | 53 | 54207 | 1.1.1.1 | 192.168.2.4 |
| Oct 2, 2024 23:05:27.281743050 CEST | 53 | 59234 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 23:04:00.251230001 CEST | 192.168.2.4 | 1.1.1.1 | 0x426 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 23:04:00.251631975 CEST | 192.168.2.4 | 1.1.1.1 | 0x9c2a | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 23:04:01.218239069 CEST | 192.168.2.4 | 1.1.1.1 | 0x7044 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 23:04:01.218583107 CEST | 192.168.2.4 | 1.1.1.1 | 0x9b67 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 23:04:04.540512085 CEST | 192.168.2.4 | 1.1.1.1 | 0xc7e7 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 23:04:04.540854931 CEST | 192.168.2.4 | 1.1.1.1 | 0x3f6d | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 23:04:10.106193066 CEST | 192.168.2.4 | 1.1.1.1 | 0x633d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 23:04:10.106376886 CEST | 192.168.2.4 | 1.1.1.1 | 0xf02 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 23:04:11.150007010 CEST | 192.168.2.4 | 1.1.1.1 | 0x16b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 23:04:11.150572062 CEST | 192.168.2.4 | 1.1.1.1 | 0xf75a | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 2, 2024 23:05:13.449323893 CEST | 192.168.2.4 | 1.1.1.1 | 0x5bb | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 2, 2024 23:05:13.449462891 CEST | 192.168.2.4 | 1.1.1.1 | 0x926b | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 2, 2024 23:04:00.259654045 CEST | 1.1.1.1 | 192.168.2.4 | 0x9c2a | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 23:04:00.259691000 CEST | 1.1.1.1 | 192.168.2.4 | 0x426 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.226655960 CEST | 1.1.1.1 | 192.168.2.4 | 0x9b67 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.226655960 CEST | 1.1.1.1 | 192.168.2.4 | 0x9b67 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 172.217.18.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 216.58.212.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 142.250.185.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 142.250.74.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 172.217.23.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:01.227796078 CEST | 1.1.1.1 | 192.168.2.4 | 0x7044 | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:04.547617912 CEST | 1.1.1.1 | 192.168.2.4 | 0xc7e7 | No error (0) | 142.250.184.228 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:04.547878027 CEST | 1.1.1.1 | 192.168.2.4 | 0x3f6d | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 2, 2024 23:04:10.113301039 CEST | 1.1.1.1 | 192.168.2.4 | 0x633d | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:10.113301039 CEST | 1.1.1.1 | 192.168.2.4 | 0x633d | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:10.113972902 CEST | 1.1.1.1 | 192.168.2.4 | 0xf02 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 2, 2024 23:04:11.157416105 CEST | 1.1.1.1 | 192.168.2.4 | 0x16b | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 2, 2024 23:05:13.456233025 CEST | 1.1.1.1 | 192.168.2.4 | 0x5bb | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49730 | 142.250.185.142 | 443 | 2668 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 21:04:00 UTC | 851 | OUT | |
| 2024-10-02 21:04:01 UTC | 1919 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49736 | 142.250.186.110 | 443 | 2668 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-02 21:04:01 UTC | 894 | OUT | |
| 2024-10-02 21:04:02 UTC | 2530 | IN |