Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1524646 |
| MD5: | 45c675b6790e21eacdb1f3478fcadfda |
| SHA1: | 1e5955dd76b7b92c39114d6a45a99cf245ea1450 |
| SHA256: | a82303f0e40f9287c668597cc0250f6b1cfdab506282608510bdd49ec49f400c |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Uses taskkill to terminate processes
Classification
- System is w10x64
file.exe (PID: 5008 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 45C675B6790E21EACDB1F3478FCADFDA) 
taskkill.exe (PID: 5024 cmdline: taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) 
conhost.exe (PID: 6588 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 6420 cmdline:
taskkill / F /IM msed ge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 4396 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 5728 cmdline:
taskkill / F /IM fire fox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 5396 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 5768 cmdline:
taskkill / F /IM oper a.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 1788 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7092 cmdline:
taskkill / F /IM brav e.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 7152 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
chrome.exe (PID: 3944 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://youtu be.com/acc ount?=http s://accoun ts.google. com/v3/sig nin/challe nge/pwd" - -start-ful lscreen -- no-first-r un --disab le-session -crashed-b ubble --di sable-info bars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6332 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2088 --fi eld-trial- handle=202 4,i,660547 8859309440 277,123384 7571118689 499,262144 /prefetch :8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7956 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=55 56 --field -trial-han dle=2024,i ,660547885 9309440277 ,123384757 1118689499 ,262144 /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7964 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5596 --f ield-trial -handle=20 24,i,66054 7885930944 0277,12338 4757111868 9499,26214 4 /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00EBDBBE | |
| Source: | Code function: | 0_2_00E8C2A2 | |
| Source: | Code function: | 0_2_00EC68EE | |
| Source: | Code function: | 0_2_00EC698F | |
| Source: | Code function: | 0_2_00EBD076 | |
| Source: | Code function: | 0_2_00EBD3A9 | |
| Source: | Code function: | 0_2_00EC9642 | |
| Source: | Code function: | 0_2_00EC979D | |
| Source: | Code function: | 0_2_00EC9B2B | |
| Source: | Code function: | 0_2_00EC5C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_00ECCE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00ECEAFF | |
| Source: | Code function: | 0_2_00ECED6A | |
| Source: | Code function: | 0_2_00ECEAFF | |
| Source: | Code function: | 0_2_00EBAA57 | |
| Source: | Code function: | 0_2_00EE9576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_45dedde3-2 | |
| Source: | String found in binary or memory: | memstr_a7d7b370-a | |
| Source: | String found in binary or memory: | memstr_7dd34b73-c | |
| Source: | String found in binary or memory: | memstr_66e4efd4-2 | |
| Source: | Code function: | 0_2_00EBD5EB | |
| Source: | Code function: | 0_2_00EB1201 | |
| Source: | Code function: | 0_2_00EBE8F6 | |
| Source: | Code function: | 0_2_00E58060 | |
| Source: | Code function: | 0_2_00EC2046 | |
| Source: | Code function: | 0_2_00EB8298 | |
| Source: | Code function: | 0_2_00E8E4FF | |
| Source: | Code function: | 0_2_00E8676B | |
| Source: | Code function: | 0_2_00EE4873 | |
| Source: | Code function: | 0_2_00E5CAF0 | |
| Source: | Code function: | 0_2_00E7CAA0 | |
| Source: | Code function: | 0_2_00E6CC39 | |
| Source: | Code function: | 0_2_00E86DD9 | |
| Source: | Code function: | 0_2_00E6D073 | |
| Source: | Code function: | 0_2_00E591C0 | |
| Source: | Code function: | 0_2_00E6B119 | |
| Source: | Code function: | 0_2_00E71394 | |
| Source: | Code function: | 0_2_00E71706 | |
| Source: | Code function: | 0_2_00E7781B | |
| Source: | Code function: | 0_2_00E719B0 | |
| Source: | Code function: | 0_2_00E6997D | |
| Source: | Code function: | 0_2_00E57920 | |
| Source: | Code function: | 0_2_00E77A4A | |
| Source: | Code function: | 0_2_00E77CA7 | |
| Source: | Code function: | 0_2_00E71C77 | |
| Source: | Code function: | 0_2_00E89EEE | |
| Source: | Code function: | 0_2_00EDBE44 | |
| Source: | Code function: | 0_2_00E71F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00EC37B5 | |
| Source: | Code function: | 0_2_00EB10BF | |
| Source: | Code function: | 0_2_00EB16C3 | |
| Source: | Code function: | 0_2_00EC51CD | |
| Source: | Code function: | 0_2_00EDA67C | |
| Source: | Code function: | 0_2_00EC648E | |
| Source: | Code function: | 0_2_00E542A2 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00E542DE | |
| Source: | Code function: | 0_2_00E70A89 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00E6F98E | |
| Source: | Code function: | 0_2_00EE1C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-95725 | ||
| Source: | API coverage: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_00EBDBBE | |
| Source: | Code function: | 0_2_00E8C2A2 | |
| Source: | Code function: | 0_2_00EC68EE | |
| Source: | Code function: | 0_2_00EC698F | |
| Source: | Code function: | 0_2_00EBD076 | |
| Source: | Code function: | 0_2_00EBD3A9 | |
| Source: | Code function: | 0_2_00EC9642 | |
| Source: | Code function: | 0_2_00EC979D | |
| Source: | Code function: | 0_2_00EC9B2B | |
| Source: | Code function: | 0_2_00EC5C97 | |
| Source: | Code function: | 0_2_00E542DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00ECEAA2 | |
| Source: | Code function: | 0_2_00E82622 | |
| Source: | Code function: | 0_2_00E542DE | |
| Source: | Code function: | 0_2_00E74CE8 | |
| Source: | Code function: | 0_2_00EB0B62 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_00E82622 | |
| Source: | Code function: | 0_2_00E7083F | |
| Source: | Code function: | 0_2_00E709D5 | |
| Source: | Code function: | 0_2_00E70C21 | |
| Source: | Code function: | 0_2_00EB1201 | |
| Source: | Code function: | 0_2_00E92BA5 | |
| Source: | Code function: | 0_2_00EBB226 | |
| Source: | Code function: | 0_2_00ED22DA | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00EB0B62 | |
| Source: | Code function: | 0_2_00EB1663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00E70698 | |
| Source: | Code function: | 0_2_00EC8195 | |
| Source: | Code function: | 0_2_00EAD27A | |
| Source: | Code function: | 0_2_00E8B952 | |
| Source: | Code function: | 0_2_00E542DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 0_2_00ED1204 | |
| Source: | Code function: | 0_2_00ED1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 2 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 16 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 1 Masquerading | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Virtualization/Sandbox Evasion | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 21 Access Token Manipulation | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 2 Process Injection | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.185.238 | true | false | unknown | |
| www3.l.google.com | 142.250.186.78 | true | false | unknown | |
| play.google.com | 142.250.186.174 | true | false | unknown | |
| www.google.com | 216.58.206.68 | true | false | unknown | |
| youtube.com | 216.58.212.142 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.186.78 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 216.58.212.142 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.174 | play.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.238 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 216.58.206.68 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.186.142 | unknown | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.5 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1524646 |
| Start date and time: | 2024-10-03 03:00:07 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 0s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 20 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal64.troj.evad.winEXE@46/36@12/8 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 172.217.18.3, 172.217.16.206, 142.251.173.84, 34.104.35.123, 172.217.16.138, 216.58.206.42, 142.250.185.138, 142.250.184.202, 172.217.18.10, 142.250.186.170, 142.250.186.42, 142.250.185.234, 142.250.185.202, 142.250.181.234, 142.250.185.74, 216.58.212.138, 142.250.184.234, 142.250.185.170, 142.250.74.202, 142.250.185.106, 142.250.185.195, 142.250.186.67, 142.250.186.106, 216.58.206.74, 142.250.186.138, 172.217.23.106, 172.217.16.202, 142.250.186.74, 199.232.210.172, 192.229.221.95, 142.250.185.227, 173.194.76.84, 142.250.185.78
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Credential Flusher | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Phisher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 1138de370e523e824bbca92d049a3777 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Phisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HtmlDropper | Browse |
|
⊘No context
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.9806766636089166 |
| Encrypted: | false |
| SSDEEP: | 48:8XMd1d4T8ksH1idAKZdA19ehwiZUklqehYgy+3:8sQvifgy |
| MD5: | 1BBB5A05CDF8AAF2785D12E84223C76A |
| SHA1: | E8DA885CE79EB980FE0C00E951F59CDC7C172710 |
| SHA-256: | 6D76DF38A66383AE64F2CEBF38D2C50DCD5517B9FFF26A14187ACD780528E762 |
| SHA-512: | 9317C8953AED1412E9A44BC7357A00782D082AC955E811B0D3C2A2353CA4F0DEE7B037BAB3A0BE3173629979795AA52485A0C732575767CF4D2FBD10B268120A |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9957456173160515 |
| Encrypted: | false |
| SSDEEP: | 48:8Ud4T8ksH1idAKZdA1weh/iZUkAQkqehPgy+2:8bv49Qagy |
| MD5: | 9CE6301FEDE669DFA2C82AD155F81ADA |
| SHA1: | A86CB9ECE219E13559A9EA01EBD530E12DA667B9 |
| SHA-256: | 2E29ED3CB5F448BBFF88D0D089119A0405FDF0D53F583F26E7763FB8A3BDAD4A |
| SHA-512: | 3095E947C1AFEBA8FCD274E881BBE7E150D9FF0F717376FF2B48CEF53D409ED10CCB68F7810A6F6A748AD84A0C043178CDDBEDDA858D220AE050E8F92E8B5135 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2693 |
| Entropy (8bit): | 4.00599031199346 |
| Encrypted: | false |
| SSDEEP: | 48:8xtd4T8ksH1idAKZdA14tseh7sFiZUkmgqeh7sxgy+BX:8xYvwnDgy |
| MD5: | 73539276AB21B6176A0DD05067E72A93 |
| SHA1: | A50898D8391923DD901F3344CB0F209C17322DC0 |
| SHA-256: | 74FF855595496301C75A57251FD26739409579F2BB594CF0F2ADA1BA4E1B2092 |
| SHA-512: | C393FA2907724875762532059C6A680885CC1B9B317E47E8DDB23A6573EA44B568B90F39104B367CC2658DAEAC7FD0E51747C4C59E80BE98B8F5D12E59A100BF |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9929470643814926 |
| Encrypted: | false |
| SSDEEP: | 48:8td4T8ksH1idAKZdA1vehDiZUkwqehbgy+R:8YvjJgy |
| MD5: | DE7D5B2EE3C91B681429FFA794A840C8 |
| SHA1: | 0B2A48016AAF38E6AA1BC9B64F0DE8EC441902B7 |
| SHA-256: | FC7BAF00859DADD41B07A8BB6BED00FDBBF7E8C6256DF7F12776A0B796104A9A |
| SHA-512: | CBF0D9F485DF621692003BB2204FE2B48EDB97707A9FFD865C9985EC71AF49AF72C2F77503DE960ECC0A5D9B0102A2874F3602F61896164FC317F4CB45EF008A |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9840489230988716 |
| Encrypted: | false |
| SSDEEP: | 48:88d4T8ksH1idAKZdA1hehBiZUk1W1qeh1gy+C:8Tvz9Vgy |
| MD5: | 492AC58206F1CCDFBA33EDC90A3F1EEE |
| SHA1: | F0EEEAE9D241999A23230DD4B76A0FE60DD9A657 |
| SHA-256: | 1B7016F2061C2A2B131196FE94CC7B2A4F593F8C26C4520EE52CB3CED6048E81 |
| SHA-512: | 1401A5E69E1D8E80A4A978C016E7ECBC8031639EC437F21E62720F5F04479C172A3F8FF70B8402F5B8C5E8CE8732C119A2371C65AE8EE621886099B869D22A41 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2683 |
| Entropy (8bit): | 3.994293702013421 |
| Encrypted: | false |
| SSDEEP: | 48:8sd4T8ksH1idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbDgy+yT+:8jvjT/TbxWOvTbDgy7T |
| MD5: | 5D0B887D594F09B246C31E31A5A34FA3 |
| SHA1: | 33B54C56633185C96AE3D5AB7A27F66AE142B020 |
| SHA-256: | 86FFEB9C28F1DADA2B2DA377E3D84FC77A0B82097F53F5874BE49FE0DB43C9FA |
| SHA-512: | F9D7ACF97B8E14A2484B09A9ACB167E0B80BC3FEC6E4F8A6D4FD1DBF62AEA6470D3DC348311CAC42AF7459D876B19F9567A9B8861EFC72EE03477CE175E15D68 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3467 |
| Entropy (8bit): | 5.514745431912774 |
| Encrypted: | false |
| SSDEEP: | 96:ozbld2fNUmeqJNizhNtt1W8t//loyIpXmdVE2w:onSKE8PWe/Cy4X3j |
| MD5: | 8DEF399E8355ABC23E64505281005099 |
| SHA1: | 24FF74C3AEFD7696D84FF148465DF4B1B60B1696 |
| SHA-256: | F128D7218E1286B05DF11310AD3C8F4CF781402698E45448850D2A3A22F5F185 |
| SHA-512: | 33721DD47658D8E12ADF6BD9E9316EB89F5B6297927F7FD60F954E04B829DCBF0E1AE6DDD9A3401F45E0011AE4B1397B960C218238A3D0F633A2173D8E604082 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.257113147606035 |
| Encrypted: | false |
| SSDEEP: | 48:o72ZrNZ4yNAbU+15fMxIdf5WENoBCbw7DbG2bEJrw:oyNNAY+1i4HoBNG2Ilw |
| MD5: | F06E2DC5CC446B39F878B5F8E4D78418 |
| SHA1: | 9F1F34FDD8F8DAB942A9B95D9F720587B6F6AD48 |
| SHA-256: | 118E4D2FE7CEF205F9AFC87636554C6D8220882B158333EE3D1990282D158B8F |
| SHA-512: | 893C4F883CD1C88C6AAF5A6E7F232D62823A53E1FFDE5C1C52BB066D75781DD041F4D281CDBF18070D921CE862652D8863E2B9D5E0190CFA4128890D62C44168 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5050 |
| Entropy (8bit): | 5.289052544075544 |
| Encrypted: | false |
| SSDEEP: | 96:o4We0hP7OBFXYvB1sig3Fd8HkaXzLmUrv8Vh1WJlLQXT2v2gqw:655758Fd8HkaPZ0GmAD |
| MD5: | 26E26FD11772DFF5C7004BEA334289CC |
| SHA1: | 638DAAF541BDE31E95AEE4F8ADA677434D7051DB |
| SHA-256: | ADFE3E4960982F5EF4C043052A9990D8683C5FC2B590E817B6B1A5774DDE2CE3 |
| SHA-512: | C31929EB6D1C60D6A84A2574FF60490394A6D6F9B354972F3328952F570D80B3F2AEC916B0E1B66DDB1AC056EB75BFAC477E7AF631D0AD1810EDBAF025465D66 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32500 |
| Entropy (8bit): | 5.378903546681047 |
| Encrypted: | false |
| SSDEEP: | 768:zYlbuROstb0e39nKGrkysU0smpu4OLOdzIf1p/5GeSsngurz6aKEEEGo/:zYl61Cysbu4OLOdzIfrIen72ZFo/ |
| MD5: | BF4BF9728A7C302FBA5B14F3D0F1878B |
| SHA1: | 2607CA7A93710D629400077FF3602CB207E6F53D |
| SHA-256: | 8981E7B228DF7D6A8797C0CD1E9B0F1F88337D5F0E1C27A04E7A57D2C4309798 |
| SHA-512: | AC9E170FC3AFDC0CF6BB8E926B93EF129A5FAD1BBA51B60BABCF3555E9B652E98F86A00FB099879DED35DD3FFE72ECFA597E20E6CA8CF402BEDEC40F78412EDA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.298162049824456 |
| Encrypted: | false |
| SSDEEP: | 48:o7vGoolL3ALFKphnpiu7xOKAcfO/3d/rYh4vZorw:o/QLUFUL4KA+2y0Mw |
| MD5: | CE055F881BDAB4EF6C1C8AA4B3890348 |
| SHA1: | 2671741A70E9F5B608F690AAEEA4972003747654 |
| SHA-256: | 9B91C23691D6032CDFE28863E369624B2EDB033E1487A1D1BB0977E3590E5462 |
| SHA-512: | 8A22250628985C2E570E6FBADFC0D5CB6753F0735130F9E74962A409476C2859C5C81F8A0F5C427A9F13ED399C8E251FA43FF67AD5F16860640D45E7A538E857 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.355381206612617 |
| Encrypted: | false |
| SSDEEP: | 48:o7FEEM3MtH15jNQ8jsK3rnw0dkckTrKEp/OqLE9xz0W5Bzv3M6hIHYA+JITbwrF8:oq675jOArwoAmI/DLaxNPL5m+m6w |
| MD5: | E2A7251AD83A0D0634FEA2703D10ED07 |
| SHA1: | 90D72011F31FC40D3DA3748F2817F90A29EB5C01 |
| SHA-256: | 1079B49C4AAF5C10E4F2E6A086623F40D200A71FF2A1F64E88AA6C91E4BE7A6F |
| SHA-512: | CD6D75580EA8BD97CF7C7C0E0BD9D9A54FB6EA7DF1DDB5A95E94D38B260F9EE1425C640839ECD229B8D01E145CF2786CA374D31EC537EB8FE17FF415D5B985F5 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 698314 |
| Entropy (8bit): | 5.595120835898624 |
| Encrypted: | false |
| SSDEEP: | 6144:TJvaKtQfcxene0F2HhPM8RGYcBlKmd5r6XISxi7SlncOpYMSrBg5X3O4mAEFD7:TJyKtkIct842ISxXJ09 |
| MD5: | F82438F9EAD5F57493C673008EED9E09 |
| SHA1: | E4681E68FD66D8C76C6ACBC21E2C45F36FD645BC |
| SHA-256: | B4B092F54EAAA82BFAA159B8D61FB867B51C3067CBD60F4904A205A11F503250 |
| SHA-512: | 89027A7B1B3A080D40411F2E6E3B62BF57AC60879223566E71BD41D900C17051F0A058EFE04F8F1FED5E05DC54617D7A86F83D21BDED0F79347795C8B980B4B2 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22833 |
| Entropy (8bit): | 5.425034548615223 |
| Encrypted: | false |
| SSDEEP: | 384:7lFo6ZEdpgtmyiPixV9OX9gMBpHkHnfst9lZulagGcwYHiRFjJzN7:77o6ZviPixV8xpEHn89l4IgGcwYCRtb7 |
| MD5: | 749B18538FE32BFE0815D75F899F5B21 |
| SHA1: | AF95A019211AF69F752A43CAA54A83C2AFD41D28 |
| SHA-256: | 116B2687C1D5E00DB56A79894AB0C12D4E2E000B9379B7E7AD751B84DF611F3F |
| SHA-512: | E4B6F4556AA0FD9979BB52681508F5E26FFB256473803F74F7F5C8D93FA3636D7D0A5835618FBC6123022805CE0D9616A7451A0F302C665E28A6090B5D588505 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4066 |
| Entropy (8bit): | 5.363016925556486 |
| Encrypted: | false |
| SSDEEP: | 96:G2CiFZX5BReR68ujioIRVrqtyzBeTV6SfyAKLif9c7w:bCMZXVeR6jiosVrqtyzBaImyAKw9x |
| MD5: | FC5E597D923838E10390DADD12651A81 |
| SHA1: | C9959F8D539DB5DF07B8246EC12539B6A9CC101F |
| SHA-256: | A7EBD5280C50AE93C061EAE1E9727329E015E97531F8F2D82D0E3EA76ADB37B4 |
| SHA-512: | 784CA572808F184A849388723FBB3701E6981D885BBA8A330A933F90BF0B36A2E4A491D4463A27911B1D9F7A7134F23E15F187FC7CB4554EAE9BC252513EED7C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.404371326611379 |
| Encrypted: | false |
| SSDEEP: | 192:EEFZpeip4HzZlY0If0Ma23jcUcrhCx6VD1TYPi8:Es/p4jgjUhtD1TY68 |
| MD5: | 21E893B65627B397E22619A9F5BB9662 |
| SHA1: | F561B0F66211C1E7B22F94B4935C312AB7087E85 |
| SHA-256: | FFA9B8BC8EF2CDFF5EB4BA1A0BA1710A253A5B42535E2A369D5026967DCF4673 |
| SHA-512: | 3DE3CD6A4E9B06AB3EB324E90A40B5F2AEEA8D7D6A2651C310E993CF79EEB5AC6E2E33C587F46B2DD20CC862354FD1A61AEBB9B990E6805F6629404BA285F8FA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.291808298251231 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DuZvuhqCsNRxoYTY9/qoVk7hz1l2p6vDMW94uEQOeGbCx4VGbgCSFBV87OU:o7DuZWhv6oy12kvwKEeGbC6GbHSh/Hrw |
| MD5: | 4CA7ADFE744A690411EA4D3EA8DB9E4B |
| SHA1: | 2CF1777A199E25378D330DA68BED1871B5C5BC32 |
| SHA-256: | 128129BA736B3094323499B0498A5B3A909C1529717461C34B70080A5B1603BD |
| SHA-512: | 8BD3477AF41D1F0FE74AFFCB177BEC0F5F4FDCBBA6BD29D9C2567E6FFDEF5DEB7FF74BF348F33209C39D7BB4958E748DF6731D3DC8F6947352276BC92EAF9E79 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG_aYNE-Dz95N0OV63231Yfi4Jf5g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 743936 |
| Entropy (8bit): | 5.791086230020914 |
| Encrypted: | false |
| SSDEEP: | 6144:YVXWBQkPdzg5pTX1ROv/duPzd8C3s891/N:Nfd8j91/N |
| MD5: | 1A3606C746E7B1C949D9078E8E8C1244 |
| SHA1: | 56A3EB1E93E61ACD7AAD39DC3526CB60E23651B1 |
| SHA-256: | 5F49AE5162183E2EF6F082B29EC99F18DB0212B8ADDB03699B1BFB0AC7869742 |
| SHA-512: | F2D15243311C472331C5F3F083BB6C18D38EC0247A3F3CBAFD96DBA40E4EAE489CDA04176672E39FE3760EF7347596B2A5EAB0FB0125E881EF514475C99863B9 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/am=xIFgKBi2EQjEE54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlE6O04h0gj7Nu50q-nmaRKM6WWcJw/m=_b,_tp" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.5832946750344785 |
| TrID: |
|
| File name: | file.exe |
| File size: | 919'040 bytes |
| MD5: | 45c675b6790e21eacdb1f3478fcadfda |
| SHA1: | 1e5955dd76b7b92c39114d6a45a99cf245ea1450 |
| SHA256: | a82303f0e40f9287c668597cc0250f6b1cfdab506282608510bdd49ec49f400c |
| SHA512: | 125eac9aed6678e0f61b78e26b9e73126005602a3f358de5c448e68659e5d739e26a00e78463e7ee6980131deccab5423f062525f5ccbcfef063ee5391c94d68 |
| SSDEEP: | 12288:TqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgalTm:TqDEvCTbMWu7rQYlBQcBiT6rprG8aRm |
| TLSH: | 1D159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FDE993 [Thu Oct 3 00:47:15 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007FAA3C7EA163h |
| jmp 00007FAA3C7E9A6Fh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FAA3C7E9C4Dh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FAA3C7E9C1Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007FAA3C7EC80Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007FAA3C7EC858h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007FAA3C7EC841h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9a10 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9a10 | 0x9c00 | 0d2e6c97e729a90df64c1792fd6fc0f1 | False | 0.3053385416666667 | data | 5.325468746671334 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xcd8 | data | 1.003345498783455 | ||
| RT_GROUP_ICON | 0xdd490 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd508 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd51c | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd530 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd544 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd620 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 3, 2024 03:00:58.144932032 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:00:58.145004988 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:00:58.254293919 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:03.424638987 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:03.424669981 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:03.425054073 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:03.425448895 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:03.425463915 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.087960005 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.088279009 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:04.088293076 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.089092970 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.089154959 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:04.090114117 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.090172052 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:04.091248035 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:04.091317892 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.091408968 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:04.135432005 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.137974024 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:04.137989044 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.184855938 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:04.371448040 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.371675014 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.371741056 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:04.377582073 CEST | 49704 | 443 | 192.168.2.5 | 216.58.212.142 |
| Oct 3, 2024 03:01:04.377588034 CEST | 443 | 49704 | 216.58.212.142 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.389467001 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:04.389539957 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.389626026 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:04.389890909 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:04.389918089 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.104460955 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.105077982 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:05.105093956 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.105447054 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.105494976 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:05.106040955 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.106079102 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:05.107250929 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:05.107300997 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.107548952 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:05.107553959 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.153588057 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:05.400432110 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.400485039 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.400629044 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:05.400644064 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.400665045 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:05.400706053 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:05.402892113 CEST | 49710 | 443 | 192.168.2.5 | 142.250.185.238 |
| Oct 3, 2024 03:01:05.402909040 CEST | 443 | 49710 | 142.250.185.238 | 192.168.2.5 |
| Oct 3, 2024 03:01:07.752197027 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:07.752227068 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:07.807255983 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:07.807373047 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:07.807490110 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:07.807681084 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:07.807719946 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:07.843168974 CEST | 49716 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:07.843215942 CEST | 443 | 49716 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:07.843291998 CEST | 49716 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:07.845010042 CEST | 49716 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:07.845038891 CEST | 443 | 49716 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:07.856539965 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:08.443305016 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.443487883 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:08.443516970 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.444941998 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.444989920 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:08.446054935 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:08.446131945 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.487797022 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:08.487818003 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.505445004 CEST | 443 | 49716 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.505517006 CEST | 49716 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:08.509578943 CEST | 49716 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:08.509593964 CEST | 443 | 49716 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.509932995 CEST | 443 | 49716 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.543565989 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:08.559178114 CEST | 49716 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:08.561218977 CEST | 49716 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:08.603440046 CEST | 443 | 49716 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.776370049 CEST | 443 | 49716 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.776438951 CEST | 443 | 49716 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.776520014 CEST | 49716 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:08.776907921 CEST | 49716 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:08.776932001 CEST | 443 | 49716 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.776943922 CEST | 49716 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:08.776952982 CEST | 443 | 49716 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.818512917 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:08.818562031 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:08.818651915 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:08.819232941 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:08.819250107 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:09.463125944 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:09.463192940 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:09.467989922 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:09.468012094 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:09.468275070 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:09.470402956 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:09.515405893 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:09.736243010 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:09.736427069 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:09.736475945 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:09.792023897 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:09.792090893 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:09.792129993 CEST | 49721 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 03:01:09.792146921 CEST | 443 | 49721 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 03:01:10.014641047 CEST | 443 | 49703 | 23.1.237.91 | 192.168.2.5 |
| Oct 3, 2024 03:01:10.014770031 CEST | 49703 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:12.363245964 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:12.363296986 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:12.363375902 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:12.363815069 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:12.363837004 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:12.991539955 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:12.991909981 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:12.991950989 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:12.992362976 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:12.992444038 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:12.993042946 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:12.993098974 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:12.994199991 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:12.994266033 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:12.994443893 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:12.994461060 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.036056995 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.310389996 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.310441017 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.310470104 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.310508966 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.310553074 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.310586929 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.316292048 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.316375017 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.316390038 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.322571039 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.322617054 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.322653055 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.322665930 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.322726011 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.328968048 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.329052925 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.335262060 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.335304022 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.335340023 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.335352898 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.335702896 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.396760941 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.396811008 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.397017956 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.397083998 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.397156000 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.399702072 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.399801016 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.406039000 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.406080961 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.406131029 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.406145096 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.407669067 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.414515018 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.414566994 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.418462038 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.418524981 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.418538094 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.419879913 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:13.419917107 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.419992924 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:13.420856953 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:13.420872927 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.424860001 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.425028086 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.425039053 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.431138992 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.431267023 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.431273937 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.431293011 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.431353092 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.431916952 CEST | 49732 | 443 | 192.168.2.5 | 142.250.186.78 |
| Oct 3, 2024 03:01:13.431940079 CEST | 443 | 49732 | 142.250.186.78 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.522039890 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:13.522093058 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.522231102 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:13.522573948 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:13.522595882 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.059717894 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.109272003 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.155580044 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.205493927 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.208868980 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.208877087 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.209209919 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.209233999 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.210226059 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.210308075 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.211301088 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.211397886 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.212816000 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.212891102 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.213848114 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.213907957 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.213933945 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.214140892 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.214211941 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.214354038 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.214507103 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.214518070 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.214843035 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.259427071 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.264219046 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.264219999 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.264235973 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.264242887 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.310471058 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.310600042 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.429322958 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.430429935 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.430497885 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.430530071 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.430530071 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.430548906 CEST | 443 | 49736 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.430624008 CEST | 49736 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.431881905 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.431906939 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.431966066 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.432462931 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.432482958 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.456048012 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.456105947 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.456160069 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.456800938 CEST | 49737 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.456809998 CEST | 443 | 49737 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.457685947 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.457735062 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:14.457784891 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.458482981 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:14.458518028 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.099869967 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.100074053 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.100090981 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.100451946 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.100513935 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.101157904 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.101216078 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.101331949 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.101394892 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.101432085 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.101452112 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.101459980 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.154108047 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.157505035 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.157906055 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.157939911 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.158313990 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.158389091 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.159008026 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.159066916 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.159204006 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.159269094 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.159424067 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.159424067 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.159446001 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.201009989 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.201029062 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.320314884 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.321327925 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.321391106 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.322002888 CEST | 49741 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.322017908 CEST | 443 | 49741 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.376503944 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.377549887 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.377624989 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.378231049 CEST | 49739 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:15.378272057 CEST | 443 | 49739 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.705538988 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:15.751394033 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.971529961 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.971576929 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.971604109 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.971643925 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.971757889 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:15.971760035 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:15.971760035 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:15.971801043 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:15.972621918 CEST | 49715 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:01:15.972650051 CEST | 443 | 49715 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:01:16.788772106 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:16.788810015 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:16.788880110 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:16.790450096 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:16.790467978 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:17.418103933 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:17.418165922 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:17.420944929 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:17.420955896 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:17.421241999 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:17.466438055 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:17.998075962 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:18.039402008 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.201453924 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.201478004 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.201483965 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.201524019 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.201556921 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:18.201570988 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.201580048 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.201591969 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:18.201617956 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:18.202058077 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.202111006 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:18.202116966 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.202200890 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.205256939 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:18.697448969 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:18.697479963 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:18.697493076 CEST | 49745 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:18.697499037 CEST | 443 | 49745 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:20.240823030 CEST | 49703 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:20.240884066 CEST | 49703 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:20.241187096 CEST | 49754 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:20.241219997 CEST | 443 | 49754 | 23.1.237.91 | 192.168.2.5 |
| Oct 3, 2024 03:01:20.241292000 CEST | 49754 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:20.244203091 CEST | 49754 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:20.244213104 CEST | 443 | 49754 | 23.1.237.91 | 192.168.2.5 |
| Oct 3, 2024 03:01:20.245948076 CEST | 443 | 49703 | 23.1.237.91 | 192.168.2.5 |
| Oct 3, 2024 03:01:20.245975018 CEST | 443 | 49703 | 23.1.237.91 | 192.168.2.5 |
| Oct 3, 2024 03:01:21.486547947 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:21.486588001 CEST | 443 | 49755 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:21.491408110 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:21.494045019 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:21.494057894 CEST | 443 | 49755 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:21.796566963 CEST | 443 | 49754 | 23.1.237.91 | 192.168.2.5 |
| Oct 3, 2024 03:01:21.796648026 CEST | 49754 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:22.126755953 CEST | 443 | 49755 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:22.127099037 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:22.127105951 CEST | 443 | 49755 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:22.127459049 CEST | 443 | 49755 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:22.127744913 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:22.127793074 CEST | 443 | 49755 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:22.127916098 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:22.127916098 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:22.127937078 CEST | 443 | 49755 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:22.456254005 CEST | 443 | 49755 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:22.457088947 CEST | 443 | 49755 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:22.457165003 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:22.458209038 CEST | 49755 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:22.458224058 CEST | 443 | 49755 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:41.477015972 CEST | 443 | 49754 | 23.1.237.91 | 192.168.2.5 |
| Oct 3, 2024 03:01:41.477097988 CEST | 49754 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 03:01:43.797081947 CEST | 49756 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:43.797200918 CEST | 443 | 49756 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:43.797291994 CEST | 49756 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:43.797517061 CEST | 49756 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:43.797549009 CEST | 443 | 49756 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:44.431016922 CEST | 443 | 49756 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:44.431360006 CEST | 49756 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:44.431390047 CEST | 443 | 49756 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:44.431723118 CEST | 443 | 49756 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:44.431982994 CEST | 49756 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:44.432034969 CEST | 443 | 49756 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:44.432116032 CEST | 49756 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:44.432126999 CEST | 49756 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:44.432137012 CEST | 443 | 49756 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:44.499092102 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:44.499139071 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:44.499206066 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:44.499568939 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:44.499583960 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:44.732886076 CEST | 443 | 49756 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:44.733494997 CEST | 443 | 49756 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:44.733576059 CEST | 49756 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:44.733678102 CEST | 49756 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:44.733696938 CEST | 443 | 49756 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:45.130656958 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:45.130979061 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:45.131006956 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:45.131758928 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:45.132038116 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:45.132123947 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:45.132177114 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:45.132195950 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:45.132210970 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:45.348634958 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:45.349453926 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:45.349523067 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:45.349844933 CEST | 49757 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:45.349860907 CEST | 443 | 49757 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:46.733335018 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:46.733406067 CEST | 443 | 49758 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:46.733514071 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:46.733807087 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:46.733824015 CEST | 443 | 49758 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:47.363708973 CEST | 443 | 49758 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:47.397001982 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:47.397041082 CEST | 443 | 49758 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:47.397669077 CEST | 443 | 49758 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:47.404227972 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:47.404354095 CEST | 443 | 49758 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:47.407905102 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:47.407929897 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:47.407943964 CEST | 443 | 49758 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:47.664505959 CEST | 443 | 49758 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:47.664868116 CEST | 443 | 49758 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:47.664927006 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:47.665168047 CEST | 49758 | 443 | 192.168.2.5 | 142.250.186.174 |
| Oct 3, 2024 03:01:47.665194035 CEST | 443 | 49758 | 142.250.186.174 | 192.168.2.5 |
| Oct 3, 2024 03:01:55.345669031 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:55.345727921 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:55.345807076 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:55.346271038 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:55.346287966 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:55.947990894 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:55.948071003 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:55.952238083 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:55.952253103 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:55.952461004 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:55.959331989 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:56.003422976 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:56.158675909 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:56.158699036 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:56.158724070 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:56.158885956 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:56.158917904 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:56.159096003 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:56.159681082 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:56.159713030 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:56.159871101 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:56.159871101 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:56.159879923 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:56.160073996 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:56.160119057 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:56.163074017 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:56.163120985 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:01:56.163146019 CEST | 49759 | 443 | 192.168.2.5 | 20.12.23.50 |
| Oct 3, 2024 03:01:56.163161039 CEST | 443 | 49759 | 20.12.23.50 | 192.168.2.5 |
| Oct 3, 2024 03:02:07.848447084 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:02:07.848551989 CEST | 443 | 49761 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:02:07.848675966 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:02:07.848865032 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:02:07.848907948 CEST | 443 | 49761 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:02:14.603506088 CEST | 49764 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:14.603599072 CEST | 443 | 49764 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:14.603681087 CEST | 49764 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:14.603930950 CEST | 49764 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:14.603965998 CEST | 443 | 49764 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:15.249670029 CEST | 443 | 49764 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:15.249926090 CEST | 49764 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:15.249947071 CEST | 443 | 49764 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:15.250485897 CEST | 443 | 49764 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:15.250803947 CEST | 49764 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:15.250895023 CEST | 443 | 49764 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:15.250937939 CEST | 49764 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:15.250937939 CEST | 49764 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:15.250976086 CEST | 443 | 49764 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:15.293790102 CEST | 49764 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:15.549295902 CEST | 443 | 49764 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:15.550117016 CEST | 443 | 49764 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:15.550209045 CEST | 49764 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:15.550467014 CEST | 49764 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:15.550488949 CEST | 443 | 49764 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:17.531450033 CEST | 49765 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:17.531547070 CEST | 443 | 49765 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:17.531652927 CEST | 49765 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:17.531898975 CEST | 49765 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:17.531929016 CEST | 443 | 49765 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:18.179507017 CEST | 443 | 49765 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:18.183044910 CEST | 49765 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:18.183109999 CEST | 443 | 49765 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:18.183466911 CEST | 443 | 49765 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:18.183746099 CEST | 49765 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:18.183810949 CEST | 443 | 49765 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:18.184051037 CEST | 49765 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:18.184051037 CEST | 49765 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:18.184089899 CEST | 443 | 49765 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:18.479150057 CEST | 443 | 49765 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:18.479535103 CEST | 443 | 49765 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:18.479615927 CEST | 49765 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:18.479777098 CEST | 49765 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:18.479821920 CEST | 443 | 49765 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:37.855804920 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:02:37.899446964 CEST | 443 | 49761 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:02:47.610364914 CEST | 49767 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:47.610425949 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:47.610532045 CEST | 49767 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:47.610869884 CEST | 49767 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:47.610892057 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:47.767215014 CEST | 49768 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:47.767313004 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:47.767422915 CEST | 49768 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:47.767776966 CEST | 49768 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:47.767813921 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.250983000 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.251346111 CEST | 49767 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.251410961 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.251938105 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.252234936 CEST | 49767 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.252327919 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.252403975 CEST | 49767 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.252403975 CEST | 49767 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.252446890 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.431622028 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.432033062 CEST | 49768 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.432068110 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.432826996 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.433197975 CEST | 49768 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.433290005 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.433340073 CEST | 49768 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.433362961 CEST | 49768 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.433372021 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.549180984 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.549988985 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.550120115 CEST | 49767 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.550170898 CEST | 49767 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.550188065 CEST | 443 | 49767 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.737061024 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.737410069 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:02:48.737473965 CEST | 49768 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.737767935 CEST | 49768 | 443 | 192.168.2.5 | 142.250.186.142 |
| Oct 3, 2024 03:02:48.737792015 CEST | 443 | 49768 | 142.250.186.142 | 192.168.2.5 |
| Oct 3, 2024 03:03:07.903840065 CEST | 49769 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:03:07.903942108 CEST | 443 | 49769 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:03:07.904066086 CEST | 49769 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:03:07.904335976 CEST | 49769 | 443 | 192.168.2.5 | 216.58.206.68 |
| Oct 3, 2024 03:03:07.904377937 CEST | 443 | 49769 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:03:08.566617966 CEST | 443 | 49769 | 216.58.206.68 | 192.168.2.5 |
| Oct 3, 2024 03:03:08.616494894 CEST | 49769 | 443 | 192.168.2.5 | 216.58.206.68 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 3, 2024 03:01:03.401374102 CEST | 61468 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:01:03.401689053 CEST | 56959 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:01:03.407896996 CEST | 53 | 61468 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:03.408482075 CEST | 53 | 56959 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:03.429486990 CEST | 53 | 59713 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:03.433104038 CEST | 53 | 63874 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.380502939 CEST | 60887 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:01:04.380779982 CEST | 60820 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:01:04.387202024 CEST | 53 | 60887 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.387351036 CEST | 53 | 60820 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:04.444030046 CEST | 53 | 61061 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:07.794951916 CEST | 64080 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:01:07.795085907 CEST | 63386 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:01:07.801973104 CEST | 53 | 63386 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:07.802164078 CEST | 53 | 64080 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:07.965692997 CEST | 53 | 63332 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:09.772393942 CEST | 53 | 54790 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:12.349216938 CEST | 65072 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:01:12.349718094 CEST | 61124 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:01:12.357593060 CEST | 53 | 65072 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:12.360799074 CEST | 53 | 61124 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.411755085 CEST | 54929 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:01:13.412050009 CEST | 51405 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:01:13.418359041 CEST | 53 | 54929 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:13.418742895 CEST | 53 | 51405 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:21.357065916 CEST | 53 | 57846 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:01:40.446532965 CEST | 53 | 57442 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:02:03.068658113 CEST | 53 | 53939 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:02:03.069323063 CEST | 53 | 64450 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:02:11.450443029 CEST | 53 | 50938 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:02:14.595801115 CEST | 53134 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:02:14.595854998 CEST | 64298 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 03:02:14.602844000 CEST | 53 | 53134 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:02:14.603126049 CEST | 53 | 64298 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 03:02:31.021159887 CEST | 53 | 51651 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 3, 2024 03:01:03.401374102 CEST | 192.168.2.5 | 1.1.1.1 | 0xf224 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 03:01:03.401689053 CEST | 192.168.2.5 | 1.1.1.1 | 0xae01 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 03:01:04.380502939 CEST | 192.168.2.5 | 1.1.1.1 | 0xd508 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 03:01:04.380779982 CEST | 192.168.2.5 | 1.1.1.1 | 0x836 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 03:01:07.794951916 CEST | 192.168.2.5 | 1.1.1.1 | 0xed31 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 03:01:07.795085907 CEST | 192.168.2.5 | 1.1.1.1 | 0xf8b7 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 03:01:12.349216938 CEST | 192.168.2.5 | 1.1.1.1 | 0xde52 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 03:01:12.349718094 CEST | 192.168.2.5 | 1.1.1.1 | 0xf128 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 03:01:13.411755085 CEST | 192.168.2.5 | 1.1.1.1 | 0x9e4c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 03:01:13.412050009 CEST | 192.168.2.5 | 1.1.1.1 | 0x7ee4 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 03:02:14.595801115 CEST | 192.168.2.5 | 1.1.1.1 | 0x3e7a | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 03:02:14.595854998 CEST | 192.168.2.5 | 1.1.1.1 | 0x7e08 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 3, 2024 03:01:03.407896996 CEST | 1.1.1.1 | 192.168.2.5 | 0xf224 | No error (0) | 216.58.212.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:03.408482075 CEST | 1.1.1.1 | 192.168.2.5 | 0xae01 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 216.58.212.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387202024 CEST | 1.1.1.1 | 192.168.2.5 | 0xd508 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387351036 CEST | 1.1.1.1 | 192.168.2.5 | 0x836 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:04.387351036 CEST | 1.1.1.1 | 192.168.2.5 | 0x836 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 03:01:07.801973104 CEST | 1.1.1.1 | 192.168.2.5 | 0xf8b7 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 03:01:07.802164078 CEST | 1.1.1.1 | 192.168.2.5 | 0xed31 | No error (0) | 216.58.206.68 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:12.357593060 CEST | 1.1.1.1 | 192.168.2.5 | 0xde52 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:12.357593060 CEST | 1.1.1.1 | 192.168.2.5 | 0xde52 | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:12.360799074 CEST | 1.1.1.1 | 192.168.2.5 | 0xf128 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 03:01:13.418359041 CEST | 1.1.1.1 | 192.168.2.5 | 0x9e4c | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 03:02:14.602844000 CEST | 1.1.1.1 | 192.168.2.5 | 0x3e7a | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49704 | 216.58.212.142 | 443 | 6332 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-03 01:01:04 UTC | 859 | OUT | |
| 2024-10-03 01:01:04 UTC | 1919 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49710 | 142.250.185.238 | 443 | 6332 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-03 01:01:05 UTC | 902 | OUT | |
| 2024-10-03 01:01:05 UTC | 2530 | IN |