Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1524805 |
| MD5: | 8d3ee4b9b4f941932e71657e1bbc0aaa |
| SHA1: | b789aa43c4a8f53eb8e6df61747c99e70634b22c |
| SHA256: | 35359f4b8af06d6b3b37992f7ae8f9c9bea7a975f51e697cc738b4ef65715a98 |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 72 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Classification
- System is w10x64
file.exe (PID: 6476 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 8D3EE4B9B4F941932E71657E1BBC0AAA) 
taskkill.exe (PID: 5660 cmdline: taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) 
conhost.exe (PID: 6256 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 4504 cmdline:
taskkill / F /IM msed ge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 1408 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 4248 cmdline:
taskkill / F /IM fire fox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 4340 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 6388 cmdline:
taskkill / F /IM oper a.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 4456 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 4504 cmdline:
taskkill / F /IM brav e.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 5900 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
chrome.exe (PID: 7316 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://youtu be.com/acc ount?=http s://accoun ts.google. com/v3/sig nin/challe nge/pwd" - -start-ful lscreen -- no-first-r un --disab le-session -crashed-b ubble --di sable-info bars MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 7528 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2200 --fi eld-trial- handle=184 0,i,113615 7901098822 9476,10119 9464909568 85098,2621 44 /prefet ch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 5420 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=53 40 --field -trial-han dle=1840,i ,113615790 1098822947 6,10119946 4909568850 98,262144 /prefetch: 8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 6488 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5404 --f ield-trial -handle=18 40,i,11361 5790109882 29476,1011 9946490956 885098,262 144 /prefe tch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00AEDBBE | |
| Source: | Code function: | 0_2_00ABC2A2 | |
| Source: | Code function: | 0_2_00AF68EE | |
| Source: | Code function: | 0_2_00AF698F | |
| Source: | Code function: | 0_2_00AED076 | |
| Source: | Code function: | 0_2_00AED3A9 | |
| Source: | Code function: | 0_2_00AF9642 | |
| Source: | Code function: | 0_2_00AF979D | |
| Source: | Code function: | 0_2_00AF9B2B | |
| Source: | Code function: | 0_2_00AF5C97 | |
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_00AFCE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00AFEAFF | |
| Source: | Code function: | 0_2_00AFED6A | |
| Source: | Code function: | 0_2_00AFEAFF | |
| Source: | Code function: | 0_2_00AEAA57 | |
| Source: | Code function: | 0_2_00B19576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_92592f19-c | |
| Source: | String found in binary or memory: | memstr_029c7474-9 | |
| Source: | String found in binary or memory: | memstr_ed6c9415-e | |
| Source: | String found in binary or memory: | memstr_75a68737-6 | |
| Source: | Code function: | 0_2_00AED5EB | |
| Source: | Code function: | 0_2_00AE1201 | |
| Source: | Code function: | 0_2_00AEE8F6 | |
| Source: | Code function: | 0_2_00A88060 | |
| Source: | Code function: | 0_2_00AF2046 | |
| Source: | Code function: | 0_2_00AE8298 | |
| Source: | Code function: | 0_2_00ABE4FF | |
| Source: | Code function: | 0_2_00AB676B | |
| Source: | Code function: | 0_2_00B14873 | |
| Source: | Code function: | 0_2_00AACAA0 | |
| Source: | Code function: | 0_2_00A8CAF0 | |
| Source: | Code function: | 0_2_00A9CC39 | |
| Source: | Code function: | 0_2_00AB6DD9 | |
| Source: | Code function: | 0_2_00A9D063 | |
| Source: | Code function: | 0_2_00A891C0 | |
| Source: | Code function: | 0_2_00A9B119 | |
| Source: | Code function: | 0_2_00AA1394 | |
| Source: | Code function: | 0_2_00AA1706 | |
| Source: | Code function: | 0_2_00AA781B | |
| Source: | Code function: | 0_2_00AA19B0 | |
| Source: | Code function: | 0_2_00A87920 | |
| Source: | Code function: | 0_2_00A9997D | |
| Source: | Code function: | 0_2_00AA7A4A | |
| Source: | Code function: | 0_2_00AA7CA7 | |
| Source: | Code function: | 0_2_00AA1C77 | |
| Source: | Code function: | 0_2_00AB9EEE | |
| Source: | Code function: | 0_2_00B0BE44 | |
| Source: | Code function: | 0_2_00AA1F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00AF37B5 | |
| Source: | Code function: | 0_2_00AE10BF | |
| Source: | Code function: | 0_2_00AE16C3 | |
| Source: | Code function: | 0_2_00AF51CD | |
| Source: | Code function: | 0_2_00B0A67C | |
| Source: | Code function: | 0_2_00AF648E | |
| Source: | Code function: | 0_2_00A842A2 | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00A842DE | |
| Source: | Code function: | 0_2_00AA0A89 | |
| Source: | Code function: | 0_2_00A9F98E | |
| Source: | Code function: | 0_2_00B11C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-96640 | ||
| Source: | API coverage: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_00AEDBBE | |
| Source: | Code function: | 0_2_00ABC2A2 | |
| Source: | Code function: | 0_2_00AF68EE | |
| Source: | Code function: | 0_2_00AF698F | |
| Source: | Code function: | 0_2_00AED076 | |
| Source: | Code function: | 0_2_00AED3A9 | |
| Source: | Code function: | 0_2_00AF9642 | |
| Source: | Code function: | 0_2_00AF979D | |
| Source: | Code function: | 0_2_00AF9B2B | |
| Source: | Code function: | 0_2_00AF5C97 | |
| Source: | Code function: | 0_2_00A842DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00AFEAA2 | |
| Source: | Code function: | 0_2_00AB2622 | |
| Source: | Code function: | 0_2_00A842DE | |
| Source: | Code function: | 0_2_00AA4CE8 | |
| Source: | Code function: | 0_2_00AE0B62 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_00AB2622 | |
| Source: | Code function: | 0_2_00AA083F | |
| Source: | Code function: | 0_2_00AA09D5 | |
| Source: | Code function: | 0_2_00AA0C21 | |
| Source: | Code function: | 0_2_00AE1201 | |
| Source: | Code function: | 0_2_00AC2BA5 | |
| Source: | Code function: | 0_2_00AEB226 | |
| Source: | Code function: | 0_2_00B022DA | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00AE0B62 | |
| Source: | Code function: | 0_2_00AE1663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00AA0698 | |
| Source: | Code function: | 0_2_00AF8195 | |
| Source: | Code function: | 0_2_00ADD27A | |
| Source: | Code function: | 0_2_00ABB952 | |
| Source: | Code function: | 0_2_00A842DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 0_2_00B01204 | |
| Source: | Code function: | 0_2_00B01806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 2 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 16 System Information Discovery | Distributed Component Object Model | Input Capture | 3 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 2 Valid Accounts | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Virtualization/Sandbox Evasion | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 21 Access Token Manipulation | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 2 Process Injection | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 11% | ReversingLabs | |||
| 18% | Virustotal | Browse | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 1% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 172.217.18.110 | true | false |
| unknown |
| www3.l.google.com | 172.217.16.206 | true | false |
| unknown |
| play.google.com | 142.250.185.142 | true | false |
| unknown |
| www.google.com | 142.250.186.36 | true | false |
| unknown |
| youtube.com | 172.217.16.142 | true | false |
| unknown |
| accounts.youtube.com | unknown | unknown | false |
| unknown |
| www.youtube.com | unknown | unknown | false |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.186.36 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.16.206 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 172.217.18.110 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.16.142 | youtube.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.7 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1524805 |
| Start date and time: | 2024-10-03 09:27:54 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 11s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 30 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal72.troj.evad.winEXE@52/30@12/6 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.184.227, 142.250.184.238, 142.251.173.84, 34.104.35.123, 142.250.184.195, 142.250.185.195, 142.250.181.234, 142.250.184.234, 216.58.212.170, 142.250.185.74, 142.250.184.202, 142.250.186.42, 142.250.74.202, 142.250.185.202, 142.250.185.138, 216.58.206.42, 172.217.16.138, 142.250.185.106, 142.250.185.170, 172.217.18.10, 142.250.186.170, 142.250.185.234, 142.250.186.74, 216.58.206.74, 172.217.16.202, 142.250.186.106, 142.250.186.138, 199.232.210.172, 142.250.185.99, 64.233.184.84, 142.250.185.142
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Azorult | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| play.google.com | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Amadey, Credential Flusher, Stealc | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Azorult | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
|
⊘No context
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 744362 |
| Entropy (8bit): | 5.7913337944729175 |
| Encrypted: | false |
| SSDEEP: | 6144:HVXWBQkPdzg5pTX1ROv/duPzd8C3s891/Q:gfd8j91/Q |
| MD5: | C6E31A4B08FC2DF9191AA47785B3FB31 |
| SHA1: | 5094D16F35D927EBE73D715F95E199BB2112BFA6 |
| SHA-256: | 67CA532191F69C2FF20D2A015493D6A4AB7ADC9C584A86F1E10E272FD72100E9 |
| SHA-512: | 6C6E78717D44F86CA4FBCA84534810D6432913D9D61BC13FE010D03775F6FE5C4705B4D1965641C858DE68DBA7D1B306CE12FF62E4C38995C1EE3EA0541F9565 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHMmP29tNFN_V7bhU8rapgP9PTgBw/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.404371326611379 |
| Encrypted: | false |
| SSDEEP: | 192:EEFZpeip4HzZlY0If0Ma23jcUcrhCx6VD1TYPi8:Es/p4jgjUhtD1TY68 |
| MD5: | 21E893B65627B397E22619A9F5BB9662 |
| SHA1: | F561B0F66211C1E7B22F94B4935C312AB7087E85 |
| SHA-256: | FFA9B8BC8EF2CDFF5EB4BA1A0BA1710A253A5B42535E2A369D5026967DCF4673 |
| SHA-512: | 3DE3CD6A4E9B06AB3EB324E90A40B5F2AEEA8D7D6A2651C310E993CF79EEB5AC6E2E33C587F46B2DD20CC862354FD1A61AEBB9B990E6805F6629404BA285F8FA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 698791 |
| Entropy (8bit): | 5.595243292922648 |
| Encrypted: | false |
| SSDEEP: | 6144:TJvaKtQfcxene0F2HhPM8RGYcBlKmd5r6XIQqS7SlncOpYMSrBg5X3O4mAEFD7:TJyKtkIct842IQqHJ09 |
| MD5: | 7A4AEFC2F596D19F522738DB34C5A680 |
| SHA1: | 7F6E9BE8B3C1450075365A31FF6E4B49F1D35BA7 |
| SHA-256: | 61D7FF7565945545C0D823CCFC5DB5D09C8714FBF8AD77994F389F08289124B2 |
| SHA-512: | 7D80188B002DB3ED7360B9B236DE435F2008345ECEC00FDE39412BE39DE5C08FD80CBD2D7370D0DBB98F4BCCA0CEF147AD9E7935AC2894DB55D81C1B32EB647E |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22833 |
| Entropy (8bit): | 5.425034548615223 |
| Encrypted: | false |
| SSDEEP: | 384:7lFo6ZEdpgtmyiPixV9OX9gMBpHkHnfst9lZulagGcwYHiRFjJzN7:77o6ZviPixV8xpEHn89l4IgGcwYCRtb7 |
| MD5: | 749B18538FE32BFE0815D75F899F5B21 |
| SHA1: | AF95A019211AF69F752A43CAA54A83C2AFD41D28 |
| SHA-256: | 116B2687C1D5E00DB56A79894AB0C12D4E2E000B9379B7E7AD751B84DF611F3F |
| SHA-512: | E4B6F4556AA0FD9979BB52681508F5E26FFB256473803F74F7F5C8D93FA3636D7D0A5835618FBC6123022805CE0D9616A7451A0F302C665E28A6090B5D588505 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4067 |
| Entropy (8bit): | 5.363457972758152 |
| Encrypted: | false |
| SSDEEP: | 96:G2CiFZX5BReR68ujioIRVrqtyzBeTV6SfyAKLif9cLw:bCMZXVeR6jiosVrqtyzBaImyAKw9z |
| MD5: | B027BF10F968F37628EB698B2CF46D8E |
| SHA1: | 0C9801E4FF3BE18102E6E22246B4262FCC6CE011 |
| SHA-256: | 98608C8414932B6F029948A323B1236EFB96861306FD1EDEB6CE47E180392B47 |
| SHA-512: | 3B1E5A3B247273F025EACF389F98BC139F8453ECEC7A2EC762A4E3279F220B7BED2CB23CD5630E92ED03187C514956DF814E9450FFAA10BFE312633B445DBEF1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.355381206612617 |
| Encrypted: | false |
| SSDEEP: | 48:o7FEEM3MtH15jNQ8jsK3rnw0dkckTrKEp/OqLE9xz0W5Bzv3M6hIHYA+JITbwrF8:oq675jOArwoAmI/DLaxNPL5m+m6w |
| MD5: | E2A7251AD83A0D0634FEA2703D10ED07 |
| SHA1: | 90D72011F31FC40D3DA3748F2817F90A29EB5C01 |
| SHA-256: | 1079B49C4AAF5C10E4F2E6A086623F40D200A71FF2A1F64E88AA6C91E4BE7A6F |
| SHA-512: | CD6D75580EA8BD97CF7C7C0E0BD9D9A54FB6EA7DF1DDB5A95E94D38B260F9EE1425C640839ECD229B8D01E145CF2786CA374D31EC537EB8FE17FF415D5B985F5 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.257113147606035 |
| Encrypted: | false |
| SSDEEP: | 48:o72ZrNZ4yNAbU+15fMxIdf5WENoBCbw7DbG2bEJrw:oyNNAY+1i4HoBNG2Ilw |
| MD5: | F06E2DC5CC446B39F878B5F8E4D78418 |
| SHA1: | 9F1F34FDD8F8DAB942A9B95D9F720587B6F6AD48 |
| SHA-256: | 118E4D2FE7CEF205F9AFC87636554C6D8220882B158333EE3D1990282D158B8F |
| SHA-512: | 893C4F883CD1C88C6AAF5A6E7F232D62823A53E1FFDE5C1C52BB066D75781DD041F4D281CDBF18070D921CE862652D8863E2B9D5E0190CFA4128890D62C44168 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32500 |
| Entropy (8bit): | 5.378903546681047 |
| Encrypted: | false |
| SSDEEP: | 768:zYlbuROstb0e39nKGrkysU0smpu4OLOdzIf1p/5GeSsngurz6aKEEEGo/:zYl61Cysbu4OLOdzIfrIen72ZFo/ |
| MD5: | BF4BF9728A7C302FBA5B14F3D0F1878B |
| SHA1: | 2607CA7A93710D629400077FF3602CB207E6F53D |
| SHA-256: | 8981E7B228DF7D6A8797C0CD1E9B0F1F88337D5F0E1C27A04E7A57D2C4309798 |
| SHA-512: | AC9E170FC3AFDC0CF6BB8E926B93EF129A5FAD1BBA51B60BABCF3555E9B652E98F86A00FB099879DED35DD3FFE72ECFA597E20E6CA8CF402BEDEC40F78412EDA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.291808298251231 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DuZvuhqCsNRxoYTY9/qoVk7hz1l2p6vDMW94uEQOeGbCx4VGbgCSFBV87OU:o7DuZWhv6oy12kvwKEeGbC6GbHSh/Hrw |
| MD5: | 4CA7ADFE744A690411EA4D3EA8DB9E4B |
| SHA1: | 2CF1777A199E25378D330DA68BED1871B5C5BC32 |
| SHA-256: | 128129BA736B3094323499B0498A5B3A909C1529717461C34B70080A5B1603BD |
| SHA-512: | 8BD3477AF41D1F0FE74AFFCB177BEC0F5F4FDCBBA6BD29D9C2567E6FFDEF5DEB7FF74BF348F33209C39D7BB4958E748DF6731D3DC8F6947352276BC92EAF9E79 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3467 |
| Entropy (8bit): | 5.514745431912774 |
| Encrypted: | false |
| SSDEEP: | 96:ozbld2fNUmeqJNizhNtt1W8t//loyIpXmdVE2w:onSKE8PWe/Cy4X3j |
| MD5: | 8DEF399E8355ABC23E64505281005099 |
| SHA1: | 24FF74C3AEFD7696D84FF148465DF4B1B60B1696 |
| SHA-256: | F128D7218E1286B05DF11310AD3C8F4CF781402698E45448850D2A3A22F5F185 |
| SHA-512: | 33721DD47658D8E12ADF6BD9E9316EB89F5B6297927F7FD60F954E04B829DCBF0E1AE6DDD9A3401F45E0011AE4B1397B960C218238A3D0F633A2173D8E604082 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5050 |
| Entropy (8bit): | 5.289052544075544 |
| Encrypted: | false |
| SSDEEP: | 96:o4We0hP7OBFXYvB1sig3Fd8HkaXzLmUrv8Vh1WJlLQXT2v2gqw:655758Fd8HkaPZ0GmAD |
| MD5: | 26E26FD11772DFF5C7004BEA334289CC |
| SHA1: | 638DAAF541BDE31E95AEE4F8ADA677434D7051DB |
| SHA-256: | ADFE3E4960982F5EF4C043052A9990D8683C5FC2B590E817B6B1A5774DDE2CE3 |
| SHA-512: | C31929EB6D1C60D6A84A2574FF60490394A6D6F9B354972F3328952F570D80B3F2AEC916B0E1B66DDB1AC056EB75BFAC477E7AF631D0AD1810EDBAF025465D66 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.298162049824456 |
| Encrypted: | false |
| SSDEEP: | 48:o7vGoolL3ALFKphnpiu7xOKAcfO/3d/rYh4vZorw:o/QLUFUL4KA+2y0Mw |
| MD5: | CE055F881BDAB4EF6C1C8AA4B3890348 |
| SHA1: | 2671741A70E9F5B608F690AAEEA4972003747654 |
| SHA-256: | 9B91C23691D6032CDFE28863E369624B2EDB033E1487A1D1BB0977E3590E5462 |
| SHA-512: | 8A22250628985C2E570E6FBADFC0D5CB6753F0735130F9E74962A409476C2859C5C81F8A0F5C427A9F13ED399C8E251FA43FF67AD5F16860640D45E7A538E857 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.583317111592395 |
| TrID: |
|
| File name: | file.exe |
| File size: | 919'040 bytes |
| MD5: | 8d3ee4b9b4f941932e71657e1bbc0aaa |
| SHA1: | b789aa43c4a8f53eb8e6df61747c99e70634b22c |
| SHA256: | 35359f4b8af06d6b3b37992f7ae8f9c9bea7a975f51e697cc738b4ef65715a98 |
| SHA512: | aa5493f1baf3520799d581ffbd6e762b1dcb495f947a1ee558ca4f3bba963043aad3bd6746243a3b2ff6c5bd7a59dc353c19a5cdf9d0d318eccb98ae8a4c7e4f |
| SSDEEP: | 12288:5qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgalT8:5qDEvCTbMWu7rQYlBQcBiT6rprG8aR8 |
| TLSH: | 2C159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FE4190 [Thu Oct 3 07:02:40 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007FDE3C61E053h |
| jmp 00007FDE3C61D95Fh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FDE3C61DB3Dh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FDE3C61DB0Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007FDE3C6206FDh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007FDE3C620748h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007FDE3C620731h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9a10 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9a10 | 0x9c00 | 07ce3cd31186a49d818f2cfd4e95e15f | False | 0.30546374198717946 | data | 5.325166743236066 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xcd8 | data | 1.003345498783455 | ||
| RT_GROUP_ICON | 0xdd490 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd508 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd51c | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd530 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd544 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd620 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 3, 2024 09:28:44.983391047 CEST | 49674 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:28:44.998997927 CEST | 49675 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:28:45.030256987 CEST | 49672 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:28:45.999072075 CEST | 49671 | 443 | 192.168.2.7 | 204.79.197.203 |
| Oct 3, 2024 09:28:50.024663925 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 3, 2024 09:28:50.389848948 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 3, 2024 09:28:50.811522961 CEST | 49671 | 443 | 192.168.2.7 | 204.79.197.203 |
| Oct 3, 2024 09:28:51.139667988 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 3, 2024 09:28:52.640235901 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 3, 2024 09:28:53.406497955 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:53.406560898 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:53.406821966 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:53.407042980 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:53.407056093 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.040326118 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.072438002 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:54.072468042 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.072913885 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.072982073 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:54.074955940 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.074996948 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:54.100670099 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:54.100728989 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.101130009 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:54.101136923 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.155714989 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:54.319235086 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.319684029 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.319777012 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:54.358100891 CEST | 49700 | 443 | 192.168.2.7 | 172.217.16.142 |
| Oct 3, 2024 09:28:54.358110905 CEST | 443 | 49700 | 172.217.16.142 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.373039007 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:54.373075008 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.373135090 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:54.373986006 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:54.374001980 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.593238115 CEST | 49674 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:28:54.608874083 CEST | 49675 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:28:54.640124083 CEST | 49672 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:28:55.005644083 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:55.008733988 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:55.008755922 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:55.009183884 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:55.009474039 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:55.009906054 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:55.009970903 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:55.011157990 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:55.011231899 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:55.011410952 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:55.011428118 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:55.063225031 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:55.320132971 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:55.320159912 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:55.320231915 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:55.320280075 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:55.320280075 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:55.323955059 CEST | 49705 | 443 | 192.168.2.7 | 172.217.18.110 |
| Oct 3, 2024 09:28:55.323986053 CEST | 443 | 49705 | 172.217.18.110 | 192.168.2.7 |
| Oct 3, 2024 09:28:55.624480009 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 3, 2024 09:28:57.054471970 CEST | 443 | 49698 | 104.98.116.138 | 192.168.2.7 |
| Oct 3, 2024 09:28:57.054658890 CEST | 49698 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:28:57.861850023 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:28:57.861901045 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:28:57.861979961 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:28:57.862220049 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:28:57.862232924 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.049055099 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:58.049154997 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.049248934 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:58.051084995 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:58.051120043 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.495291948 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.500850916 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:28:58.500859022 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.502017975 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.502079010 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:28:58.523461103 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:28:58.523597002 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.576668978 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:28:58.576683044 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.623608112 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:28:58.688617945 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.688678026 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:58.702536106 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:58.702553988 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.702879906 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.748130083 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:58.795572996 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:58.843405962 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.980514050 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.980590105 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.980640888 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:58.980782032 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:58.980802059 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:58.980812073 CEST | 49712 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:58.980818987 CEST | 443 | 49712 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:59.022418976 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:59.022456884 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:59.022528887 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:59.022844076 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:59.022860050 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:59.661391020 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:59.661546946 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:59.662817001 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:59.662832975 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:59.663113117 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:59.664268970 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:59.711404085 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:59.938859940 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:59.938946009 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:28:59.942382097 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:59.942382097 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:59.942420006 CEST | 49714 | 443 | 192.168.2.7 | 184.28.90.27 |
| Oct 3, 2024 09:28:59.942439079 CEST | 443 | 49714 | 184.28.90.27 | 192.168.2.7 |
| Oct 3, 2024 09:29:00.425220013 CEST | 49671 | 443 | 192.168.2.7 | 204.79.197.203 |
| Oct 3, 2024 09:29:01.588644028 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 3, 2024 09:29:02.208425999 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:02.208484888 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:02.208564997 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:02.208811045 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:02.208823919 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:02.842175007 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:02.842546940 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:02.842569113 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:02.842961073 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:02.843015909 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:02.843692064 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:02.843744993 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:02.846229076 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:02.846288919 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:02.846501112 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:02.846508026 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:02.889811993 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.158606052 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.158740997 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.158807039 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.158823967 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.158842087 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.158868074 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.158874035 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.158915997 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.164407015 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.164494991 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.170627117 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.170706987 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.170720100 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.170773029 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.176997900 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.177084923 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.183430910 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.183525085 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.183530092 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.183553934 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.183590889 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.245393991 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.245450974 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.245532990 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.245568037 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.245609045 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.247574091 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.247657061 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.253968000 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.254054070 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.254062891 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.254089117 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.254185915 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.260210037 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.260304928 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.266603947 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.266695023 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.266712904 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.272952080 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.273049116 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.273056984 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.279342890 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.279441118 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.279474974 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.279712915 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.279777050 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.317819118 CEST | 49725 | 443 | 192.168.2.7 | 172.217.16.206 |
| Oct 3, 2024 09:29:03.317873001 CEST | 443 | 49725 | 172.217.16.206 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.189510107 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:05.189534903 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.189599991 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:05.190593004 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:05.190608978 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.490040064 CEST | 49698 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:29:05.490464926 CEST | 49738 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:29:05.490504980 CEST | 443 | 49738 | 104.98.116.138 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.490550995 CEST | 49738 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:29:05.492831945 CEST | 49738 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:29:05.492852926 CEST | 443 | 49738 | 104.98.116.138 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.495299101 CEST | 443 | 49698 | 104.98.116.138 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.548670053 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:29:05.591465950 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.814888000 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.815020084 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.815088034 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:29:05.815115929 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.815198898 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.815246105 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:29:05.815253019 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.815552950 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.815617085 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:29:05.816822052 CEST | 49710 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:29:05.816838026 CEST | 443 | 49710 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.987323999 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.987457037 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:06.046062946 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:06.046092987 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.047137022 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.098016977 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:06.630928993 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:06.671408892 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.890465975 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.890532017 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.890571117 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.890592098 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:06.890611887 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.890625954 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:06.890645981 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.890661955 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:06.890664101 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.890697002 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:06.890712976 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:06.890851974 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.890913963 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:06.890928030 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.891041040 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:06.891088009 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:07.375530005 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:07.375560045 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:07.375613928 CEST | 49736 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:07.375619888 CEST | 443 | 49736 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:13.498666048 CEST | 49677 | 443 | 192.168.2.7 | 20.50.201.200 |
| Oct 3, 2024 09:29:15.647891045 CEST | 61153 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:29:15.652785063 CEST | 53 | 61153 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:15.652864933 CEST | 61153 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:29:15.652956009 CEST | 61153 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:29:15.658037901 CEST | 53 | 61153 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:16.105273008 CEST | 53 | 61153 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:16.159924030 CEST | 61153 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:29:16.185318947 CEST | 61153 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:29:16.190521002 CEST | 53 | 61153 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:16.190577030 CEST | 61153 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:29:43.764470100 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:43.764509916 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:43.764599085 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:43.765892029 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:43.765903950 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.582904100 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.583096027 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.586311102 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.586318016 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.586641073 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.592417955 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.635447025 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.931292057 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.931356907 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.931436062 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.931521893 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.931535959 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.931549072 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.931598902 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.932436943 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.932522058 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.932529926 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.932591915 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.932596922 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.932636976 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.932647943 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.932841063 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.933845043 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.933866978 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:44.933872938 CEST | 61158 | 443 | 192.168.2.7 | 20.114.59.183 |
| Oct 3, 2024 09:29:44.933877945 CEST | 443 | 61158 | 20.114.59.183 | 192.168.2.7 |
| Oct 3, 2024 09:29:48.243118048 CEST | 443 | 49738 | 104.98.116.138 | 192.168.2.7 |
| Oct 3, 2024 09:29:48.243238926 CEST | 49738 | 443 | 192.168.2.7 | 104.98.116.138 |
| Oct 3, 2024 09:29:57.907326937 CEST | 61160 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:29:57.907370090 CEST | 443 | 61160 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:57.907437086 CEST | 61160 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:29:57.907651901 CEST | 61160 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:29:57.907665014 CEST | 443 | 61160 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:58.577848911 CEST | 443 | 61160 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:58.578254938 CEST | 61160 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:29:58.578267097 CEST | 443 | 61160 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:58.579370022 CEST | 443 | 61160 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:58.579663038 CEST | 61160 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:29:58.579840899 CEST | 443 | 61160 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:29:58.624574900 CEST | 61160 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:30:08.472001076 CEST | 443 | 61160 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:30:08.472160101 CEST | 443 | 61160 | 142.250.186.36 | 192.168.2.7 |
| Oct 3, 2024 09:30:08.472250938 CEST | 61160 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:30:35.408639908 CEST | 61160 | 443 | 192.168.2.7 | 142.250.186.36 |
| Oct 3, 2024 09:30:35.408725023 CEST | 443 | 61160 | 142.250.186.36 | 192.168.2.7 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 3, 2024 09:28:53.270997047 CEST | 53 | 49822 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:28:53.398987055 CEST | 60293 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:28:53.399274111 CEST | 64563 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:28:53.405827999 CEST | 53 | 60293 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:28:53.405983925 CEST | 53 | 64563 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:28:53.421921015 CEST | 53 | 63818 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.364509106 CEST | 57707 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:28:54.364669085 CEST | 57013 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:28:54.372121096 CEST | 53 | 57707 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.372222900 CEST | 53 | 57013 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:28:54.430942059 CEST | 53 | 54669 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:28:56.266300917 CEST | 123 | 123 | 192.168.2.7 | 20.101.57.9 |
| Oct 3, 2024 09:28:56.434859037 CEST | 123 | 123 | 20.101.57.9 | 192.168.2.7 |
| Oct 3, 2024 09:28:57.850992918 CEST | 55802 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:28:57.851171970 CEST | 65241 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:28:57.860878944 CEST | 53 | 55802 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:28:57.860894918 CEST | 53 | 65241 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:28:59.617270947 CEST | 53 | 55010 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:02.168725967 CEST | 57933 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:29:02.168812037 CEST | 59965 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:29:02.175692081 CEST | 53 | 57933 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:02.175718069 CEST | 53 | 59965 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.618099928 CEST | 49608 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:29:03.619787931 CEST | 52581 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:29:03.625215054 CEST | 53 | 49608 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:03.626904964 CEST | 53 | 52581 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:05.727469921 CEST | 53 | 64034 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:11.616040945 CEST | 53 | 51739 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:15.647459984 CEST | 53 | 54177 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:29:50.506612062 CEST | 138 | 138 | 192.168.2.7 | 192.168.2.255 |
| Oct 3, 2024 09:29:53.245443106 CEST | 53 | 56539 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:30:04.247833967 CEST | 53 | 62974 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:30:05.033771038 CEST | 54600 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:30:05.033960104 CEST | 62842 | 53 | 192.168.2.7 | 1.1.1.1 |
| Oct 3, 2024 09:30:05.317967892 CEST | 53 | 62842 | 1.1.1.1 | 192.168.2.7 |
| Oct 3, 2024 09:30:05.318161964 CEST | 53 | 54600 | 1.1.1.1 | 192.168.2.7 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 3, 2024 09:28:53.398987055 CEST | 192.168.2.7 | 1.1.1.1 | 0x51b1 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 09:28:53.399274111 CEST | 192.168.2.7 | 1.1.1.1 | 0xd81 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 09:28:54.364509106 CEST | 192.168.2.7 | 1.1.1.1 | 0x2100 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 09:28:54.364669085 CEST | 192.168.2.7 | 1.1.1.1 | 0x7198 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 09:28:57.850992918 CEST | 192.168.2.7 | 1.1.1.1 | 0xe628 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 09:28:57.851171970 CEST | 192.168.2.7 | 1.1.1.1 | 0x33ef | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 09:29:02.168725967 CEST | 192.168.2.7 | 1.1.1.1 | 0xca25 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 09:29:02.168812037 CEST | 192.168.2.7 | 1.1.1.1 | 0xc6c7 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 09:29:03.618099928 CEST | 192.168.2.7 | 1.1.1.1 | 0xa051 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 09:29:03.619787931 CEST | 192.168.2.7 | 1.1.1.1 | 0x32c9 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 09:30:05.033771038 CEST | 192.168.2.7 | 1.1.1.1 | 0x5a7f | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 09:30:05.033960104 CEST | 192.168.2.7 | 1.1.1.1 | 0x57ba | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 3, 2024 09:28:53.405827999 CEST | 1.1.1.1 | 192.168.2.7 | 0x51b1 | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:53.405983925 CEST | 1.1.1.1 | 192.168.2.7 | 0xd81 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 172.217.18.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 216.58.212.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 142.250.74.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372121096 CEST | 1.1.1.1 | 192.168.2.7 | 0x2100 | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372222900 CEST | 1.1.1.1 | 192.168.2.7 | 0x7198 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:54.372222900 CEST | 1.1.1.1 | 192.168.2.7 | 0x7198 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 09:28:57.860878944 CEST | 1.1.1.1 | 192.168.2.7 | 0xe628 | No error (0) | 142.250.186.36 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:28:57.860894918 CEST | 1.1.1.1 | 192.168.2.7 | 0x33ef | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 09:29:02.175692081 CEST | 1.1.1.1 | 192.168.2.7 | 0xca25 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 09:29:02.175692081 CEST | 1.1.1.1 | 192.168.2.7 | 0xca25 | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:29:02.175718069 CEST | 1.1.1.1 | 192.168.2.7 | 0xc6c7 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 09:29:03.625215054 CEST | 1.1.1.1 | 192.168.2.7 | 0xa051 | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 09:30:05.318161964 CEST | 1.1.1.1 | 192.168.2.7 | 0x5a7f | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.7 | 49700 | 172.217.16.142 | 443 | 7528 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-03 07:28:54 UTC | 847 | OUT | |
| 2024-10-03 07:28:54 UTC | 1704 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.7 | 49705 | 172.217.18.110 | 443 | 7528 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-03 07:28:55 UTC | 865 | OUT | |
| 2024-10-03 07:28:55 UTC | 2634 | IN |