Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1524981 |
| MD5: | 746063bf48eaa219d09d96b5184ad1de |
| SHA1: | ab9f355421da2267713c07fdd573b20db64730e9 |
| SHA256: | 1f0a0a605b06a2536f8ed6cfd666c21dd37fae64a04ee2f6ebc3957cbf58dda5 |
| Tags: | exeuser-Bitsight |
| Infos: |  |
 | |
Detection
Credential Flusher
| Score: | 72 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sleep loop found (likely to delay execution)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Classification
- System is w10x64
file.exe (PID: 4824 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 746063BF48EAA219D09D96B5184AD1DE) 
taskkill.exe (PID: 2860 cmdline: taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) 
conhost.exe (PID: 6200 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 3552 cmdline:
taskkill / F /IM msed ge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 3556 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 2228 cmdline:
taskkill / F /IM fire fox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 6152 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 1220 cmdline:
taskkill / F /IM oper a.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 1400 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 1476 cmdline:
taskkill / F /IM brav e.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 6220 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
chrome.exe (PID: 5748 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://youtu be.com/acc ount?=http s://accoun ts.google. com/v3/sig nin/challe nge/pwd" - -start-ful lscreen -- no-first-r un --disab le-session -crashed-b ubble --di sable-info bars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 2860 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2104 --fi eld-trial- handle=198 4,i,180140 1782342304 7097,85125 0081331493 5792,26214 4 /prefetc h:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7956 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=54 04 --field -trial-han dle=1984,i ,180140178 2342304709 7,85125008 1331493579 2,262144 / prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7964 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5596 --f ield-trial -handle=19 84,i,18014 0178234230 47097,8512 5008133149 35792,2621 44 /prefet ch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialFlusher | Yara detected Credential Flusher | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00C8DBBE | |
| Source: | Code function: | 0_2_00C5C2A2 | |
| Source: | Code function: | 0_2_00C968EE | |
| Source: | Code function: | 0_2_00C9698F | |
| Source: | Code function: | 0_2_00C8D076 | |
| Source: | Code function: | 0_2_00C8D3A9 | |
| Source: | Code function: | 0_2_00C99642 | |
| Source: | Code function: | 0_2_00C9979D | |
| Source: | Code function: | 0_2_00C99B2B | |
| Source: | Code function: | 0_2_00C95C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_00C9CE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00C9EAFF | |
| Source: | Code function: | 0_2_00C9ED6A | |
| Source: | Code function: | 0_2_00C9EAFF | |
| Source: | Code function: | 0_2_00C8AA57 | |
| Source: | Code function: | 0_2_00CB9576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_2eacd4f7-8 | |
| Source: | String found in binary or memory: | memstr_dddecbfe-0 | |
| Source: | String found in binary or memory: | memstr_58c6126b-0 | |
| Source: | String found in binary or memory: | memstr_29177a16-2 | |
| Source: | Code function: | 0_2_00C8D5EB | |
| Source: | Code function: | 0_2_00C81201 | |
| Source: | Code function: | 0_2_00C8E8F6 | |
| Source: | Code function: | 0_2_00C92046 | |
| Source: | Code function: | 0_2_00C28060 | |
| Source: | Code function: | 0_2_00C88298 | |
| Source: | Code function: | 0_2_00C5E4FF | |
| Source: | Code function: | 0_2_00C5676B | |
| Source: | Code function: | 0_2_00CB4873 | |
| Source: | Code function: | 0_2_00C2CAF0 | |
| Source: | Code function: | 0_2_00C4CAA0 | |
| Source: | Code function: | 0_2_00C3CC39 | |
| Source: | Code function: | 0_2_00C56DD9 | |
| Source: | Code function: | 0_2_00C291C0 | |
| Source: | Code function: | 0_2_00C3B119 | |
| Source: | Code function: | 0_2_00C41394 | |
| Source: | Code function: | 0_2_00C41706 | |
| Source: | Code function: | 0_2_00C4781B | |
| Source: | Code function: | 0_2_00C419B0 | |
| Source: | Code function: | 0_2_00C3997D | |
| Source: | Code function: | 0_2_00C27920 | |
| Source: | Code function: | 0_2_00C47A4A | |
| Source: | Code function: | 0_2_00C47CA7 | |
| Source: | Code function: | 0_2_00C41C77 | |
| Source: | Code function: | 0_2_00C59EEE | |
| Source: | Code function: | 0_2_00CABE44 | |
| Source: | Code function: | 0_2_00C41F32 | |
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00C937B5 | |
| Source: | Code function: | 0_2_00C810BF | |
| Source: | Code function: | 0_2_00C816C3 | |
| Source: | Code function: | 0_2_00C951CD | |
| Source: | Code function: | 0_2_00CAA67C | |
| Source: | Code function: | 0_2_00C9648E | |
| Source: | Code function: | 0_2_00C242A2 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00C242DE | |
| Source: | Code function: | 0_2_00C40A89 | |
| Source: | Code function: | 0_2_00C3119A | |
| Source: | Code function: | 0_2_00C311A2 | |
| Source: | Code function: | 0_2_00C31906 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00C3F98E | |
| Source: | Code function: | 0_2_00CB1C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_0-74751 | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | API coverage: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Code function: | 0_2_00C8DBBE | |
| Source: | Code function: | 0_2_00C5C2A2 | |
| Source: | Code function: | 0_2_00C968EE | |
| Source: | Code function: | 0_2_00C9698F | |
| Source: | Code function: | 0_2_00C8D076 | |
| Source: | Code function: | 0_2_00C8D3A9 | |
| Source: | Code function: | 0_2_00C99642 | |
| Source: | Code function: | 0_2_00C9979D | |
| Source: | Code function: | 0_2_00C99B2B | |
| Source: | Code function: | 0_2_00C95C97 | |
| Source: | Code function: | 0_2_00C242DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00C9EAA2 | |
| Source: | Code function: | 0_2_00C52622 | |
| Source: | Code function: | 0_2_00C242DE | |
| Source: | Code function: | 0_2_00C44CE8 | |
| Source: | Code function: | 0_2_00C80B62 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_00C52622 | |
| Source: | Code function: | 0_2_00C4083F | |
| Source: | Code function: | 0_2_00C409D5 | |
| Source: | Code function: | 0_2_00C40C21 | |
| Source: | Code function: | 0_2_00C81201 | |
| Source: | Code function: | 0_2_00C62BA5 | |
| Source: | Code function: | 0_2_00C8B226 | |
| Source: | Code function: | 0_2_00CA22DA | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00C80B62 | |
| Source: | Code function: | 0_2_00C81663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00C40698 | |
| Source: | Code function: | 0_2_00C98195 | |
| Source: | Code function: | 0_2_00C5B952 | |
| Source: | Code function: | 0_2_00C242DE | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | Code function: | 0_2_00CA1204 | |
| Source: | Code function: | 0_2_00CA1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 2 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 File and Directory Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 16 System Information Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 12 Security Software Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 1 Masquerading | LSA Secrets | 11 Virtualization/Sandbox Evasion | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | Cached Domain Credentials | 3 Process Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 11 Virtualization/Sandbox Evasion | DCSync | 11 Application Window Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 21 Access Token Manipulation | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 2 Process Injection | /etc/passwd and /etc/shadow | Network Sniffing | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 16% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 172.217.18.14 | true | false | unknown | |
| www3.l.google.com | 142.250.185.174 | true | false | unknown | |
| play.google.com | 172.217.18.14 | true | false | unknown | |
| www.google.com | 216.58.206.36 | true | false | unknown | |
| youtube.com | 142.250.186.46 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.186.46 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.18.14 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 216.58.206.78 | unknown | United States | 15169 | GOOGLEUS | false | |
| 216.58.206.36 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.174 | www3.l.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.16 |
| 192.168.2.5 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1524981 |
| Start date and time: | 2024-10-03 14:51:30 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 15s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 20 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal72.troj.evad.winEXE@46/36@12/8 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.181.238, 142.251.173.84, 34.104.35.123, 142.250.185.234, 142.250.186.170, 142.250.185.106, 142.250.184.234, 172.217.16.138, 142.250.181.234, 172.217.18.10, 142.250.184.202, 142.250.185.202, 142.250.74.202, 142.250.185.74, 216.58.206.42, 142.250.186.42, 142.250.185.138, 142.250.186.106, 142.250.185.170, 142.250.185.227, 216.58.212.163, 172.217.18.106, 142.250.186.138, 142.250.186.74, 172.217.16.202, 216.58.206.74, 93.184.221.240, 192.229.221.95, 142.250.186.67, 142.250.110.84, 172.217.16.142
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Credential Flusher | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Phisher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Credential Flusher | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | HtmlDropper | Browse |
|
⊘No context
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.972330200275292 |
| Encrypted: | false |
| SSDEEP: | 48:8ZdwoTQsxsHUidAKZdA19ehwiZUklqehgy+3:88ok+T3y |
| MD5: | BDAB5FD603F3BFEA794D08E2761B7B96 |
| SHA1: | 6A6648129C34865E73B3C3F39FE833DE27399A65 |
| SHA-256: | 06FFA6D78CE588C3D48381F92A822093399AD15CC30D9DB23580298F7E7BC74F |
| SHA-512: | 0357F1CEA111DC8852E8F3D2A003595C6769993E522EC2A133031B38EFE93BE190437D795C5776BB9482E168A907EC0A1115B5C8D087A6AE67E6C78E0C862FA8 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9850005068229764 |
| Encrypted: | false |
| SSDEEP: | 48:8sddwoTQsxsHUidAKZdA1weh/iZUkAQkqehny+2:8lok+h9QKy |
| MD5: | 5187577892D5F275EF898062BC500F4B |
| SHA1: | B57C962AA31E0832696C818FAF16B934FD5EC146 |
| SHA-256: | DD837D6265ADDF466618BBC1E905E1A5E4691D735E21E61BEE477BC9D507A460 |
| SHA-512: | 4B5E07FC5F0719246525F501775AB7AA42752C30924E820BE7760F5770E51239736026732A3B53E5D76A7F9192C5986D594B10AF974D7BB3F433D5E4C6D93AC4 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2693 |
| Entropy (8bit): | 3.999472173355142 |
| Encrypted: | false |
| SSDEEP: | 48:8xKdwoTQsxsHUidAKZdA14tseh7sFiZUkmgqeh7sBy+BX:8xPok+Rnzy |
| MD5: | A37AFF04E9AF42131E314E1CA57B27FA |
| SHA1: | 1D7EFF9E1421C9FBA7DB4F23217518E56B952D44 |
| SHA-256: | E587B46F02ED4A7C42AAA19CB70A66CFD2B2050A8960BC8442D2C675ECE46FFE |
| SHA-512: | 1C8665E2792ACA3B3697EBFA5B091E9D6F16921D1941AB11BA69A58415414E925CC477E21CADDBCA2DE651C118F1E9249875536544CD83C64929C056B46166D0 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.9809526244518536 |
| Encrypted: | false |
| SSDEEP: | 48:8LdwoTQsxsHUidAKZdA1vehDiZUkwqehby+R:8mok+Cpy |
| MD5: | D266AF31E02567BBFBBD2CF9E155E3E4 |
| SHA1: | D691558478FB067A3E5EDAFE6857D26D05DF0EBF |
| SHA-256: | A9D8212B77250CFE6AEA2B92686B5EEA7659990AB44884FD812460CCFD57AC5D |
| SHA-512: | 73317AC881681AE3AC04ADE7E9AF1B7A6A18E5E5AAA3D270647EDD8E6512C2224D8134063803649DEE141B4BED92E0E0FCDB949AB4A1FA9C7F958AC498F6BE38 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 3.972860143251594 |
| Encrypted: | false |
| SSDEEP: | 48:8+dwoTQsxsHUidAKZdA1hehBiZUk1W1qehty+C:8Dok+y9Ny |
| MD5: | 236BD427EEA781D2215C751089027BC0 |
| SHA1: | 2FFA1307E844BA9E46AB40ECBB6C1A40BA263110 |
| SHA-256: | 8082783C96463A713FF2C329A56F3604895484AFECF59BB973F03CB39D82C93F |
| SHA-512: | 5A2B97985F01664277E70C01AA09F6747D01DEB21989A68D2F70D1B9EBF3D71DA498F97B779D884BB72316116E8F64238C50835C935F93DEAB1D6EA60EB8B291 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2683 |
| Entropy (8bit): | 3.9849291365726085 |
| Encrypted: | false |
| SSDEEP: | 48:8OdwoTQsxsHUidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbzy+yT+:8Tok+sT/TbxWOvTbzy7T |
| MD5: | 4C90EB2E1D35754B1C62A19DCDADAFEC |
| SHA1: | 54E5D7097D0AE2C8FA0B9ECDFC4B956250E557F6 |
| SHA-256: | 5440197219BF595A1B3F321305FAB90ED6DA33043BCB4F0F48C1A0C1FD644591 |
| SHA-512: | 932E2CDBA0DE2429DD3CB7559F3C5C7A06A9B978CC156CF8652AF1EBD450DC4D8014770E25EC6C708FC57097FCB29180C7A70966E86FAB3E1D6C306B3933EA76 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3467 |
| Entropy (8bit): | 5.514745431912774 |
| Encrypted: | false |
| SSDEEP: | 96:ozbld2fNUmeqJNizhNtt1W8t//loyIpXmdVE2w:onSKE8PWe/Cy4X3j |
| MD5: | 8DEF399E8355ABC23E64505281005099 |
| SHA1: | 24FF74C3AEFD7696D84FF148465DF4B1B60B1696 |
| SHA-256: | F128D7218E1286B05DF11310AD3C8F4CF781402698E45448850D2A3A22F5F185 |
| SHA-512: | 33721DD47658D8E12ADF6BD9E9316EB89F5B6297927F7FD60F954E04B829DCBF0E1AE6DDD9A3401F45E0011AE4B1397B960C218238A3D0F633A2173D8E604082 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 744362 |
| Entropy (8bit): | 5.791334302173818 |
| Encrypted: | false |
| SSDEEP: | 6144:YVXWBQkPdzg5pTX1ROv/duPzd8C3s891/Q:Nfd8j91/Q |
| MD5: | 5998B16F22823CDA571E9767D2F000F5 |
| SHA1: | 8F191C974AF3FDEF368C7A2706A1C81C7F379ADB |
| SHA-256: | 7FFEA98E198646D080873710AD217394C63EF97E6B8F5DD0EBF5E3BB8B7AED8E |
| SHA-512: | 951A410744AFBD905141EB68846DCC707F36B6A3A7C3734633B98064441E417A14F52B1F3FB347114ED15E7899D3554EA9745EACF7076955119AA0EF9ADD206E |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGukuT5y8NnMp7TQhoXvWQoBnYT8w/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5050 |
| Entropy (8bit): | 5.289052544075544 |
| Encrypted: | false |
| SSDEEP: | 96:o4We0hP7OBFXYvB1sig3Fd8HkaXzLmUrv8Vh1WJlLQXT2v2gqw:655758Fd8HkaPZ0GmAD |
| MD5: | 26E26FD11772DFF5C7004BEA334289CC |
| SHA1: | 638DAAF541BDE31E95AEE4F8ADA677434D7051DB |
| SHA-256: | ADFE3E4960982F5EF4C043052A9990D8683C5FC2B590E817B6B1A5774DDE2CE3 |
| SHA-512: | C31929EB6D1C60D6A84A2574FF60490394A6D6F9B354972F3328952F570D80B3F2AEC916B0E1B66DDB1AC056EB75BFAC477E7AF631D0AD1810EDBAF025465D66 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4067 |
| Entropy (8bit): | 5.363457972758152 |
| Encrypted: | false |
| SSDEEP: | 96:G2CiFZX5BReR68ujioIRVrqtyzBeTV6SfyAKLif9cLw:bCMZXVeR6jiosVrqtyzBaImyAKw9z |
| MD5: | B027BF10F968F37628EB698B2CF46D8E |
| SHA1: | 0C9801E4FF3BE18102E6E22246B4262FCC6CE011 |
| SHA-256: | 98608C8414932B6F029948A323B1236EFB96861306FD1EDEB6CE47E180392B47 |
| SHA-512: | 3B1E5A3B247273F025EACF389F98BC139F8453ECEC7A2EC762A4E3279F220B7BED2CB23CD5630E92ED03187C514956DF814E9450FFAA10BFE312633B445DBEF1 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.404371326611379 |
| Encrypted: | false |
| SSDEEP: | 192:EEFZpeip4HzZlY0If0Ma23jcUcrhCx6VD1TYPi8:Es/p4jgjUhtD1TY68 |
| MD5: | 21E893B65627B397E22619A9F5BB9662 |
| SHA1: | F561B0F66211C1E7B22F94B4935C312AB7087E85 |
| SHA-256: | FFA9B8BC8EF2CDFF5EB4BA1A0BA1710A253A5B42535E2A369D5026967DCF4673 |
| SHA-512: | 3DE3CD6A4E9B06AB3EB324E90A40B5F2AEEA8D7D6A2651C310E993CF79EEB5AC6E2E33C587F46B2DD20CC862354FD1A61AEBB9B990E6805F6629404BA285F8FA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.257113147606035 |
| Encrypted: | false |
| SSDEEP: | 48:o72ZrNZ4yNAbU+15fMxIdf5WENoBCbw7DbG2bEJrw:oyNNAY+1i4HoBNG2Ilw |
| MD5: | F06E2DC5CC446B39F878B5F8E4D78418 |
| SHA1: | 9F1F34FDD8F8DAB942A9B95D9F720587B6F6AD48 |
| SHA-256: | 118E4D2FE7CEF205F9AFC87636554C6D8220882B158333EE3D1990282D158B8F |
| SHA-512: | 893C4F883CD1C88C6AAF5A6E7F232D62823A53E1FFDE5C1C52BB066D75781DD041F4D281CDBF18070D921CE862652D8863E2B9D5E0190CFA4128890D62C44168 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 22833 |
| Entropy (8bit): | 5.425034548615223 |
| Encrypted: | false |
| SSDEEP: | 384:7lFo6ZEdpgtmyiPixV9OX9gMBpHkHnfst9lZulagGcwYHiRFjJzN7:77o6ZviPixV8xpEHn89l4IgGcwYCRtb7 |
| MD5: | 749B18538FE32BFE0815D75F899F5B21 |
| SHA1: | AF95A019211AF69F752A43CAA54A83C2AFD41D28 |
| SHA-256: | 116B2687C1D5E00DB56A79894AB0C12D4E2E000B9379B7E7AD751B84DF611F3F |
| SHA-512: | E4B6F4556AA0FD9979BB52681508F5E26FFB256473803F74F7F5C8D93FA3636D7D0A5835618FBC6123022805CE0D9616A7451A0F302C665E28A6090B5D588505 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.355381206612617 |
| Encrypted: | false |
| SSDEEP: | 48:o7FEEM3MtH15jNQ8jsK3rnw0dkckTrKEp/OqLE9xz0W5Bzv3M6hIHYA+JITbwrF8:oq675jOArwoAmI/DLaxNPL5m+m6w |
| MD5: | E2A7251AD83A0D0634FEA2703D10ED07 |
| SHA1: | 90D72011F31FC40D3DA3748F2817F90A29EB5C01 |
| SHA-256: | 1079B49C4AAF5C10E4F2E6A086623F40D200A71FF2A1F64E88AA6C91E4BE7A6F |
| SHA-512: | CD6D75580EA8BD97CF7C7C0E0BD9D9A54FB6EA7DF1DDB5A95E94D38B260F9EE1425C640839ECD229B8D01E145CF2786CA374D31EC537EB8FE17FF415D5B985F5 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.298162049824456 |
| Encrypted: | false |
| SSDEEP: | 48:o7vGoolL3ALFKphnpiu7xOKAcfO/3d/rYh4vZorw:o/QLUFUL4KA+2y0Mw |
| MD5: | CE055F881BDAB4EF6C1C8AA4B3890348 |
| SHA1: | 2671741A70E9F5B608F690AAEEA4972003747654 |
| SHA-256: | 9B91C23691D6032CDFE28863E369624B2EDB033E1487A1D1BB0977E3590E5462 |
| SHA-512: | 8A22250628985C2E570E6FBADFC0D5CB6753F0735130F9E74962A409476C2859C5C81F8A0F5C427A9F13ED399C8E251FA43FF67AD5F16860640D45E7A538E857 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 698791 |
| Entropy (8bit): | 5.595243292922648 |
| Encrypted: | false |
| SSDEEP: | 6144:TJvaKtQfcxene0F2HhPM8RGYcBlKmd5r6XIQqS7SlncOpYMSrBg5X3O4mAEFD7:TJyKtkIct842IQqHJ09 |
| MD5: | 7A4AEFC2F596D19F522738DB34C5A680 |
| SHA1: | 7F6E9BE8B3C1450075365A31FF6E4B49F1D35BA7 |
| SHA-256: | 61D7FF7565945545C0D823CCFC5DB5D09C8714FBF8AD77994F389F08289124B2 |
| SHA-512: | 7D80188B002DB3ED7360B9B236DE435F2008345ECEC00FDE39412BE39DE5C08FD80CBD2D7370D0DBB98F4BCCA0CEF147AD9E7935AC2894DB55D81C1B32EB647E |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.291808298251231 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DuZvuhqCsNRxoYTY9/qoVk7hz1l2p6vDMW94uEQOeGbCx4VGbgCSFBV87OU:o7DuZWhv6oy12kvwKEeGbC6GbHSh/Hrw |
| MD5: | 4CA7ADFE744A690411EA4D3EA8DB9E4B |
| SHA1: | 2CF1777A199E25378D330DA68BED1871B5C5BC32 |
| SHA-256: | 128129BA736B3094323499B0498A5B3A909C1529717461C34B70080A5B1603BD |
| SHA-512: | 8BD3477AF41D1F0FE74AFFCB177BEC0F5F4FDCBBA6BD29D9C2567E6FFDEF5DEB7FF74BF348F33209C39D7BB4958E748DF6731D3DC8F6947352276BC92EAF9E79 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32500 |
| Entropy (8bit): | 5.378903546681047 |
| Encrypted: | false |
| SSDEEP: | 768:zYlbuROstb0e39nKGrkysU0smpu4OLOdzIf1p/5GeSsngurz6aKEEEGo/:zYl61Cysbu4OLOdzIfrIen72ZFo/ |
| MD5: | BF4BF9728A7C302FBA5B14F3D0F1878B |
| SHA1: | 2607CA7A93710D629400077FF3602CB207E6F53D |
| SHA-256: | 8981E7B228DF7D6A8797C0CD1E9B0F1F88337D5F0E1C27A04E7A57D2C4309798 |
| SHA-512: | AC9E170FC3AFDC0CF6BB8E926B93EF129A5FAD1BBA51B60BABCF3555E9B652E98F86A00FB099879DED35DD3FFE72ECFA597E20E6CA8CF402BEDEC40F78412EDA |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBimEQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHHHUTOu8QCHKV2CSS4q8_ZgreBVQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.5838009000706945 |
| TrID: |
|
| File name: | file.exe |
| File size: | 919'040 bytes |
| MD5: | 746063bf48eaa219d09d96b5184ad1de |
| SHA1: | ab9f355421da2267713c07fdd573b20db64730e9 |
| SHA256: | 1f0a0a605b06a2536f8ed6cfd666c21dd37fae64a04ee2f6ebc3957cbf58dda5 |
| SHA512: | 463e0126e38ae135e4ff603a86b8298a5ce9c7c0ac1f0651ffe78c98205c3482b4349bbf3d8bb13608c80e3462b0b3e22dc94e4ddb2e31db143a2f1fc7b34cd4 |
| SSDEEP: | 12288:eqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgayTJ:eqDEvCTbMWu7rQYlBQcBiT6rprG8aSJ |
| TLSH: | 58159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FE920D [Thu Oct 3 12:46:05 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F0B152358F3h |
| jmp 00007F0B152351FFh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F0B152353DDh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F0B152353AAh |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F0B15237F9Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F0B15237FE8h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F0B15237FD1h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9bf4 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9bf4 | 0x9c00 | a0ff2fe8bc6a05aec5c21c281aedfb04 | False | 0.31810897435897434 | data | 5.331451166549155 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xeba | data | 1.0029177718832891 | ||
| RT_GROUP_ICON | 0xdd674 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd6ec | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd700 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd714 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd728 | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd804 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 3, 2024 14:52:16.697447062 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 14:52:16.697448969 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 14:52:16.806802988 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 14:52:24.391901970 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:24.391963005 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:24.392024994 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:24.393608093 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:24.393629074 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.080171108 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.080534935 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.080563068 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.080960035 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.081015110 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.081837893 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.081887960 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.086363077 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.086445093 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.086843014 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.086858988 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.137829065 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.596133947 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.596363068 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.596590996 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.596647024 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.598417044 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.663953066 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.663992882 CEST | 443 | 49705 | 142.250.186.46 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.664005995 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.664045095 CEST | 49705 | 443 | 192.168.2.5 | 142.250.186.46 |
| Oct 3, 2024 14:52:25.718298912 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:25.718347073 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.718419075 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:25.718736887 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:25.718746901 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:26.309674978 CEST | 49674 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 14:52:26.310249090 CEST | 49675 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 14:52:26.416943073 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:26.419055939 CEST | 49673 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 14:52:26.422534943 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:26.422560930 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:26.423057079 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:26.423113108 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:26.423789978 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:26.423839092 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:26.426420927 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:26.426511049 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:26.427126884 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:26.427145958 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:26.481564999 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:26.754631042 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:26.754704952 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:26.754731894 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:26.755688906 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:26.755789995 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:26.757622004 CEST | 49710 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:26.757644892 CEST | 443 | 49710 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:28.089462042 CEST | 443 | 49703 | 23.1.237.91 | 192.168.2.5 |
| Oct 3, 2024 14:52:28.089637041 CEST | 49703 | 443 | 192.168.2.5 | 23.1.237.91 |
| Oct 3, 2024 14:52:28.775002003 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:28.775048018 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:28.775120974 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:28.775333881 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:28.775352001 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:28.911590099 CEST | 49715 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:28.911645889 CEST | 443 | 49715 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:28.911712885 CEST | 49715 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:28.913583040 CEST | 49715 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:28.913614035 CEST | 443 | 49715 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:29.470551968 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:29.470900059 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:29.470925093 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:29.471911907 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:29.471967936 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:29.473836899 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:29.473932028 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:29.528460026 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:29.528484106 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:29.575333118 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:29.929394007 CEST | 443 | 49715 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:29.929506063 CEST | 49715 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:29.974071026 CEST | 49715 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:29.974098921 CEST | 443 | 49715 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:29.974380016 CEST | 443 | 49715 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:30.028475046 CEST | 49715 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:30.162595034 CEST | 49715 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:30.207406998 CEST | 443 | 49715 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:30.411711931 CEST | 443 | 49715 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:30.411782980 CEST | 443 | 49715 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:30.411832094 CEST | 49715 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:30.411891937 CEST | 49715 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:30.411914110 CEST | 443 | 49715 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:30.411927938 CEST | 49715 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:30.411933899 CEST | 443 | 49715 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:30.483150959 CEST | 49720 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:30.483191013 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:30.483273029 CEST | 49720 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:30.483556986 CEST | 49720 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:30.483567953 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:31.368196011 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:31.368292093 CEST | 49720 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:31.374685049 CEST | 49720 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:31.374695063 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:31.374998093 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:31.392302036 CEST | 49720 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:31.439403057 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:31.667041063 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:31.667115927 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:31.667181969 CEST | 49720 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:31.670542002 CEST | 49720 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:31.670562983 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:31.670624971 CEST | 49720 | 443 | 192.168.2.5 | 184.28.90.27 |
| Oct 3, 2024 14:52:31.670631886 CEST | 443 | 49720 | 184.28.90.27 | 192.168.2.5 |
| Oct 3, 2024 14:52:35.499730110 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:35.499783039 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:35.499852896 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:35.500081062 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:35.500091076 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.146204948 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.146769047 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.146791935 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.147156954 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.147226095 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.147840023 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.147886038 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.148953915 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.149005890 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.149220943 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.149229050 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.199621916 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.467267036 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.467787027 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.467853069 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.467888117 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.467928886 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.468199015 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.468242884 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.473382950 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.473481894 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.479017019 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.479099989 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.479198933 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.479244947 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.485465050 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.485528946 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.491580963 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.491628885 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.491796970 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.491838932 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.554207087 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.554295063 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.554423094 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.554470062 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.555953026 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.556006908 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.561907053 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.561976910 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.562114954 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.562159061 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.568350077 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.568402052 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.574455976 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.574525118 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.574687004 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.580852985 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.580916882 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.580945969 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.587140083 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.587182999 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.587203026 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.587258101 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.587295055 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.587332010 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.587348938 CEST | 443 | 49732 | 142.250.185.174 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.587362051 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.587393999 CEST | 49732 | 443 | 192.168.2.5 | 142.250.185.174 |
| Oct 3, 2024 14:52:36.676369905 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:36.676402092 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.676590919 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:36.676944017 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:36.676954985 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.723733902 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:36.723793030 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.724292040 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:36.724414110 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:36.724430084 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.234355927 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:37.234389067 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.234822035 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:37.236130953 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:37.236150026 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.347491980 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.374716043 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.388297081 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.413281918 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.413312912 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.413536072 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.413579941 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.414084911 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.414099932 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.414201021 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.414210081 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.414859056 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.414922953 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.415350914 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.415441036 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.418879986 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.418909073 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.418962955 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.419013023 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.419424057 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.419441938 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.419486046 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.419501066 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.464888096 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.467844009 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.630412102 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.630609035 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.630678892 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.631082058 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.631082058 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.631117105 CEST | 443 | 49735 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.631200075 CEST | 49735 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.632132053 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.632164001 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.632602930 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.632602930 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.632632971 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.656431913 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.656538010 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.656594992 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.657188892 CEST | 49736 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.657215118 CEST | 443 | 49736 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.658133030 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.658174038 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.658233881 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.658530951 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:37.658541918 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.929915905 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.929984093 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:37.931915998 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:37.931927919 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.932171106 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:37.979837894 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:38.264425993 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.264823914 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.264837027 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.265131950 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.265187979 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.265731096 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.265784979 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.266302109 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.266345978 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.266604900 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.266612053 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.266664982 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.286811113 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.287050009 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.287064075 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.287367105 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.287426949 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.287975073 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.288027048 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.288217068 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.288269997 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.288424969 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.288433075 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.288448095 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.307403088 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.331397057 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.340569973 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.620378971 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.620486975 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.620527029 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.621001959 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.621112108 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.621157885 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.621208906 CEST | 49742 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.621218920 CEST | 443 | 49742 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.623032093 CEST | 49743 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:38.623048067 CEST | 443 | 49743 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.675580978 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:38.719402075 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.903685093 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.903721094 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.903729916 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.903742075 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.903767109 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.903789043 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:38.903808117 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.903819084 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:38.903848886 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:38.905247927 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.905308008 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:38.905317068 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.906152010 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:38.906193972 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:38.979109049 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:39.023395061 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.246120930 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.246380091 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.246479034 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:39.246501923 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.246788979 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.246814013 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.246829987 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:39.246839046 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.247020006 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:39.247348070 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.247397900 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.247435093 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:39.248939991 CEST | 49714 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:52:39.248960018 CEST | 443 | 49714 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.630986929 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:39.631025076 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:39.631041050 CEST | 49740 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:52:39.631048918 CEST | 443 | 49740 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:52:44.531922102 CEST | 49755 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:44.531985998 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:44.532319069 CEST | 49755 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:44.532320023 CEST | 49755 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:44.532365084 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:45.568492889 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:45.568886995 CEST | 49755 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:45.568912983 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:45.569256067 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:45.569545984 CEST | 49755 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:45.569597006 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:45.569705009 CEST | 49755 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:45.569715023 CEST | 49755 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:45.569720984 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:45.891629934 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:45.892287016 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:52:45.895358086 CEST | 49755 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:45.896117926 CEST | 49755 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:52:45.896132946 CEST | 443 | 49755 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:06.968811035 CEST | 49756 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:06.968879938 CEST | 443 | 49756 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:06.969012976 CEST | 49756 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:06.969259024 CEST | 49756 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:06.969280958 CEST | 443 | 49756 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.327346087 CEST | 49757 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.327411890 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.327574968 CEST | 49757 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.327783108 CEST | 49757 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.327796936 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.631881952 CEST | 443 | 49756 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.632309914 CEST | 49756 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.632376909 CEST | 443 | 49756 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.632827997 CEST | 443 | 49756 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.633224010 CEST | 49756 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.633299112 CEST | 443 | 49756 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.633420944 CEST | 49756 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.633457899 CEST | 49756 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.633471012 CEST | 443 | 49756 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.733481884 CEST | 49758 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.733536005 CEST | 443 | 49758 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.733613014 CEST | 49758 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.733880043 CEST | 49758 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.733896971 CEST | 443 | 49758 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.944328070 CEST | 443 | 49756 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.944473028 CEST | 443 | 49756 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.944550037 CEST | 49756 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.944835901 CEST | 49756 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.944895029 CEST | 443 | 49756 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.974870920 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.975132942 CEST | 49757 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.975150108 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.976464033 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.976892948 CEST | 49757 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.977066994 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:07.977082968 CEST | 49757 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.977108002 CEST | 49757 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:07.977226973 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.029016018 CEST | 49757 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:08.477149010 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.477463007 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.477565050 CEST | 49757 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:08.478020906 CEST | 49757 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:08.478045940 CEST | 443 | 49757 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.479809999 CEST | 443 | 49758 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.480102062 CEST | 49758 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:08.480118036 CEST | 443 | 49758 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.480433941 CEST | 443 | 49758 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.480813980 CEST | 49758 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:08.480875015 CEST | 443 | 49758 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.480981112 CEST | 49758 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:08.481007099 CEST | 49758 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:08.481012106 CEST | 443 | 49758 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.675803900 CEST | 443 | 49758 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.675904036 CEST | 443 | 49758 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:08.675976038 CEST | 49758 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:08.676501989 CEST | 49758 | 443 | 192.168.2.5 | 172.217.18.14 |
| Oct 3, 2024 14:53:08.676518917 CEST | 443 | 49758 | 172.217.18.14 | 192.168.2.5 |
| Oct 3, 2024 14:53:16.494875908 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:16.494920969 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:16.495002985 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:16.495398045 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:16.495415926 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.123117924 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.123194933 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.128304005 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.128319025 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.128531933 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.142816067 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.187412024 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.383594990 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.383662939 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.383717060 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.383770943 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.383795977 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.383829117 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.383909941 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.384265900 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.384316921 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.384352922 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.384368896 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.384385109 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.384639025 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.384694099 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.412842035 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.412895918 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:18.412921906 CEST | 49759 | 443 | 192.168.2.5 | 172.202.163.200 |
| Oct 3, 2024 14:53:18.412935019 CEST | 443 | 49759 | 172.202.163.200 | 192.168.2.5 |
| Oct 3, 2024 14:53:28.763595104 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:53:28.763634920 CEST | 443 | 49761 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:53:28.763706923 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:53:28.764028072 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:53:28.764045954 CEST | 443 | 49761 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:53:29.469158888 CEST | 443 | 49761 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:53:29.473113060 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:53:29.473149061 CEST | 443 | 49761 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:53:29.473480940 CEST | 443 | 49761 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:53:29.473776102 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:53:29.473844051 CEST | 443 | 49761 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:53:29.527920008 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:53:37.857950926 CEST | 49763 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:37.857991934 CEST | 443 | 49763 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:37.858066082 CEST | 49763 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:37.858146906 CEST | 49764 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:37.858175993 CEST | 443 | 49764 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:37.858393908 CEST | 49764 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:37.858433008 CEST | 49763 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:37.858441114 CEST | 443 | 49763 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:37.858746052 CEST | 49764 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:37.858757019 CEST | 443 | 49764 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.561995029 CEST | 443 | 49763 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.562357903 CEST | 49763 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.562424898 CEST | 443 | 49763 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.562845945 CEST | 443 | 49763 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.563127995 CEST | 49763 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.563199997 CEST | 443 | 49763 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.563277006 CEST | 49763 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.563314915 CEST | 49763 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.563328028 CEST | 443 | 49763 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.567193985 CEST | 443 | 49764 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.567658901 CEST | 49764 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.567676067 CEST | 443 | 49764 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.568041086 CEST | 443 | 49764 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.568444967 CEST | 49764 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.568506956 CEST | 443 | 49764 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.568582058 CEST | 49764 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.568608046 CEST | 49764 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.568613052 CEST | 443 | 49764 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.875531912 CEST | 443 | 49763 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.875675917 CEST | 443 | 49763 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.875783920 CEST | 49763 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.878001928 CEST | 49763 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.878036022 CEST | 443 | 49763 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.878586054 CEST | 443 | 49764 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.880561113 CEST | 443 | 49764 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:38.880629063 CEST | 49764 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.900242090 CEST | 49764 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:53:38.900280952 CEST | 443 | 49764 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:53:39.357383013 CEST | 443 | 49761 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:53:39.357553005 CEST | 443 | 49761 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:53:39.357625961 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:53:52.732455015 CEST | 49761 | 443 | 192.168.2.5 | 216.58.206.36 |
| Oct 3, 2024 14:53:52.732487917 CEST | 443 | 49761 | 216.58.206.36 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.158421993 CEST | 49766 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.158478022 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.158580065 CEST | 49766 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.159050941 CEST | 49766 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.159069061 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.283932924 CEST | 49767 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.283981085 CEST | 443 | 49767 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.284244061 CEST | 49767 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.284338951 CEST | 49767 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.284347057 CEST | 443 | 49767 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.800759077 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.801048994 CEST | 49766 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.801073074 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.801435947 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.801809072 CEST | 49766 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.801856995 CEST | 49766 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.801863909 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.801877022 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.801883936 CEST | 49766 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.841808081 CEST | 49766 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.841835976 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.972419977 CEST | 443 | 49767 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.972711086 CEST | 49767 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.972731113 CEST | 443 | 49767 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.973098040 CEST | 443 | 49767 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.973352909 CEST | 49767 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.973414898 CEST | 443 | 49767 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:08.973479033 CEST | 49767 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.973493099 CEST | 49767 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:08.973505020 CEST | 443 | 49767 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:09.146517038 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:09.147166014 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:09.147249937 CEST | 49766 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:09.147599936 CEST | 49766 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:09.147624016 CEST | 443 | 49766 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:09.317229033 CEST | 443 | 49767 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:09.320648909 CEST | 443 | 49767 | 216.58.206.78 | 192.168.2.5 |
| Oct 3, 2024 14:54:09.320720911 CEST | 49767 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:09.321042061 CEST | 49767 | 443 | 192.168.2.5 | 216.58.206.78 |
| Oct 3, 2024 14:54:09.321060896 CEST | 443 | 49767 | 216.58.206.78 | 192.168.2.5 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 3, 2024 14:52:24.374049902 CEST | 52972 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:52:24.374212027 CEST | 51960 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:52:24.380966902 CEST | 53 | 52972 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:24.381748915 CEST | 53 | 51960 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:24.381907940 CEST | 53 | 56068 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:24.390674114 CEST | 53 | 49603 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.667560101 CEST | 50320 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:52:25.667659998 CEST | 55516 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:52:25.717367887 CEST | 53 | 50320 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.717458010 CEST | 53 | 55516 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:25.783895969 CEST | 53 | 55029 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:28.700603008 CEST | 57038 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:52:28.700866938 CEST | 53521 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:52:28.766318083 CEST | 53 | 57038 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:28.766339064 CEST | 53 | 53521 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:29.264312983 CEST | 53 | 63906 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:32.638102055 CEST | 53 | 51703 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:35.482458115 CEST | 57659 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:52:35.482587099 CEST | 57391 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:52:35.489321947 CEST | 53 | 57659 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:35.490958929 CEST | 53 | 57391 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.629177094 CEST | 49939 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:52:36.629359007 CEST | 64027 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:52:36.636300087 CEST | 53 | 64027 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:36.636323929 CEST | 53 | 49939 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:52:42.755108118 CEST | 53 | 54449 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:53:01.710607052 CEST | 53 | 61827 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:53:24.104156017 CEST | 53 | 63925 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:53:24.109838963 CEST | 53 | 62012 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:53:37.589873075 CEST | 53 | 56002 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:53:37.844014883 CEST | 64106 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:53:37.844136953 CEST | 59156 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 3, 2024 14:53:37.857372999 CEST | 53 | 64106 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:53:37.857379913 CEST | 53 | 59156 | 1.1.1.1 | 192.168.2.5 |
| Oct 3, 2024 14:53:52.740502119 CEST | 53 | 53240 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 3, 2024 14:52:24.374049902 CEST | 192.168.2.5 | 1.1.1.1 | 0xfe38 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 14:52:24.374212027 CEST | 192.168.2.5 | 1.1.1.1 | 0x60fa | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 14:52:25.667560101 CEST | 192.168.2.5 | 1.1.1.1 | 0xec9f | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 14:52:25.667659998 CEST | 192.168.2.5 | 1.1.1.1 | 0xd584 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 14:52:28.700603008 CEST | 192.168.2.5 | 1.1.1.1 | 0xd9b6 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 14:52:28.700866938 CEST | 192.168.2.5 | 1.1.1.1 | 0x8ca1 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 14:52:35.482458115 CEST | 192.168.2.5 | 1.1.1.1 | 0xfd93 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 14:52:35.482587099 CEST | 192.168.2.5 | 1.1.1.1 | 0xba8e | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 14:52:36.629177094 CEST | 192.168.2.5 | 1.1.1.1 | 0x9ec5 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 14:52:36.629359007 CEST | 192.168.2.5 | 1.1.1.1 | 0x6cc4 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 14:53:37.844014883 CEST | 192.168.2.5 | 1.1.1.1 | 0x7f7 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 14:53:37.844136953 CEST | 192.168.2.5 | 1.1.1.1 | 0xef28 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 3, 2024 14:52:24.380966902 CEST | 1.1.1.1 | 192.168.2.5 | 0xfe38 | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:24.381748915 CEST | 1.1.1.1 | 192.168.2.5 | 0x60fa | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.185.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.74.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717367887 CEST | 1.1.1.1 | 192.168.2.5 | 0xec9f | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717458010 CEST | 1.1.1.1 | 192.168.2.5 | 0xd584 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:25.717458010 CEST | 1.1.1.1 | 192.168.2.5 | 0xd584 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 14:52:28.766318083 CEST | 1.1.1.1 | 192.168.2.5 | 0xd9b6 | No error (0) | 216.58.206.36 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:28.766339064 CEST | 1.1.1.1 | 192.168.2.5 | 0x8ca1 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 14:52:35.489321947 CEST | 1.1.1.1 | 192.168.2.5 | 0xfd93 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:35.489321947 CEST | 1.1.1.1 | 192.168.2.5 | 0xfd93 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:35.490958929 CEST | 1.1.1.1 | 192.168.2.5 | 0xba8e | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 14:52:36.636323929 CEST | 1.1.1.1 | 192.168.2.5 | 0x9ec5 | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 14:53:37.857372999 CEST | 1.1.1.1 | 192.168.2.5 | 0x7f7 | No error (0) | 216.58.206.78 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49705 | 142.250.186.46 | 443 | 2860 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-03 12:52:25 UTC | 859 | OUT | |
| 2024-10-03 12:52:25 UTC | 1726 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49710 | 172.217.18.14 | 443 | 2860 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-03 12:52:26 UTC | 877 | OUT | |
| 2024-10-03 12:52:26 UTC | 2634 | IN |