Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1525192 |
| MD5: | 5c3cf2541c758d3f50a08a65b6e2abe3 |
| SHA1: | b303df0dfeaf5e9d012f8c8857b1a72fd6530c17 |
| SHA256: | a1e825d314c9c21a051645e9edc8c3311bbae6b12721bfeb868dcad02ddc0411 |
| Tags: | exeuser-Bitsight |
| Infos: | |
 | |
Detection
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sleep loop found (likely to delay execution)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Classification
- System is w10x64
file.exe (PID: 7700 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 5C3CF2541C758D3F50A08A65B6E2ABE3) 
taskkill.exe (PID: 7744 cmdline: taskkill / F /IM chro me.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) 
conhost.exe (PID: 7752 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7872 cmdline:
taskkill / F /IM msed ge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 7904 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 8052 cmdline:
taskkill / F /IM fire fox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 8060 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7344 cmdline:
taskkill / F /IM oper a.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 7380 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 3144 cmdline:
taskkill / F /IM brav e.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 6260 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
chrome.exe (PID: 5940 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://youtu be.com/acc ount?=http s://accoun ts.google. com/v3/sig nin/challe nge/pwd" - -start-ful lscreen -- no-first-r un --disab le-session -crashed-b ubble --di sable-info bars MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - chrome.exe (PID: 7808 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2088 --fi eld-trial- handle=199 6,i,175547 9808646242 6449,32770 3969570564 7036,26214 4 /prefetc h:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - chrome.exe (PID: 9172 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=45 72 --field -trial-han dle=1996,i ,175547980 8646242644 9,32770396 9570564703 6,262144 / prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - chrome.exe (PID: 9180 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=4528 --f ield-trial -handle=19 96,i,17554 7980864624 26449,3277 0396957056 47036,2621 44 /prefet ch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 1_2_00BBDBBE | |
| Source: | Code function: | 1_2_00B8C2A2 | |
| Source: | Code function: | 1_2_00BC68EE | |
| Source: | Code function: | 1_2_00BC698F | |
| Source: | Code function: | 1_2_00BBD076 | |
| Source: | Code function: | 1_2_00BBD3A9 | |
| Source: | Code function: | 1_2_00BC9642 | |
| Source: | Code function: | 1_2_00BC979D | |
| Source: | Code function: | 1_2_00BC9B2B | |
| Source: | Code function: | 1_2_00BC5C97 | |
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 1_2_00BCCE44 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 1_2_00BCEAFF | |
| Source: | Code function: | 1_2_00BCED6A | |
| Source: | Code function: | 1_2_00BCEAFF | |
| Source: | Code function: | 1_2_00BBAA57 | |
| Source: | Code function: | 1_2_00BE9576 | |
System Summary | |
|---|
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | memstr_d5d79bc2-2 | |
| Source: | String found in binary or memory: | memstr_0d9a6f08-0 | |
| Source: | String found in binary or memory: | memstr_a8426fee-4 | |
| Source: | String found in binary or memory: | memstr_5a1c6089-7 | |
| Source: | Code function: | 1_2_00BBD5EB | |
| Source: | Code function: | 1_2_00BB1201 | |
| Source: | Code function: | 1_2_00BBE8F6 | |
| Source: | Code function: | 1_2_00B58060 | |
| Source: | Code function: | 1_2_00BC2046 | |
| Source: | Code function: | 1_2_00BB8298 | |
| Source: | Code function: | 1_2_00B8E4FF | |
| Source: | Code function: | 1_2_00B8676B | |
| Source: | Code function: | 1_2_00BE4873 | |
| Source: | Code function: | 1_2_00B7CAA0 | |
| Source: | Code function: | 1_2_00B5CAF0 | |
| Source: | Code function: | 1_2_00B6CC39 | |
| Source: | Code function: | 1_2_00B86DD9 | |
| Source: | Code function: | 1_2_00B591C0 | |
| Source: | Code function: | 1_2_00B6B119 | |
| Source: | Code function: | 1_2_00B71394 | |
| Source: | Code function: | 1_2_00B71706 | |
| Source: | Code function: | 1_2_00B7781B | |
| Source: | Code function: | 1_2_00B719B0 | |
| Source: | Code function: | 1_2_00B57920 | |
| Source: | Code function: | 1_2_00B6997D | |
| Source: | Code function: | 1_2_00B77A4A | |
| Source: | Code function: | 1_2_00B77CA7 | |
| Source: | Code function: | 1_2_00B71C77 | |
| Source: | Code function: | 1_2_00B89EEE | |
| Source: | Code function: | 1_2_00BDBE44 | |
| Source: | Code function: | 1_2_00B71F32 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 1_2_00BC37B5 | |
| Source: | Code function: | 1_2_00BB10BF | |
| Source: | Code function: | 1_2_00BB16C3 | |
| Source: | Code function: | 1_2_00BC51CD | |
| Source: | Code function: | 1_2_00BDA67C | |
| Source: | Code function: | 1_2_00BC648E | |
| Source: | Code function: | 1_2_00B542A2 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 1_2_00B542DE | |
| Source: | Code function: | 1_2_00B70A89 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 1_2_00B6F98E | |
| Source: | Code function: | 1_2_00BE1C41 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_1-97180 | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | API coverage: | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Code function: | 1_2_00BBDBBE | |
| Source: | Code function: | 1_2_00B8C2A2 | |
| Source: | Code function: | 1_2_00BC68EE | |
| Source: | Code function: | 1_2_00BC698F | |
| Source: | Code function: | 1_2_00BBD076 | |
| Source: | Code function: | 1_2_00BBD3A9 | |
| Source: | Code function: | 1_2_00BC9642 | |
| Source: | Code function: | 1_2_00BC979D | |
| Source: | Code function: | 1_2_00BC9B2B | |
| Source: | Code function: | 1_2_00BC5C97 | |
| Source: | Code function: | 1_2_00B542DE | |
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 1_2_00BCEAA2 | |
| Source: | Code function: | 1_2_00B82622 | |
| Source: | Code function: | 1_2_00B542DE | |
| Source: | Code function: | 1_2_00B74CE8 | |
| Source: | Code function: | 1_2_00BB0B62 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 1_2_00B82622 | |
| Source: | Code function: | 1_2_00B7083F | |
| Source: | Code function: | 1_2_00B709D5 | |
| Source: | Code function: | 1_2_00B70C21 | |
| Source: | Code function: | 1_2_00BB1201 | |
| Source: | Code function: | 1_2_00B92BA5 | |
| Source: | Code function: | 1_2_00BBB226 | |
| Source: | Code function: | 1_2_00BD22DA | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 1_2_00BB0B62 | |
| Source: | Code function: | 1_2_00BB1663 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 1_2_00B70698 | |
| Source: | Code function: | 1_2_00BC8195 | |
| Source: | Code function: | 1_2_00BAD27A | |
| Source: | Code function: | 1_2_00B8B952 | |
| Source: | Code function: | 1_2_00B542DE | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 1_2_00BD1204 | |
| Source: | Code function: | 1_2_00BD1806 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 2 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | 2 Valid Accounts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 21 Input Capture | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | 2 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | 3 Clipboard Data | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 16 System Information Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 1 Masquerading | LSA Secrets | 12 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 1 Registry Run Keys / Startup Folder | 2 Valid Accounts | Cached Domain Credentials | 12 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 12 Virtualization/Sandbox Evasion | DCSync | 3 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 21 Access Token Manipulation | Proc Filesystem | 11 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 2 Process Injection | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 13% | ReversingLabs | |||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| youtube-ui.l.google.com | 142.250.181.238 | true | false | unknown | |
| www3.l.google.com | 142.250.185.174 | true | false | unknown | |
| play.google.com | 142.250.186.142 | true | false | unknown | |
| www.google.com | 216.58.212.132 | true | false | unknown | |
| youtube.com | 172.217.16.206 | true | false | unknown | |
| accounts.youtube.com | unknown | unknown | false | unknown | |
| www.youtube.com | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 216.58.212.132 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.16.206 | youtube.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.110 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.250.181.238 | youtube-ui.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 142.250.185.174 | www3.l.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.142 | play.google.com | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.10 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1525192 |
| Start date and time: | 2024-10-03 20:45:11 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 20s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 29 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal64.evad.winEXE@54/36@12/8 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 142.250.185.227, 142.250.186.110, 64.233.184.84, 34.104.35.123, 216.58.212.170, 216.58.212.138, 142.250.184.234, 142.250.185.202, 142.250.185.170, 142.250.184.202, 142.250.186.170, 172.217.16.138, 142.250.181.234, 142.250.185.74, 142.250.186.42, 142.250.185.106, 172.217.18.10, 142.250.185.138, 216.58.206.42, 142.250.185.234, 142.250.185.163, 142.250.181.227, 142.250.186.106, 172.217.16.202, 142.250.186.138, 142.250.186.74, 199.232.214.172, 216.58.212.163, 142.250.110.84, 142.250.185.142
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
- Not all processes where analyzed, report is missing behavior information
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: file.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | HtmlDropper | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Credential Flusher | Browse | |||
| Get hash | malicious | Phisher | Browse | |||
| Get hash | malicious | HtmlDropper, HTMLPhisher | Browse | |||
| Get hash | malicious | Phisher | Browse | |||
| Get hash | malicious | Credential Flusher | Browse |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HtmlDropper | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
| ||
| Get hash | malicious | Phisher | Browse |
| ||
| Get hash | malicious | HtmlDropper, HTMLPhisher | Browse |
| ||
| Get hash | malicious | Phisher | Browse |
| ||
| Get hash | malicious | Credential Flusher | Browse |
|
⊘No context
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2673 |
| Entropy (8bit): | 3.987535977351098 |
| Encrypted: | false |
| SSDEEP: | 48:8YDbdbTcvHHidAKZdA1uehwiZUklqeh1y+3:8YdQKyy |
| MD5: | AA5E5FD4A998E103268F7415800CF8BA |
| SHA1: | 5255B0635A5B0336F16969EEDDE280B4B3D680BA |
| SHA-256: | E4FA3C3A66A726CF28C155B3A798224E089987E4D0BF122CA684299964C5FD22 |
| SHA-512: | F79245240C5DC7D5D6E391AD19D0CC11BEEA580ECECC446F5399D48E93C22E2070825FE802C814ED237EEA5EFDEBA185C5836D4DF7F6AFA131DAA32F859C3634 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2675 |
| Entropy (8bit): | 4.0041069569096495 |
| Encrypted: | false |
| SSDEEP: | 48:8TDbdbTcvHHidAKZdA1Heh/iZUkAQkqehiy+2:8TdQU9Qvy |
| MD5: | A73541B63CA178AEC5BC65E9D9D723CC |
| SHA1: | FBBF39310DF4935187EED8B815202216A1854537 |
| SHA-256: | 3171F25EE16779DB43B5F6225F7C56E3EF6D3A920647DA96E6A0B244CAF12C2F |
| SHA-512: | 57A5DF958516E208292B3544EA0D6CC2CA072B4FE9716C2E1177E0F20EE8DF2616868595F11A403005DEB9851659A8237311964EC2396158534AEE7A886C5C4D |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2689 |
| Entropy (8bit): | 4.012145309858374 |
| Encrypted: | false |
| SSDEEP: | 48:8FDbdbTcbHHidAKZdA149eh7sFiZUkmgqeh7s8y+BX:8FdQ8ney |
| MD5: | 5F541EC07521AE747EB7422B2138C842 |
| SHA1: | 376435C1C2F857873305E2120B28ABB2CC797EB0 |
| SHA-256: | 81348125E8CF6DB31AA45B408C70735F0B46A4BF10F41C55B99731D2D0D9AE20 |
| SHA-512: | 95DE3D37F4B4ECBE48564BA2B2EB7574C9CC7840F061B4AA9360F66D0BDC6EEB8FE6E2911D0779849432E3B8124619DEB396820098B734CC39465A4489D77FBE |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.999296762938444 |
| Encrypted: | false |
| SSDEEP: | 48:86DbdbTcvHHidAKZdA14ehDiZUkwqehWy+R:86dQPUy |
| MD5: | AEB0B5DC5632C3C242AD9D2562B5086A |
| SHA1: | 618D749FE7379BDF56D42FDCFFDECB4520E803B8 |
| SHA-256: | CB36EF48BAEEB945E41A05C89E31A7E87E512DC94177CDC7DED494CA7544EC6F |
| SHA-512: | 33FB5B591960327AF69F787FBA3C079FDBF446616A08B24DFA3DEE7A7CBD33F79885CF632B761E606B642E03537A48F07C70742C243643660CA81A3A599BBF20 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.990217420759994 |
| Encrypted: | false |
| SSDEEP: | 48:8RDbdbTcvHHidAKZdA1mehBiZUk1W1qehYy+C:8RdQf94y |
| MD5: | D4BF2FA9E7AF458156ED360B160F91C2 |
| SHA1: | A01A6A213E410154045E6B763D4D701D49B96666 |
| SHA-256: | CEE5F9D3EE148866766C5E6E000DEBDE48958B8B19EF6BDD6BF3E0E7081D4B76 |
| SHA-512: | F84FF48F938B047EE399AC5973E943A39AB9110BEA75F186A26C067ACA8193EAC468FE177AF388D0FEDEA8F94811B7CA7FEA1DB3F5B92D0B71E8183F909A72CE |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.9986038934401766 |
| Encrypted: | false |
| SSDEEP: | 48:8FDbdbTcvHHidAKZdA1duT1ehOuTbbiZUk5OjqehOuTbey+yT+:8FdQ+TyTbxWOvTbey7T |
| MD5: | C9BF81369D028728674C085752B511DE |
| SHA1: | 6BE83A71F4527B75620EEBCE9992BEE12ADB57A1 |
| SHA-256: | C3D6E7B6393C89E82C5977CFBE853657D45B9DD63E657C5D843D80BB6A43CD84 |
| SHA-512: | EC0DD720520F581AE538DF147A02842ECB1062BB11BEA231CF0E6A11FCCEB6498AE16F5670560E9D2BBEFC8FDB50ABFF6D53ED847C7E80D1E28F26D935CA9878 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 84 |
| Entropy (8bit): | 4.875266466142591 |
| Encrypted: | false |
| SSDEEP: | 3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ |
| MD5: | 87B6333E98B7620EA1FF98D1A837A39E |
| SHA1: | 105DE6815B0885357DE1414BFC0D77FCC9E924EF |
| SHA-256: | DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA |
| SHA-512: | 867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994 |
| Malicious: | false |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5050 |
| Entropy (8bit): | 5.30005628600801 |
| Encrypted: | false |
| SSDEEP: | 96:o75BuBxJfma7bGZABddEgf8nI4zLm4KGo8Vh1EabPVTq8fv/xRw:WHMmaX9r8Igp7nBlHo |
| MD5: | D9F15F1AEAF15673336FAA3507D1A2A7 |
| SHA1: | FC79D00AF2E2D44FEBA701F12ECD4AFCA327F464 |
| SHA-256: | AA3574ADCF3826390918BC2D5DCD88D7BC63238A6022DEF3487A67A731C30E7A |
| SHA-512: | D756961B6BFC478274E390B94D613BD837DA011D680FC6D67779A8E12C7F082EF977FC15D02C076F92BC1D2CE7EFDE48F82B4EC1BD12CF38AEDDAB1917E36041 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 698852 |
| Entropy (8bit): | 5.594980353163612 |
| Encrypted: | false |
| SSDEEP: | 6144:TN3KfgnkxgOYoRvEoQvSXwojVlmGa/ZLJiH7ZkvgTa5PB1+UO5Hx+B8U2+:TUMkxgOENagFxJiyU+ |
| MD5: | AA9FDCBE29C6D043DC83A7DAD848CCC3 |
| SHA1: | E3F0A387A0A4B060620C975E1C70AA20294F3F22 |
| SHA-256: | 1A624C24D6D712C633F0B034606610DAD6B5AD7890FBFA3A9B204BD33207D60E |
| SHA-512: | C93878CE1281349204ABDB4444B18A12C03A010D1A252827EBFE45523E834988CE95D6E625FF82A60934D7A275AD8DAAC689E4412C5719ACCA8C9E1D4365B4D3 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3467 |
| Entropy (8bit): | 5.508385764606741 |
| Encrypted: | false |
| SSDEEP: | 96:ogbsxK3SrI2Jrutmxy9FALtcP+EGYkxhclzV9xCw:Psc3OIpDj2ZYkxhATxX |
| MD5: | 231ABD6E6C360E709640B399EDF85476 |
| SHA1: | 6CB98F38D9B6FDCF2E7D7C7682A219082F2E1E75 |
| SHA-256: | 44B5D535663C65CD2E6228EF1F0C3DBA9C89EAE5C1BF079A6C4C64972DEE989D |
| SHA-512: | D45455810B34493A05BA2DD7ADF24C0C009F4CF0898AE9C57978D38C8F2654CEEFC11D1C151BA72B902E0FA87537D43C37957DCAEC1792B5277B54C8E7BCCA3C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9210 |
| Entropy (8bit): | 5.393248075042016 |
| Encrypted: | false |
| SSDEEP: | 192:t7mFYxV97I4Ia0U44rS3mt8IV7ydti6M5/1JlNg:t7vB7Il2t+dEF1JlNg |
| MD5: | 2ED5BC88509286438B682EFF23518005 |
| SHA1: | D5C8FD77BA3ED7F977A4AD0C85CF026D0F74F3E2 |
| SHA-256: | F878D44B5CAC6BC95D638C13D0814C10E7D6CC145351ABA7945F53D8CB167979 |
| SHA-512: | 12F5415A482286C53631D09B5F50BA4AAA0957DB61904430E5B728777A15DC62428ED560847AB1DFEC459E302FB4D009D32CC1770EAD5425023CA48DF4640AA4 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1858 |
| Entropy (8bit): | 5.297658905867848 |
| Encrypted: | false |
| SSDEEP: | 48:o7vjoGL3AeFkphnpiu7cOyBfO/3d/rYrv3Zrw:ofrLxFuLdyp2AVw |
| MD5: | B42DB3D22B12B8E3BE1B82961FE2870E |
| SHA1: | D9CFD11C1C2DE17A7E9301F11AD875B610B96576 |
| SHA-256: | 75DC40A81CEACB57940F84D2B29E021974C3004B245CC7198362CA944E9C4058 |
| SHA-512: | EC0708797586F8F85EC8A0BBECA707D73778D93C12986B92965D1828B254D39485926354AEC4D73474BC5755E392B813D8045B19369FAE23B30BBD12E17F7053 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5430 |
| Entropy (8bit): | 3.6534652184263736 |
| Encrypted: | false |
| SSDEEP: | 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B |
| MD5: | F3418A443E7D841097C714D69EC4BCB8 |
| SHA1: | 49263695F6B0CDD72F45CF1B775E660FDC36C606 |
| SHA-256: | 6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770 |
| SHA-512: | 82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563 |
| Malicious: | false |
| URL: | https://www.google.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 32500 |
| Entropy (8bit): | 5.378121087555083 |
| Encrypted: | false |
| SSDEEP: | 768:OnTTScxIXeijt4aRZf4AEqTzQh2HIVVcYTVf79pew6cVEkAXtuWsmsL:iA4w4A4h2HIVVcMVf72QA9jOL |
| MD5: | 57D7B0A2CE36496F05AFA27B39C1F219 |
| SHA1: | 418AD03C2E75AEAF188E2A00123B70E09D541656 |
| SHA-256: | E247A1F5E564A248C92E39C040A06B9B3BEA50A130CC98F2787FB5E2441E0707 |
| SHA-512: | 78B135A69424F951AC7E3CCBDC4F496BCA0BE6A2312DC90DFA29032C7DB19455B7E35FEE57F470729EC5E86D52DC19037BB6404C27DF614A548DE409527866C2 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 52280 |
| Entropy (8bit): | 7.995413196679271 |
| Encrypted: | true |
| SSDEEP: | 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d |
| MD5: | F61F0D4D0F968D5BBA39A84C76277E1A |
| SHA1: | AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2 |
| SHA-256: | 57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC |
| SHA-512: | 6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487 |
| Malicious: | false |
| URL: | https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1460 |
| Entropy (8bit): | 5.274624539239422 |
| Encrypted: | false |
| SSDEEP: | 24:kMYD7DUuXIqMSsN7UYgtx/mQ7hz1BU6TZ6BdXDMvUKGbWxlGb+jSFFV87Ofk8tp8:o7DhXI6PoXwsKGb2lGb+jS9Mwrw |
| MD5: | 481C149C4D3EE4A53C3E7CBA067371DF |
| SHA1: | E0FED275636D3492C922C44F010157FAF0936733 |
| SHA-256: | 9327A53F577C5FCEFDB162E02D8646CE5B70DF2201F4B3289384657B32BACE70 |
| SHA-512: | EC5C5A03ED4E1A27BEE7E1C488A238D79A9787D944E364CCE516FB28C22256919E49C99BFCFEA0F7815AB4232A350914E26D33D20F5A81ED19A39DFD40E30C79 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 23298 |
| Entropy (8bit): | 5.429186219736739 |
| Encrypted: | false |
| SSDEEP: | 384:+BitNeB9HVPQmqySWyvbbb/XEm6k1JTM2qzhOF0bCjOgiQBH2f+wl9nyf0zHwx:+BiHeB9Hecebbb/PONOFnjOgPBHgSywx |
| MD5: | A5C41D7BA22E9CF451810802AE5AC2E8 |
| SHA1: | 858F35134A0BD7BAECB1B1A30EC3645642214554 |
| SHA-256: | D29364A1E9EDE91152F2CB84962B73644741817C9C6A615C1FB70A885DD1CB8D |
| SHA-512: | DEA28AD362B51832D33CD9E936C0A255FA32C20DFFC6E806DA7AAF657D3490AF079C40FE21E10B2FDC971EB066E51ABDA182DEDC156759CCE06440E456FEB316 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3131 |
| Entropy (8bit): | 5.352056237104327 |
| Encrypted: | false |
| SSDEEP: | 48:o7hHD75byh9xqKP5jNQ8js63rAwrMNhYfmdpwoKLEy5aQW5Tx5v3MmFopMGIWO4x:oFD+95jOQr3AT7wRLDGD5flBb4Ew |
| MD5: | ADEF03127F74F5E6742B8CFA7B863F28 |
| SHA1: | 58D7C635582AF10E91EC047FD315FAF758AF51DA |
| SHA-256: | 5FDD639E222F58AEB6178EB02583086BCC50ED219DEAA953D0E7984DD0E1FEDC |
| SHA-512: | 3AC26E9569EE83298F386D551774F378D3E433A2C80C1D4BC7481C544605A2FA4943F6CBC8E97FBF8FE3C32C1EFB2A1CCAA01403819482FC7429538FDF2CA758 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1608 |
| Entropy (8bit): | 5.271783084011668 |
| Encrypted: | false |
| SSDEEP: | 48:o726BiFP89yAxKz1TtMxII+eXww7D2bc+rw:oyMyAAz1WNd8vw |
| MD5: | 45EA91A811A594F81B7F760DD14BE237 |
| SHA1: | 2C97782C6D5D0BCFB3676FF24AA1008251090DAE |
| SHA-256: | 7488FF4710E7592F66BE1FAC090F73CB8F1D2D0794B57DEAC1798C5B309EE76F |
| SHA-512: | 4F79A36857D5A8AF1E2F938EF92EA75C384DE4789972B068BE82EADAA442C538A65035CCE8665A7283137E2075B8FE4C1C9E7B2A36585491683B4869005B772A |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 744742 |
| Entropy (8bit): | 5.792853825531523 |
| Encrypted: | false |
| SSDEEP: | 6144:x5bdWK/20rOQKKQtvqUGSGDdPSxdZqmguPH:pOeKGSpgu/ |
| MD5: | D6A4595EF381156A4C38FC1268C40783 |
| SHA1: | 75B2E4139EE5014416D280B02E1F57724B0A4240 |
| SHA-256: | 9E6266EF7F49A5256F373AB78F9D0AE688CA964F542892F5FF0563F05AC6C676 |
| SHA-512: | ACC3385A52ABFA53EE68286C86F2266C2BE7D12350F31AEFD91052616CF417207E5F27A31FEC5FB4B5DDA705C599DD0B724ACA88E9FF682289C3B473902CD79C |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEEvjRYpfMDihaNwG0swUsVgVpBIg/m=_b,_tp" |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4067 |
| Entropy (8bit): | 5.3700036060139436 |
| Encrypted: | false |
| SSDEEP: | 96:G6mTOIiY1medWRQrf7VF6vtDgXJyA7oxcoTiw:3mTOImedWOVF6vtUJyA8xJ3 |
| MD5: | FA701F5D7BEF5AF6B676F099A00A1140 |
| SHA1: | 4CA8594D1E845605E7F1242AD8E10FD3A41FA3BE |
| SHA-256: | F1F311E29B597B507EE761AE40185A9BE194BA6498F91DD2A69610EF765B554A |
| SHA-512: | D53CAD789CED1F1D05546CD9DDA662FF47DF4A9FE382F4936EB1579175B06A95770426E5A83C24EACE04014956F1971A6432D1FCB26F2A9E4B922D8A34FC9875 |
| Malicious: | false |
| URL: | "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe" |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.5838209335694176 |
| TrID: |
|
| File name: | file.exe |
| File size: | 919'040 bytes |
| MD5: | 5c3cf2541c758d3f50a08a65b6e2abe3 |
| SHA1: | b303df0dfeaf5e9d012f8c8857b1a72fd6530c17 |
| SHA256: | a1e825d314c9c21a051645e9edc8c3311bbae6b12721bfeb868dcad02ddc0411 |
| SHA512: | 36dfc45366af94b0462c5cb4463ce5d6feff6984f333161b22e1235ce369e9dd049d009f44259aa18bb3531e7527f25278df23bc69b564b8fb085ff2d67a9668 |
| SSDEEP: | 24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8a4yK:mTvC/MTQYxsWR7a4 |
| TLSH: | 83159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z.... |
 | |
| Icon Hash: | aaf3e3e3938382a0 |
| Entrypoint: | 0x420577 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66FEE180 [Thu Oct 3 18:25:04 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 948cc502fe9226992dce9417f952fce3 |
| Instruction |
|---|
| call 00007F5F8C4E7CD3h |
| jmp 00007F5F8C4E75DFh |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F5F8C4E77BDh |
| mov dword ptr [esi], 0049FDF0h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FDF8h |
| mov dword ptr [ecx], 0049FDF0h |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007F5F8C4E778Ah |
| mov dword ptr [esi], 0049FE0Ch |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 0049FE14h |
| mov dword ptr [ecx], 0049FE0Ch |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| and dword ptr [eax], 00000000h |
| and dword ptr [eax+04h], 00000000h |
| push eax |
| mov eax, dword ptr [ebp+08h] |
| add eax, 04h |
| push eax |
| call 00007F5F8C4EA37Dh |
| pop ecx |
| pop ecx |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 0049FDD0h |
| push eax |
| call 00007F5F8C4EA3C8h |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| mov esi, ecx |
| lea eax, dword ptr [esi+04h] |
| mov dword ptr [esi], 0049FDD0h |
| push eax |
| call 00007F5F8C4EA3B1h |
| test byte ptr [ebp+08h], 00000001h |
| pop ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc8e64 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xd4000 | 0x9bb8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xde000 | 0x7594 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xb0ff0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xc3400 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xb1010 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9c000 | 0x894 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x9ab1d | 0x9ac00 | 0a1473f3064dcbc32ef93c5c8a90f3a6 | False | 0.565500681542811 | data | 6.668273581389308 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x9c000 | 0x2fb82 | 0x2fc00 | c9cf2468b60bf4f80f136ed54b3989fb | False | 0.35289185209424084 | data | 5.691811547483722 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xcc000 | 0x706c | 0x4800 | 53b9025d545d65e23295e30afdbd16d9 | False | 0.04356553819444445 | DOS executable (block device driver @\273\) | 0.5846666986982398 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0xd4000 | 0x9bb8 | 0x9c00 | 6b5b614fe4cf4d889636b2c7148dfd42 | False | 0.31665665064102566 | data | 5.3328567430866265 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xde000 | 0x7594 | 0x7600 | c68ee8931a32d45eb82dc450ee40efc3 | False | 0.7628111758474576 | data | 6.7972128181359786 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xd45a8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
| RT_ICON | 0xd46d0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
| RT_ICON | 0xd47f8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
| RT_ICON | 0xd4920 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 0 | English | Great Britain | 0.3333333333333333 |
| RT_ICON | 0xd4c08 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 0 | English | Great Britain | 0.5 |
| RT_ICON | 0xd4d30 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | English | Great Britain | 0.2835820895522388 |
| RT_ICON | 0xd5bd8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | English | Great Britain | 0.37906137184115524 |
| RT_ICON | 0xd6480 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | English | Great Britain | 0.23699421965317918 |
| RT_ICON | 0xd69e8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | English | Great Britain | 0.13858921161825727 |
| RT_ICON | 0xd8f90 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | English | Great Britain | 0.25070356472795496 |
| RT_ICON | 0xda038 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | English | Great Britain | 0.3173758865248227 |
| RT_MENU | 0xda4a0 | 0x50 | data | English | Great Britain | 0.9 |
| RT_STRING | 0xda4f0 | 0x594 | data | English | Great Britain | 0.3333333333333333 |
| RT_STRING | 0xdaa84 | 0x68a | data | English | Great Britain | 0.2735961768219833 |
| RT_STRING | 0xdb110 | 0x490 | data | English | Great Britain | 0.3715753424657534 |
| RT_STRING | 0xdb5a0 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
| RT_STRING | 0xdbb9c | 0x65c | data | English | Great Britain | 0.34336609336609336 |
| RT_STRING | 0xdc1f8 | 0x466 | data | English | Great Britain | 0.3605683836589698 |
| RT_STRING | 0xdc660 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | Great Britain | 0.502906976744186 |
| RT_RCDATA | 0xdc7b8 | 0xe7e | data | 1.002964959568733 | ||
| RT_GROUP_ICON | 0xdd638 | 0x76 | data | English | Great Britain | 0.6610169491525424 |
| RT_GROUP_ICON | 0xdd6b0 | 0x14 | data | English | Great Britain | 1.25 |
| RT_GROUP_ICON | 0xdd6c4 | 0x14 | data | English | Great Britain | 1.15 |
| RT_GROUP_ICON | 0xdd6d8 | 0x14 | data | English | Great Britain | 1.25 |
| RT_VERSION | 0xdd6ec | 0xdc | data | English | Great Britain | 0.6181818181818182 |
| RT_MANIFEST | 0xdd7c8 | 0x3ef | ASCII text, with CRLF line terminators | English | Great Britain | 0.5074478649453823 |
| DLL | Import |
|---|---|
| WSOCK32.dll | gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect |
| VERSION.dll | GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW |
| WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
| COMCTL32.dll | ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create |
| MPR.dll | WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W |
| WININET.dll | HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable |
| PSAPI.DLL | GetProcessMemoryInfo |
| IPHLPAPI.DLL | IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile |
| USERENV.dll | DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile |
| UxTheme.dll | IsThemeActive |
| KERNEL32.dll | DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW |
| USER32.dll | GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient |
| GDI32.dll | EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath |
| COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
| ADVAPI32.dll | GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW |
| SHELL32.dll | DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket |
| OLEAUT32.dll | CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 3, 2024 20:45:58.836965084 CEST | 49674 | 443 | 192.168.2.10 | 173.222.162.55 |
| Oct 3, 2024 20:45:58.836966991 CEST | 49675 | 443 | 192.168.2.10 | 173.222.162.55 |
| Oct 3, 2024 20:45:58.946213007 CEST | 49671 | 443 | 192.168.2.10 | 204.79.197.203 |
| Oct 3, 2024 20:46:02.681262016 CEST | 49677 | 443 | 192.168.2.10 | 20.42.65.85 |
| Oct 3, 2024 20:46:02.993211031 CEST | 49677 | 443 | 192.168.2.10 | 20.42.65.85 |
| Oct 3, 2024 20:46:03.602405071 CEST | 49677 | 443 | 192.168.2.10 | 20.42.65.85 |
| Oct 3, 2024 20:46:03.759208918 CEST | 49671 | 443 | 192.168.2.10 | 204.79.197.203 |
| Oct 3, 2024 20:46:04.805723906 CEST | 49677 | 443 | 192.168.2.10 | 20.42.65.85 |
| Oct 3, 2024 20:46:06.630095005 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:06.630131960 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:06.630192041 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:06.631306887 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:06.631323099 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.226198912 CEST | 49677 | 443 | 192.168.2.10 | 20.42.65.85 |
| Oct 3, 2024 20:46:07.267770052 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.273844957 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:07.273865938 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.274523020 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.274588108 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:07.276068926 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.276120901 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:07.281240940 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:07.281397104 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.281862020 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:07.281872034 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.335692883 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:07.551480055 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.551594973 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.551661015 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:07.554804087 CEST | 49707 | 443 | 192.168.2.10 | 172.217.16.206 |
| Oct 3, 2024 20:46:07.554826975 CEST | 443 | 49707 | 172.217.16.206 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.566174030 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:07.566222906 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.566392899 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:07.566874027 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:07.566885948 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:08.211277008 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:08.211930037 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:08.211941004 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:08.212492943 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:08.212749004 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:08.213490009 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:08.214023113 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:08.214606047 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:08.214694023 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:08.215111017 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:08.215123892 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:08.257328987 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:08.444866896 CEST | 49674 | 443 | 192.168.2.10 | 173.222.162.55 |
| Oct 3, 2024 20:46:08.444883108 CEST | 49675 | 443 | 192.168.2.10 | 173.222.162.55 |
| Oct 3, 2024 20:46:08.516041040 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:08.516138077 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:08.516227007 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:08.516227007 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:08.519798994 CEST | 49712 | 443 | 192.168.2.10 | 142.250.181.238 |
| Oct 3, 2024 20:46:08.519817114 CEST | 443 | 49712 | 142.250.181.238 | 192.168.2.10 |
| Oct 3, 2024 20:46:10.847899914 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:10.847951889 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:10.848236084 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:10.848788023 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:10.848803997 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.155654907 CEST | 49719 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:11.155685902 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.155774117 CEST | 49719 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:11.157493114 CEST | 49719 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:11.157506943 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.513955116 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.514552116 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:11.514570951 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.515655994 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.515794039 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:11.517050982 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:11.517180920 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.570071936 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:11.570086002 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.616818905 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:11.803991079 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.804178953 CEST | 49719 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:11.825397968 CEST | 49719 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:11.825417042 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.826347113 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.866820097 CEST | 49719 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:12.038599968 CEST | 49677 | 443 | 192.168.2.10 | 20.42.65.85 |
| Oct 3, 2024 20:46:12.139704943 CEST | 49719 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:12.187407017 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:12.324780941 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:12.324937105 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:12.325192928 CEST | 49719 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:12.325938940 CEST | 49719 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:12.325938940 CEST | 49719 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:12.325957060 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:12.325965881 CEST | 443 | 49719 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:12.380990028 CEST | 49723 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:12.381026983 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:12.381122112 CEST | 49723 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:12.382626057 CEST | 49723 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:12.382642031 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:13.040138960 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:13.040214062 CEST | 49723 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:13.073050976 CEST | 49723 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:13.073065042 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:13.073291063 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:13.074454069 CEST | 49723 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:13.119390965 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:13.320449114 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:13.320516109 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:13.320573092 CEST | 49723 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:13.357431889 CEST | 49723 | 443 | 192.168.2.10 | 184.28.90.27 |
| Oct 3, 2024 20:46:13.357458115 CEST | 443 | 49723 | 184.28.90.27 | 192.168.2.10 |
| Oct 3, 2024 20:46:13.367449999 CEST | 49671 | 443 | 192.168.2.10 | 204.79.197.203 |
| Oct 3, 2024 20:46:15.984847069 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:15.984889030 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:15.984965086 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:15.985260963 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:15.985272884 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.616337061 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.616647959 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.616677999 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.617074966 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.617142916 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.617815971 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.617871046 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.619966984 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.620090008 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.620284081 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.620295048 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.663635015 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.940498114 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.940551996 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.940627098 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.940646887 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.941255093 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.942182064 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.942219973 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.943718910 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.943762064 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.948970079 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.949033022 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.949096918 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.949135065 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.955416918 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.955480099 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.961659908 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.961719990 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.961719990 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:16.961739063 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:16.961992979 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.023425102 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.023497105 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.023523092 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.023566961 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.026093960 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.026176929 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.033309937 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.033363104 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.033453941 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.033463001 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.033499956 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.038902044 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.038948059 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.044781923 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.044830084 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.044931889 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.051201105 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.051285028 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.051295042 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.057792902 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.057871103 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.057879925 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.057950974 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.058017969 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.058568001 CEST | 49737 | 443 | 192.168.2.10 | 142.250.185.174 |
| Oct 3, 2024 20:46:17.058582067 CEST | 443 | 49737 | 142.250.185.174 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.155529022 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.155572891 CEST | 443 | 49740 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.155790091 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.156342030 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.156358004 CEST | 443 | 49740 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.221355915 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.221404076 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.221616983 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.222001076 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.222012043 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.812254906 CEST | 443 | 49740 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.812541962 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.812561035 CEST | 443 | 49740 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.812922001 CEST | 443 | 49740 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.813007116 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.813625097 CEST | 443 | 49740 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.813740015 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.814790010 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.814857006 CEST | 443 | 49740 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.815048933 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.815059900 CEST | 443 | 49740 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.859353065 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.859561920 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.859596968 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.859993935 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.860048056 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.860696077 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.860867977 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.860877037 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.861339092 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.861433983 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.861716986 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.861731052 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.868793964 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:17.901632071 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.114192009 CEST | 443 | 49740 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.114768982 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.114811897 CEST | 443 | 49740 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.114887953 CEST | 49740 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.115766048 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.115793943 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.115859032 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.116530895 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.116542101 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.162758112 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.162962914 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.163101912 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.163543940 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.163564920 CEST | 443 | 49741 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.163578033 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.163610935 CEST | 49741 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.165190935 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.165226936 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.165281057 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.166491032 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.166506052 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.754846096 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.755224943 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.755233049 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.755600929 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.755748034 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.756294012 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.756453037 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.756581068 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.756627083 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.756792068 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.756798029 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.756975889 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.799392939 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.804864883 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.823931932 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.824167013 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.824176073 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.824511051 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.824565887 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.825198889 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.825244904 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.825360060 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.825402021 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.825470924 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.825478077 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.825491905 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.867846012 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.867876053 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.973680019 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.973805904 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:18.973906994 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.975017071 CEST | 49745 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:18.975038052 CEST | 443 | 49745 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.032291889 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:19.032335043 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.032409906 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:19.033566952 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:19.033580065 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.045773029 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.046392918 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.046446085 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:19.047499895 CEST | 49747 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:19.047519922 CEST | 443 | 49747 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.073519945 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:19.119407892 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.347218037 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.347338915 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.347425938 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:19.347449064 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.347522974 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.347640038 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.347666979 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:19.347672939 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.348823071 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.348886013 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:19.465348005 CEST | 49717 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:46:19.465390921 CEST | 443 | 49717 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.797801018 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.797874928 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:19.801048040 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:19.801058054 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.801310062 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:19.851761103 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:20.444035053 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:20.487402916 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:20.696322918 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:20.696348906 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:20.696357012 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:20.696369886 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:20.696400881 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:20.696429014 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:20.696444988 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:20.696480989 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:20.696485043 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:20.696502924 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:20.696537018 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:20.696949005 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:20.697000980 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:20.697041035 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:21.195745945 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:21.195745945 CEST | 49749 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:21.195782900 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:21.195797920 CEST | 443 | 49749 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:21.648566961 CEST | 49677 | 443 | 192.168.2.10 | 20.42.65.85 |
| Oct 3, 2024 20:46:24.902051926 CEST | 49758 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:24.902108908 CEST | 443 | 49758 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:24.902215004 CEST | 49758 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:24.902551889 CEST | 49758 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:24.902575016 CEST | 443 | 49758 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:25.550329924 CEST | 443 | 49758 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:25.553375006 CEST | 49758 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:25.553402901 CEST | 443 | 49758 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:25.553909063 CEST | 443 | 49758 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:25.554219007 CEST | 49758 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:25.554295063 CEST | 443 | 49758 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:25.554820061 CEST | 49758 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:25.554821014 CEST | 49758 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:25.554846048 CEST | 443 | 49758 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:25.880228996 CEST | 443 | 49758 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:25.881333113 CEST | 443 | 49758 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:25.881438017 CEST | 49758 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:25.882424116 CEST | 49758 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:25.882452965 CEST | 443 | 49758 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:47.558696032 CEST | 49759 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:47.558794022 CEST | 443 | 49759 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:47.558891058 CEST | 49759 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:47.559118032 CEST | 49759 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:47.559154034 CEST | 443 | 49759 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:47.590756893 CEST | 49760 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:47.590823889 CEST | 443 | 49760 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:47.590904951 CEST | 49760 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:47.591131926 CEST | 49760 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:47.591152906 CEST | 443 | 49760 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.152621031 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.152673960 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.152756929 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.153059006 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.153073072 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.211806059 CEST | 443 | 49759 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.212152958 CEST | 49759 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.212182045 CEST | 443 | 49759 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.213031054 CEST | 443 | 49759 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.213401079 CEST | 49759 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.213520050 CEST | 443 | 49759 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.213562012 CEST | 49759 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.213582993 CEST | 49759 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.213635921 CEST | 443 | 49759 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.229371071 CEST | 443 | 49760 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.229674101 CEST | 49760 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.229712009 CEST | 443 | 49760 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.230921030 CEST | 443 | 49760 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.231277943 CEST | 49760 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.231415987 CEST | 49760 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.231425047 CEST | 443 | 49760 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.231441021 CEST | 49760 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.231460094 CEST | 443 | 49760 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.274122000 CEST | 49760 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.517112970 CEST | 443 | 49759 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.517611027 CEST | 443 | 49759 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.517739058 CEST | 49759 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.517829895 CEST | 49759 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.517863989 CEST | 443 | 49759 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.528743029 CEST | 443 | 49760 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.529546022 CEST | 443 | 49760 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.529613972 CEST | 49760 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.529702902 CEST | 49760 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.529717922 CEST | 443 | 49760 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.799546957 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.799906015 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.799917936 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.800219059 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.800287962 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.800831079 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.800875902 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.801110029 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.801153898 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.801187038 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.801199913 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.801245928 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.852261066 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:48.852277994 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:48.899152994 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:49.116789103 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:49.117328882 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:49.117439985 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:49.117892027 CEST | 49761 | 443 | 192.168.2.10 | 142.250.186.142 |
| Oct 3, 2024 20:46:49.117903948 CEST | 443 | 49761 | 142.250.186.142 | 192.168.2.10 |
| Oct 3, 2024 20:46:58.293124914 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:58.293165922 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:58.293234110 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:58.293589115 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:58.293603897 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.085745096 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.085872889 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.089803934 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.089828968 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.090265989 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.095943928 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.139410019 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.411218882 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.411251068 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.411355019 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.411380053 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.411468983 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.411488056 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.411520004 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.412811995 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.412872076 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.412892103 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.412900925 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.412928104 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.413042068 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.413096905 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.414062977 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.414078951 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:46:59.414088011 CEST | 49762 | 443 | 192.168.2.10 | 4.245.163.56 |
| Oct 3, 2024 20:46:59.414094925 CEST | 443 | 49762 | 4.245.163.56 | 192.168.2.10 |
| Oct 3, 2024 20:47:10.884196997 CEST | 49764 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:47:10.884263039 CEST | 443 | 49764 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:47:10.884407043 CEST | 49764 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:47:10.884644985 CEST | 49764 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:47:10.884665012 CEST | 443 | 49764 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:47:12.279664040 CEST | 443 | 49764 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:47:12.280046940 CEST | 49764 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:47:12.280114889 CEST | 443 | 49764 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:47:12.281248093 CEST | 443 | 49764 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:47:12.281663895 CEST | 49764 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:47:12.281816959 CEST | 443 | 49764 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:47:12.337045908 CEST | 49764 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:47:18.507314920 CEST | 49767 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:18.507350922 CEST | 443 | 49767 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:18.507419109 CEST | 49767 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:18.507647038 CEST | 49767 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:18.507656097 CEST | 443 | 49767 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:18.652257919 CEST | 49768 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:18.652338028 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:18.652426004 CEST | 49768 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:18.652698040 CEST | 49768 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:18.652729988 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.566576004 CEST | 443 | 49767 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.566936016 CEST | 49767 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.566946983 CEST | 443 | 49767 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.567050934 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.567241907 CEST | 49768 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.567302942 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.567307949 CEST | 443 | 49767 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.567775965 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.567787886 CEST | 49767 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.567787886 CEST | 49767 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.567787886 CEST | 49767 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.567804098 CEST | 443 | 49767 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.567851067 CEST | 443 | 49767 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.568057060 CEST | 49768 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.568133116 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.568186998 CEST | 49768 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.568240881 CEST | 49768 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.568253994 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.616849899 CEST | 49768 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.617296934 CEST | 49767 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.875662088 CEST | 443 | 49767 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.877227068 CEST | 443 | 49767 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.877444029 CEST | 49767 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.877626896 CEST | 49767 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.877643108 CEST | 443 | 49767 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.878413916 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.878854036 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:19.878914118 CEST | 49768 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.879112005 CEST | 49768 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:19.879158020 CEST | 443 | 49768 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:22.043123960 CEST | 443 | 49764 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:47:22.043219090 CEST | 443 | 49764 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:47:22.043400049 CEST | 49764 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:47:34.227334976 CEST | 49764 | 443 | 192.168.2.10 | 216.58.212.132 |
| Oct 3, 2024 20:47:34.227374077 CEST | 443 | 49764 | 216.58.212.132 | 192.168.2.10 |
| Oct 3, 2024 20:47:50.995076895 CEST | 49770 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:50.995119095 CEST | 443 | 49770 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:50.995187044 CEST | 49770 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:50.999079943 CEST | 49770 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:50.999094009 CEST | 443 | 49770 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.001878977 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.001946926 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.002012968 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.002258062 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.002290010 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.637692928 CEST | 443 | 49770 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.638431072 CEST | 49770 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.638452053 CEST | 443 | 49770 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.638817072 CEST | 443 | 49770 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.639245987 CEST | 49770 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.639245987 CEST | 49770 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.639261007 CEST | 443 | 49770 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.639271975 CEST | 49770 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.639309883 CEST | 443 | 49770 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.666244984 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.666534901 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.666572094 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.667872906 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.668174028 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.668303013 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.668320894 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.668348074 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.668348074 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.668358088 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.668472052 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.681689978 CEST | 49770 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.712270975 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.949842930 CEST | 443 | 49770 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.950776100 CEST | 443 | 49770 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.950938940 CEST | 49770 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.951373100 CEST | 49770 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.951390028 CEST | 443 | 49770 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.969696045 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.971128941 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Oct 3, 2024 20:47:51.971255064 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.971447945 CEST | 49771 | 443 | 192.168.2.10 | 142.250.185.110 |
| Oct 3, 2024 20:47:51.971493006 CEST | 443 | 49771 | 142.250.185.110 | 192.168.2.10 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 3, 2024 20:46:06.483845949 CEST | 53 | 52027 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:06.619112968 CEST | 61811 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:46:06.619251013 CEST | 53226 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:46:06.626322985 CEST | 53 | 61811 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:06.628180981 CEST | 53 | 53226 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:06.636347055 CEST | 53 | 56588 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.558260918 CEST | 49432 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:46:07.558430910 CEST | 54014 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:46:07.565463066 CEST | 53 | 49432 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.565613985 CEST | 53 | 54014 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:07.609477043 CEST | 53 | 59675 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:10.825752020 CEST | 52637 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:46:10.825937986 CEST | 62316 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:46:10.832809925 CEST | 53 | 62316 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:10.833049059 CEST | 53 | 52637 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:11.141871929 CEST | 53 | 52604 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:13.169904947 CEST | 53 | 58845 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:15.971231937 CEST | 56220 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:46:15.973872900 CEST | 64457 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:46:15.978785992 CEST | 53 | 56220 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:15.984180927 CEST | 53 | 64457 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.110843897 CEST | 64060 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:46:17.111095905 CEST | 59910 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:46:17.117821932 CEST | 53 | 64060 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:17.118300915 CEST | 53 | 59910 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:24.691057920 CEST | 53 | 59655 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:46:43.778680086 CEST | 53 | 63036 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:47:01.779570103 CEST | 138 | 138 | 192.168.2.10 | 192.168.2.255 |
| Oct 3, 2024 20:47:06.151791096 CEST | 53 | 53676 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:47:06.563050985 CEST | 53 | 59976 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:47:14.903445959 CEST | 53 | 54532 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:47:18.495982885 CEST | 59050 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:47:18.495982885 CEST | 52002 | 53 | 192.168.2.10 | 1.1.1.1 |
| Oct 3, 2024 20:47:18.503151894 CEST | 53 | 59050 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:47:18.504151106 CEST | 53 | 52002 | 1.1.1.1 | 192.168.2.10 |
| Oct 3, 2024 20:47:34.235404968 CEST | 53 | 61432 | 1.1.1.1 | 192.168.2.10 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 3, 2024 20:46:06.619112968 CEST | 192.168.2.10 | 1.1.1.1 | 0xd5bc | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 20:46:06.619251013 CEST | 192.168.2.10 | 1.1.1.1 | 0x338c | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 20:46:07.558260918 CEST | 192.168.2.10 | 1.1.1.1 | 0xca8a | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 20:46:07.558430910 CEST | 192.168.2.10 | 1.1.1.1 | 0x2e21 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 20:46:10.825752020 CEST | 192.168.2.10 | 1.1.1.1 | 0x8b9d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 20:46:10.825937986 CEST | 192.168.2.10 | 1.1.1.1 | 0x9d9b | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 20:46:15.971231937 CEST | 192.168.2.10 | 1.1.1.1 | 0xba50 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 20:46:15.973872900 CEST | 192.168.2.10 | 1.1.1.1 | 0xe1c5 | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 20:46:17.110843897 CEST | 192.168.2.10 | 1.1.1.1 | 0xff27 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 20:46:17.111095905 CEST | 192.168.2.10 | 1.1.1.1 | 0x1f2d | Standard query (0) | 65 | IN (0x0001) | false | |
| Oct 3, 2024 20:47:18.495982885 CEST | 192.168.2.10 | 1.1.1.1 | 0xc3c0 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 3, 2024 20:47:18.495982885 CEST | 192.168.2.10 | 1.1.1.1 | 0x4c7 | Standard query (0) | 65 | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 3, 2024 20:46:06.626322985 CEST | 1.1.1.1 | 192.168.2.10 | 0xd5bc | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:06.628180981 CEST | 1.1.1.1 | 192.168.2.10 | 0x338c | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.181.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 172.217.16.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.186.78 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.185.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.186.110 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.185.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 216.58.212.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.186.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.74.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.186.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 216.58.206.46 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 172.217.18.14 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565463066 CEST | 1.1.1.1 | 192.168.2.10 | 0xca8a | No error (0) | 172.217.16.206 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565613985 CEST | 1.1.1.1 | 192.168.2.10 | 0x2e21 | No error (0) | youtube-ui.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:07.565613985 CEST | 1.1.1.1 | 192.168.2.10 | 0x2e21 | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 20:46:10.832809925 CEST | 1.1.1.1 | 192.168.2.10 | 0x9d9b | No error (0) | 65 | IN (0x0001) | false | |||
| Oct 3, 2024 20:46:10.833049059 CEST | 1.1.1.1 | 192.168.2.10 | 0x8b9d | No error (0) | 216.58.212.132 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:15.978785992 CEST | 1.1.1.1 | 192.168.2.10 | 0xba50 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:15.978785992 CEST | 1.1.1.1 | 192.168.2.10 | 0xba50 | No error (0) | 142.250.185.174 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:15.984180927 CEST | 1.1.1.1 | 192.168.2.10 | 0xe1c5 | No error (0) | www3.l.google.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 3, 2024 20:46:17.117821932 CEST | 1.1.1.1 | 192.168.2.10 | 0xff27 | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Oct 3, 2024 20:47:18.503151894 CEST | 1.1.1.1 | 192.168.2.10 | 0xc3c0 | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.10 | 49707 | 172.217.16.206 | 443 | 7808 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-03 18:46:07 UTC | 851 | OUT | |
| 2024-10-03 18:46:07 UTC | 1726 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.10 | 49712 | 142.250.181.238 | 443 | 7808 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-10-03 18:46:08 UTC | 869 | OUT | |
| 2024-10-03 18:46:08 UTC | 2634 | IN |