Edit tour

Windows Analysis Report
OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx

Overview

General Information

Sample name:	OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx
Analysis ID:	1417471
MD5:	063c62c7c191f34e3adf27912b679c46
SHA1:	237cf820913d7320f5a379148d76da801fe96139
SHA256:	dc2b59a19680bd2e88c4a89d24b5695819808fff2acb41ce827ad6aad2e51987
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Installs a Chrome extension

JA3 SSL client fingerprint seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Chromium Browser Instance Executed With Custom Extension

Tries to load missing DLLs

Classification

Process Tree

System is w10x64

7za.exe (PID: 7520 cmdline: 7za.exe x -oC:\chrome "C:\Users\user\Desktop\OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 7580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\chrome MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7780 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1664 --field-trial-handle=2016,i,859544963767796602,16029275681761701210,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Chromium Browser Instance Executed With Custom Extension

Source: Process started

Author: Aedan Russell, frack113, X__Junior (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\chrome, CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\chrome, CommandLine|base64offset|contains: , Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\chrome, ProcessId: 7580, ProcessName: chrome.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 23.56.8.114:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.56.8.114:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49758 version: TLS 1.2

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.0.0
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.0.0
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmpTArGNe3mrAGIjCxSZ32kqtf1wo2hYSgiWWMiLq2BR_jmSiISbxHrDb_-NdiagK04Su2Nr5B77ol5IgyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2024-03-29-10
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmpTArGNe3mrAGIjDCQcX2g0chw2hR2lhqwQl7GKIAAERYj72DhBlTjaLxXCCV9uiNHZqyaKNCQKQb3CUyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2024-03-29-10
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gfryM5gE1NH7xWc&MD=kPKxn24p HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gfryM5gE1NH7xWc&MD=kPKxn24p HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: foundation-icons.eot, foundation-icons.svg, foundation-icons.ttf	String found in binary or memory: http://fontforge.sf.net)
Source: foundation-icons.eot, foundation-icons.ttf	String found in binary or memory: http://fontforge.sf.net)Created
Source: foundation-icons.eot, foundation-icons.ttf	String found in binary or memory: http://fontforge.sf.net)fontcustomfontcustomMediumMediumFontForge
Source: background.js	String found in binary or memory: http://oauth.net/grant_type/device/1.0
Source: LICENSE, foundation-icons.css	String found in binary or memory: http://zurb.com/playground/foundation-icon-fonts-3
Source: background.js	String found in binary or memory: https://app.real-debrid.com/oauth/v2/device/code?client_id=
Source: background.js	String found in binary or memory: https://app.real-debrid.com/oauth/v2/device/credentials?client_id=
Source: background.js	String found in binary or memory: https://app.real-debrid.com/oauth/v2/token
Source: background.js	String found in binary or memory: https://app.real-debrid.com/rest/1.0/hosts/regex
Source: background.js	String found in binary or memory: https://app.real-debrid.com/rest/1.0/hosts/regexFolder
Source: background.js	String found in binary or memory: https://app.real-debrid.com/rest/1.0/unrestrict/folder
Source: background.js	String found in binary or memory: https://app.real-debrid.com/rest/1.0/unrestrict/link
Source: background.js	String found in binary or memory: https://app.real-debrid.com/rest/1.0/user
Source: manifest.json	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: settings.html	String found in binary or memory: https://real-debrid.com
Source: LICENSE, manifest.json, popup.html, settings.html	String found in binary or memory: https://real-debrid.com/
Source: background.js	String found in binary or memory: https://real-debrid.com/authorize?client_id=
Source: popup.js	String found in binary or memory: https://real-debrid.com/streaming-

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.56.8.114:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.56.8.114:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49758 version: TLS 1.2

Source: C:\Windows\System32\7za.exe

Section loaded: 7z.dll

Jump to behavior

Source: classification engine

Classification label: clean3.winCRX@27/30@2/3

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03

Source: C:\Windows\System32\7za.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\7za.exe 7za.exe x -oC:\chrome "C:\Users\user\Desktop\OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx"
Source: C:\Windows\System32\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\chrome
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1664 --field-trial-handle=2016,i,859544963767796602,16029275681761701210,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1664 --field-trial-handle=2016,i,859544963767796602,16029275681761701210,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: unknown

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\chrome

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Information Discovery	Remote Services	1 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx	0%	Virustotal		Browse
OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx	0%	ReversingLabs

Source	Detection	Scanner	Label
http://fontforge.sf.net)Created	0%	Avira URL Cloud	safe
http://fontforge.sf.net)fontcustomfontcustomMediumMediumFontForge	0%	Avira URL Cloud	safe
http://fontforge.sf.net)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.251.111.99	true	false		high

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmpTArGNe3mrAGIjCxSZ32kqtf1wo2hYSgiWWMiLq2BR_jmSiISbxHrDb_-NdiagK04Su2Nr5B77ol5IgyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmpTArGNe3mrAGIjDCQcX2g0chw2hR2lhqwQl7GKIAAERYj72DhBlTjaLxXCCV9uiNHZqyaKNCQKQb3CUyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://app.real-debrid.com/oauth/v2/token	background.js	false		high
http://fontforge.sf.net)	foundation-icons.eot, foundation-icons.svg, foundation-icons.ttf	false	Avira URL Cloud: safe	low
https://real-debrid.com	settings.html	false		high
https://app.real-debrid.com/rest/1.0/unrestrict/link	background.js	false		high
https://app.real-debrid.com/rest/1.0/hosts/regexFolder	background.js	false		high
https://real-debrid.com/streaming-	popup.js	false		high
http://zurb.com/playground/foundation-icon-fonts-3	LICENSE, foundation-icons.css	false		high
https://app.real-debrid.com/oauth/v2/device/code?client_id=	background.js	false		high
http://fontforge.sf.net)Created	foundation-icons.eot, foundation-icons.ttf	false	Avira URL Cloud: safe	low
http://fontforge.sf.net)fontcustomfontcustomMediumMediumFontForge	foundation-icons.eot, foundation-icons.ttf	false	Avira URL Cloud: safe	low
https://app.real-debrid.com/oauth/v2/device/credentials?client_id=	background.js	false		high
https://real-debrid.com/	LICENSE, manifest.json, popup.html, settings.html	false		high
https://app.real-debrid.com/rest/1.0/user	background.js	false		high
https://app.real-debrid.com/rest/1.0/unrestrict/folder	background.js	false		high
https://real-debrid.com/authorize?client_id=	background.js	false		high
https://app.real-debrid.com/rest/1.0/hosts/regex	background.js	false		high
http://oauth.net/grant_type/device/1.0	background.js	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.251.111.99	www.google.com	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417471
Start date and time:	2024-03-29 11:44:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx
Detection:	CLEAN
Classification:	clean3.winCRX@27/30@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.179.94, 172.253.122.84, 142.251.167.95, 172.253.115.95, 172.253.122.95, 172.253.62.95, 172.253.63.95, 142.251.16.95, 142.251.163.95, 142.250.31.95, 142.251.111.95, 172.253.62.101, 172.253.62.139, 172.253.62.100, 172.253.62.138, 172.253.62.113, 172.253.62.102, 34.104.35.123, 69.164.0.128, 192.229.211.108, 142.251.16.94, 142.251.111.113, 142.251.111.138, 142.251.111.102, 142.251.111.100, 142.251.111.101, 142.251.111.139
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, www.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://airdrop-online-altlayer-anniversary.s3.us-east-2.amazonaws.com/posten.html?cid=freetomfr@hotmail.com	Get hash	malicious	Phisher	Browse
	http://116.198.42.183/uqcjjj	Get hash	malicious	Unknown	Browse
	https://brilink.me/xD6ksa	Get hash	malicious	Unknown	Browse
	https://179.60.147.91/	Get hash	malicious	Unknown	Browse
	https://1drv.ms/f/s!AsWd4BQz7qwJa8oeifBH2QA-eNg	Get hash	malicious	HTMLPhisher	Browse
	WaffMEMZ-1.0-Destructive.exe	Get hash	malicious	KillMBR	Browse
	https://jpn104.z23.web.core.windows.net/werrx01USAHTML/?bcda=(0101)-88868-22952	Get hash	malicious	TechSupportScam	Browse
	https://jpn104.z23.web.core.windows.net/werrx01USAHTML/?bcda=(0101)-88868-24980	Get hash	malicious	TechSupportScam	Browse
	WaffMEMZ-1.0-Destructive.exe	Get hash	malicious	KillMBR	Browse
	https://jpn104-secondary.z23.web.core.windows.net/werrx01USAHTML/?bcda=(0101)-88868-25074	Get hash	malicious	TechSupportScam	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://airdrop-online-altlayer-anniversary.s3.us-east-2.amazonaws.com/posten.html?cid=freetomfr@hotmail.com	Get hash	malicious	Phisher	Browse	13.85.23.86 23.56.8.114
	http://116.198.42.183/uqcjjj	Get hash	malicious	Unknown	Browse	13.85.23.86 23.56.8.114
	DHL INVOICE DOCUMENT NOTIFICATION 202403286777373688_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	13.85.23.86 23.56.8.114
	https://brilink.me/xD6ksa	Get hash	malicious	Unknown	Browse	13.85.23.86 23.56.8.114
	https://1drv.ms/f/s!AsWd4BQz7qwJa8oeifBH2QA-eNg	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.56.8.114
	https://jpn104.z23.web.core.windows.net/werrx01USAHTML/?bcda=(0101)-88868-22952	Get hash	malicious	TechSupportScam	Browse	13.85.23.86 23.56.8.114
	https://jpn104.z23.web.core.windows.net/werrx01USAHTML/?bcda=(0101)-88868-24980	Get hash	malicious	TechSupportScam	Browse	13.85.23.86 23.56.8.114
	WaffMEMZ-1.0-Destructive.exe	Get hash	malicious	KillMBR	Browse	13.85.23.86 23.56.8.114
	https://jpn104-secondary.z23.web.core.windows.net/werrx01USAHTML/?bcda=(0101)-88868-25074	Get hash	malicious	TechSupportScam	Browse	13.85.23.86 23.56.8.114
	https://jpn104-secondary.z23.web.core.windows.net/werrx01USAHTML/?bcda=(0101)-88868-24910	Get hash	malicious	TechSupportScam	Browse	13.85.23.86 23.56.8.114

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.039222024053982
Encrypted:	false
SSDEEP:	6:AuLGt6+DeojKTIlK3RCcBBQwEWJKNhHwIn9D7NRzW6+n:c6CpJl7VWJGHwu9D7DzW6+
MD5:	1CC6F0824F4AAE9DE0661B18E8A4B900
SHA1:	0268B90F1854D4220ACFB2E8FFA1770F7DFD6613
SHA-256:	4220E6C6ABB190816DDC126D7D17C0F7AD6135DCBCE2D30F2C45150FF9421C08
SHA-512:	FA9926EE189DC284185C1F27EC580388D71E1DB8CAA19B2F5C08D1AB5DD7726C5605ED2047384922AE28AE6E42D981E5403B19545F9438905AA9E4E88ED5A693
Malicious:	false
Reputation:	low
Preview:	RealDebrid Extension v1.3..https://real-debrid.com/....Includes: * Foundation CSS + Icons:.. http://zurb.com/playground/foundation-icon-fonts-3....Copyright 2009, 2016 Real-Debrid, All Rights Reserved...https://real-debrid.com/..

C:\chrome\_locales\en\messages.json

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1891
Entropy (8bit):	4.313894792159336
Encrypted:	false
SSDEEP:	24:14is2QCZt8aM0DsHJ7f4F/VDuUgMpDI4nb4XIchElqbpbRBJC6b0GtMWbvRjloT4:4XY8JJ7n/au24zbVGp6B
MD5:	29835F58A94BED25D93B3EEA44C51423
SHA1:	0E43B64F314455F8741CF535B1FDE7A93AEE3A65
SHA-256:	CD53D1BE8F6D6BF846593BBB346FD2F2E33EC2075C0226A4F668303286BC87AF
SHA-512:	FA144828D1D9C1B63B3D466CAAE69E09E7A31241EE286B0C3C4453FBF83CBFF0A01CD5884796692BE7FAECF99E85A8384D296915BD9E34AB555B9295CE12DED4
Malicious:	false
Reputation:	low
Preview:	{.. "description": {.. "message": "Real-Debrid is an unrestricted downloader that allows you to download files instantly and at the best of your Internet speed.".. },..."stream_now": {.. "message": "Watch in streaming now".. },..."not_streamable": {.. "message": "This link is not watchable but supported".. },..."logout": {.. "message": "Logout".. },..."authorize": {.. "message": "Authorize my account".. },..."waiting_authorize": {.. "message": "Waiting for authorization".. },..."not_supported_link": {.. "message": "Ce lien n'est pas support.".. },..."no_link_found": {.. "message": "No supported link has been found".. },..."cancel": {.. "message": "Cancel".. },.. "day": {.. "message": "Day".. },..."days": {.. "message": "Days".. },.. "debrid": {.. "message": "Unrestrict selected links".. },.. "debrid_now": {.. "message": "Unrestrict and download thi

C:\chrome\_locales\fr\messages.json

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2015
Entropy (8bit):	4.375585352210315
Encrypted:	false
SSDEEP:	24:14oG/PtkNMMlbHmKf3SVDwXMkq7qe/4uP4b4plg6a5RQkCq0Kn0Gtp8qaNKoxKO7:pGNQmepiXj1KDoR409wh6R
MD5:	93E705CEA4F7B917F059BFD291786084
SHA1:	A8E53D59F462F791EF53DA0C7555B58BF2874757
SHA-256:	0B07C1FE23F60C3DA446C22FF2AAD6B87F06AF1CEBFA9F37EDBA78D2B6D764D5
SHA-512:	C810B93C8BE7FC3A07C72A0BE0C7A27509867E962CB45EE81ACF7A198FE001356A90727D84EE0655124380D76DE9F4432B9F62AE4066F1AE7696CF013A9B2364
Malicious:	false
Reputation:	low
Preview:	{.. "description": {.. "message": "Real-Debrid est un d.brideur de qualit. qui vous permettra de t.l.charger instantan.ment et rapidement vos fichiers sur Internet.".. },..."stream_now": {.. "message": "Regarder en streaming maintenant".. },..."not_streamable": {.. "message": "Ce lien n'est pas regardable bien que support.".. },..."logout": {.. "message": "Se d.connecter".. },..."authorize": {.. "message": "Autoriser mon compte".. },..."waiting_authorize": {.. "message": "En attente d'autorisation".. },..."not_supported_link": {.. "message": "Ce lien n'est pas support.".. },..."no_link_found": {.. "message": "Aucun lien support. n'a .t. trouv.".. },..."cancel": {.. "message": "Annuler".. },.. "day": {.. "message": "Jour".. },..."days": {.. "message": "Jours".. },.. "debrid": {.. "message": "G.n.rer tous les liens coch.s".. },..."debrid_now": {.

C:\chrome\_metadata\verified_contents.json

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4511
Entropy (8bit):	5.884551927625336
Encrypted:	false
SSDEEP:	96:REyBszCyT810fnEeS8NHA3GAtf2GIWt68FV5/aaGQi7aN3xaGPCr:REyBszPR8eS8Nj+2q/FV5iaGta6r
MD5:	1B577A761D67F013A7BAD211CA9FF5C5
SHA1:	45B55F5FA0836E4ECC6D0AF57B4ABAFBA21BDCD7
SHA-256:	58DDBB1FB93C94E1790E614050056381A90D2BFCA938DEF5E21AFF46F47407EA
SHA-512:	4059B4A2C9A1A301C5351EFE03F5BBDB114234326A059E9168E5D0C12CDC6F4E6174AABB7B6B5721202D82AD96359907F91DC8499A4EFF6214C8F302558845D9
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUWlEbXhxdXhrSUZ0M0JKdGZSZkE5NjFoTmR5ODR0TVBMRVVWRF9sQ0hBZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2VuL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJ6VlBSdm85dGFfaEdXVHU3TkdfUzh1TS13Z2RjQWlhazltZ3dNb2E4aDY4In0seyJwYXRoIjoiX2xvY2FsZXMvZnIvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IkN3ZkJfaVAyREQya1JzSXY4cXJXdUg4R3J4enItcDgzN2JwNDByYlhaTlUifSx7InBhdGgiOiJjc3MvZm91bmRhdGlvbi1pY29ucy9mb3VuZGF0aW9uLWljb25zLmNzcyIsInJvb3RfaGFzaCI6IjhWMlF5UFFlb3drdGYtY0xEY0RFMzYxQjNfZVdZd0QtTjg1R21UYV9VLXcifSx7InBhdGgiOiJjc3MvZm91bmRhdGlvbi1pY29ucy9mb3VuZGF0aW9uLWljb25zLmVvdCIsInJvb3RfaGFzaCI6IkhONkhhQWJCSGh0NUh2YmZwZnZEcVRVQWwwMEtmcFRkTThjVHc4emg4OUEifSx7InBhdGgiOiJjc3MvZm91bmRhdGlvbi1pY29ucy9mb3VuZGF0aW9uLWljb25zLnN2ZyIsInJvb3RfaGFzaCI6IkkxbzJSNzU0azVndGlWWXNROXM1Y25kUVpqb1UwMFBrSkt5eW1kaVd1N1UifSx7InBhdGgiOiJjc3MvZm91bmRhdGlvbi1pY29ucy9mb3VuZGF

C:\chrome\css\foundation-icons\foundation-icons.css

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20102
Entropy (8bit):	4.823112677211415
Encrypted:	false
SSDEEP:	384:NYlXRV+bC5H/WcLRcU7VGzOgJyEi7Xnzqknih:NY/V+W5HucLRcEVGzOgJri7Xn2knih
MD5:	68844D2C98E2E1B3004CEDF00F2E51A1
SHA1:	426036F1D554B9DFFAE8B38ACC36CADE40D9521A
SHA-256:	4268828E332479438339207E75862C8FF4B195DAB0AA5EB90EE5D10CEC4057C9
SHA-512:	455CAE9B5C08E0B9742C46B01FF4F4F33E9DE7BE99606A2AF019EC4024E5A29FBFB32ED74716AEDB4397C947E6FCD970884EA3C5FB24A865ACF5C3F01FA7D1A4
Malicious:	false
Reputation:	low
Preview:	/* .. * Foundation Icons v 3.0.. * Made by ZURB 2013 http://zurb.com/playground/foundation-icon-fonts-3.. * MIT License.. */....@font-face {.. font-family: "foundation-icons";.. src: url("foundation-icons.eot");.. src: url("foundation-icons.eot?#iefix") format("embedded-opentype"),.. url("foundation-icons.woff") format("woff"),.. url("foundation-icons.ttf") format("truetype"),.. url("foundation-icons.svg#fontcustom") format("svg");.. font-weight: normal;.. font-style: normal;..}.....fi-address-book:before,...fi-alert:before,...fi-align-center:before,...fi-align-justify:before,...fi-align-left:before,...fi-align-right:before,...fi-anchor:before,...fi-annotate:before,...fi-archive:before,...fi-arrow-down:before,...fi-arrow-left:before,...fi-arrow-right:before,...fi-arrow-up:before,...fi-arrows-compress:before,...fi-arrows-expand:before,...fi-arrows-in:before,...fi-arrows-out:before,...fi-asl:before,...fi-asterisk:before,...fi-at-sign:before,...fi-background-color:b

C:\chrome\css\foundation-icons\foundation-icons.eot

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	Embedded OpenType (EOT), fontcustom family
Category:	dropped
Size (bytes):	54568
Entropy (8bit):	6.17354228386539
Encrypted:	false
SSDEEP:	768:2bPqwKxzATbtc13Q0dwWfJycdymiqCiKKamPCoCkkw1y0DJ6Exby1piw:WeATbCtFjfbViZiK9mrDNL+vV
MD5:	92827F088B9EDA87169BDC2B9888CE52
SHA1:	D584172686583FD510D8F04CF21E6E77FCE51435
SHA-256:	9189CD8788A2D42F89ECB72F08D55CC366A3ABC441C3413D9CECA66EC3144E46
SHA-512:	A69AC55DB5D2CB6AF8C113EA79A8D5C411D89599A682F628A8899C10411D698D5085E2E17ECF4F8440C3E931E5C0DE66ED71EF21833AA572DCA0F43A63B085CF
Malicious:	false
Reputation:	low
Preview:	(...p.............................LP........................W.......................f.o.n.t.c.u.s.t.o.m.....M.e.d.i.u.m... .V.e.r.s.i.o.n. .0.0.1...0.0.0. .....f.o.n.t.c.u.s.t.o.m................PFFTMh......T....OS/2A9^....X...`cmap.......0...Bcvt ...D...t....gasp.......L....glyfe.Z.........head...........6hhea...........$hmtx...7.......vloca^.0....x...>maxp.p.E...8... nameIgX....h....postg..{.......6..........W_.<..........==......==..................................................................................@.........x.......L.f...G.L.f....................................PfEd...............@............... ...............T.......c...c...c...c...............$...........$.......................W.......q.......................V...........H...H.......................F...........}...;.......;.......V...................................z.......\...E.......\...\...\...\...\...\...M...............~...........m...t...................t...................d...........\|...........A.......a..

C:\chrome\css\foundation-icons\foundation-icons.svg

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	151505
Entropy (8bit):	4.261984202800087
Encrypted:	false
SSDEEP:	3072:ijtmTaQ1PGAFAdHBycQXInp6NfZT0wO41:SQ1vXopqfZll
MD5:	6F6EFE8DB841E64F6AF7C3E1FC2530C7
SHA1:	BDCA38F453F9935203FE8CD071E97D7F8576E0BE
SHA-256:	FCBA8CA1313FF51D9DDEF102AD60DAD5128C430DC54E701CC31795928DCDEF02
SHA-512:	DE9DC845133994A2395E56AEBA137932090D1144D4E1297991DF7F43FC1D1C0EC153255940A2594153E49B46CF705E10916018AF95933D3BAA9B0F89AC3237C9
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" standalone="no"?>..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" >.. ..2013-8-23: Created...-->..<svg xmlns="http://www.w3.org/2000/svg">..<metadata>..Created by FontForge 20120731 at Fri Aug 23 09:25:55 2013.. By Jordan Humphreys..Created by Jordan Humphreys with FontForge 2.0 (http://fontforge.sf.net)..</metadata>..<defs>..<font id="fontcustom" horiz-adv-x="369" >.. <font-face .. font-family="fontcustom".. font-weight="500".. font-stretch="normal".. units-per-em="512".. panose-1="2 0 6 3 0 0 0 0 0 0".. ascent="448".. descent="-64".. bbox="-0.584459 -64.25 512.25 448.25".. underline-thickness="25.6".. underline-position="-51.2".. unicode-range="U+F100-F21A".. />.. <missing-glyph />.. <glyph glyph-name="uniF100" unicode="" horiz-adv-x="340" ..d="M330 287v0h-24v-30h24c6 0 10 -4 10 -10v-30c0 -6 -4 -10 -10 -10h-24v-29h24c6 0 10 -5 10 -11v-30c0 -6 -4 -10 -10 -10h-24v-

C:\chrome\css\foundation-icons\foundation-icons.ttf

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	TrueType Font data, 15 tables, 1st "FFTM", 14 names, Macintosh
Category:	dropped
Size (bytes):	56976
Entropy (8bit):	6.246992813506218
Encrypted:	false
SSDEEP:	768:VMqwKxzATbtc13Q0dwWfJycdymiqCiKKamPCoCkkw1y0DJ6Exby9ypiOX:VvATbCtFjfbViZiK9mrDNL+9aXX
MD5:	E20945D7C929279EF7A6F1DB184A4470
SHA1:	4B2BCE6C792493A4A5716B6FEC2DBEFE89492C3F
SHA-256:	7E1DD03DD4CE90B658052554CD7459DF16716717389A552FA4C6D56A5F8933E6
SHA-512:	436759BA495479A1477E9E62C81B78771805DE7D1689ED11EAC52E1B8E8D3D79B3455C5446EAA602EAED78B7BBD5DFAF370229759939166B51BA0097AB6A1912
Malicious:	false
Reputation:	low
Preview:	...........pFFTMh...........OS/2A9^........`cmap.......x...Bcvt .2.2...\....fpgm..x9...p....gasp.......T....glyf.j.F.......~head.......<...6hhea.......t...$hmtx...7.......vlocaQ(#<.......>maxp.......P... nameIgX....p....postg..{.......6prep....................=.......==......==....x.......L.f...G.L.f....................................PfEd...............@............... .....................<........... .............................................................................................................................................................................................................................................................................................................U......3.3.'3.#..wff.U....3.......T.j.+.A...#.32...+..32...+..32...+...#!"5.43!2..32....54/.654&".........;.2.J.......................j.7.."..8......................4.......,..............,...........z........%....#!"&47.3632...2.&264&"..79.4+."..1.;.1251......\|.................5. .........

C:\chrome\css\foundation-icons\foundation-icons.woff

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	Web Open Font Format, TrueType, length 32020, version 0.0
Category:	dropped
Size (bytes):	32020
Entropy (8bit):	7.98797897160174
Encrypted:	false
SSDEEP:	768:ZeCMB4D5hQRxRkQBtiAN7LrIM0/B5md7YtRZgkyPJxbI6GGS:ZeC04DARxRjoA1fcB5KoRVeJe
MD5:	A188C2F768CE5033D3F5D47BE7280E25
SHA1:	112FB0E498037F2FEA036ADB8105E47638159EAA
SHA-256:	8C44C3FEEDAE5331A281278EA3BA91D2255928A2F3010D316D6FBB9052E0C2EC
SHA-512:	92E59D107EDD22F88B5D754C27C2ED3834F8D667664BA5D02E675E13C2654608BE4957211BA38A900E130923130B8A7A41C6CD95660DA7806FC8865E2462732C
Malicious:	false
Preview:	wOFF......}........p........................FFTM..\|.........h...OS/2.......J...`A9^.cmap.......C...B....cvt ... ...........Dgasp..\|.............glyf...d..q.....e.Z.head...0.......6....hhea...`.......$....hmtx...........v...7loca...$...>...>^.0.maxp....... ... .p.Ename..wt...h....IgX.post..x........6g..{x.c`d``.b.....m.2p31..9[......&...@...X........x.c`d``<...........@.(...e.{.............................@......x.c`a.`...............2H2.0001.13.........p.#.')....0.1.`p..3")Q``..b[....x.m..K.Q....S$D ..p..eD..\$A#..6DD1.........^ft...*(.(f.Z.@.X..A......Q.....{..3.C...}...<..qk1...E.QA.A....f....'.`H....~.y.Y\|..mu.$v.q.K.w{....@........y.'..,...Zw....`..h.?.xK-..[....>.c-..wqOs.....3\....F;..8....N;M..O}kU.../..)q.../.{g..7....X...g..}.G}[)..).`{.G........KKRWd.{uF.......q=.R..J:.A_c<w.[PS.2.....~..W.pR..Jg0.~g.%...c..........\C....U.....x.....KM..F.E..\...G.E...........`O.\.;.'c.{..C..^...r....).{....X...=...L....=V........g#zvwj.?s.....?.x.c```f.`..F

C:\chrome\css\foundation-icons\svgs\fi-clipboard-notes.svg

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.575504296505126
Encrypted:	false
SSDEEP:	48:cCMAXQSfUcbAukgCrTxpzbrCHU4W4hwDQ26Dcsi99262fsi9Ws268QSQssi9MQ+:7xXQSfUtukgC/zbWHU4WDdcU+
MD5:	2832973B1CAA6FD5658EDDE2E7883F1D
SHA1:	0074A9228957A97049EADA4F286285FCE73F3DB4
SHA-256:	1B0B25CBDA91384C829E82146184FAB7A14E24652679AF57A9587DE79D234EF7
SHA-512:	4EB8AEA44D932B48C424EF1856FFA09AD04BCD762EC092AA38444A48AFCAF6BC11A174244B75E3EBF5B19DF7C17ADCC6958A9E0111AB652DFE7CEE7D43D5D2BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 17.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... width="100px" height="100px" viewBox="0 0 100 100" enable-background="new 0 0 100 100" xml:space="preserve">..<g>...<path d="M80.761,17.26h-0.019c0.001-0.049,0.015-0.095,0.015-0.145c0-2.893-2.346-5.245-5.241-5.245....c-0.04,0-0.076,0.011-0.116,0.012H60.842V8.48h0l0-0.002c0-0.881-0.714-1.593-1.593-1.595V6.875H40.8v0.006....c-0.015,0-0.028-0.004-0.043-0.004c-0.88,0-1.594,0.713-1.594,1.594c0,0.01,0.003,0.02,0.003,0.03v3.38H24.501....c-0.007,0-0.013-0.002-0.02-0.002c-2.893,0-5.242,2.354-5.242,5.243c0,0.047,0.013,0.09,0.014,0.137h-0.014v70.572h0.003....c0,0.009-0.003,0.018-0.003,0.027c0,2.895,2.35,5.238,5.243,5.238c0.078,0,0.151-0.0

C:\chrome\css\foundation-icons\svgs\fi-loop.svg

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1798
Entropy (8bit):	4.896629242085353
Encrypted:	false
SSDEEP:	24:2dCM5AXxGvO7LfUo9Fpz8bXjOLOjtn4Jg1EaA18ROHXuHRfSTuGxIGbL7sFIizPi:cCMAXQSfUcKXjsI4y13kXuHob7jizK
MD5:	DA779E1EEEEE712ADC0AE67200A74784
SHA1:	C6CA3225B27C75F48B2C0B0B0C94FEFBA1A79AC2
SHA-256:	66458C8667CE0A4A97711A5464F7BDE5F1593D8FB53AA15CDBFB07FE4C3A22F2
SHA-512:	92BFBEF8ADD2EBEE353FDC767ABA43A502FEA9B619C82C45E7BB35EDE7A039B6E11233C78EEF609F2317F3C227E6075D9C3880F3005DA8CF6781AE655FB6C4FA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 17.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... width="100px" height="100px" viewBox="0 0 100 100" enable-background="new 0 0 100 100" xml:space="preserve">..<g>...<path d="M83.729,23.57c-0.007-0.562-0.32-1.084-0.825-1.337c-0.503-0.259-1.107-0.212-1.568,0.114l-5.944,4.262l-0.468,0.336....c-6.405-6.391-15.196-10.389-24.938-10.389c-13.284,0-24.878,7.354-30.941,18.201l0.024,0.013....c-0.548,1.183-0.124,2.607,1.026,3.271c0.001,0,0.001,0,0.002,0.001l8.136,4.697c1.218,0.704,2.777,0.287,3.48-0.932....c0.006-0.011,0.009-0.023,0.015-0.034c3.591-6.404,10.438-10.747,18.289-10.747c4.879,0,9.352,1.696,12.914,4.5l-1.001,0.719....l-5.948,4.262c-0.455,0.327-0.696,0.89-0.611,1.447c0.081,0.55

C:\chrome\css\foundation.min.css

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	147723
Entropy (8bit):	5.049848071773941
Encrypted:	false
SSDEEP:	768:bt9Fgr6auIsnPSbp+2yZw00YyftgOU/+vENmeQIQYh2T2585uM58d4NXQJZg1w:bt9FAmIsnPSbp+Nw00zvEgeBET2582
MD5:	23C827C78DF424896BF12E2AD99E783F
SHA1:	1C842E5F29D902383BD113C61BFBD80C58243FE4
SHA-256:	BBD06ECA458430262007AB358890E2A172CD34F00D7F23D8E6AF438A225E0508
SHA-512:	A0292457CEAC0C935BF32D7439335D899CE82C01460C0F12C5C4B29C8D163B419B9862B9F4031B10ED532F2B3B06454F692E0C56C960A4535C14A7C0CE2E1E67
Malicious:	false
Preview:	meta.foundation-version{font-family:"/5.4.6/"}meta.foundation-mq-small{font-family:"/only screen/";width:0em}meta.foundation-mq-medium{font-family:"/only screen and (min-width:40.063em)/";width:40.063em}meta.foundation-mq-large{font-family:"/only screen and (min-width:64.063em)/";width:64.063em}meta.foundation-mq-xlarge{font-family:"/only screen and (min-width:90.063em)/";width:90.063em}meta.foundation-mq-xxlarge{font-family:"/only screen and (min-width:120.063em)/";width:120.063em}meta.foundation-data-attribute-namespace{font-family:false}html,body{height:100%},:before,*:after{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html,body{font-size:100%}body{background:#fff;color:#222;padding:0;margin:0;font-family:"Helvetica Neue",Helvetica,Roboto,Arial,sans-serif;font-weight:normal;font-style:normal;line-height:1.5;position:relative;cursor:auto}a:hover{cursor:pointer}img{max-width:100%;height:auto}img{-ms-interpolation-mode:bicubic}#map_canvas img,#map_ca

C:\chrome\css\style.css

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	4.891807394845987
Encrypted:	false
SSDEEP:	96:cMXmvMnwFr/BWq3XB6a/urcHFdD2YJz7BWwF78B7Bmay:c3vVFU5Xc7iIRay
MD5:	5F1072A1BE821A90E50B7CA58D056C0D
SHA1:	DD99AF732F9DB6E68D9EE96E67BD6E79BA55CFD6
SHA-256:	87ADD06AE27AD44B722AF8EFDE72AF5C8F46F79B3F1A1059767399CE10144A52
SHA-512:	408560FB8DCF17FAD0916408A2A743192715AAB6F8288083C91C5C8C69EE48C579F8DE81958C0249BDA4093C9FCC259B7161A388F0CD7D2F99F4D1A1ECD8CF9D
Malicious:	false
Preview:	html, body {.. height: auto;.. width: 355px;.. font-family: "Lato", Calibri, Arial, sans-serif;.. text-rendering: optimizeLegibility;.. -webkit-font-smoothing: antialiased;..}....a {.. outline: none;..}.....icon {...vertical-align: middle;..}.....hide {.. display: none !important;..}.....bold {.. font-weight: bold;..}.....error {.. color: red;.. font-size: 9.5px;..}.....menu {.. height: 55px;.. width: 100%;.. background-color: #2F2F2F;..}...menu.top .logo {.. float: left;.. height: 100%;.. width: 50%;.. text-align: center;..}...menu.top .logo img {.. margin: 11.5px 0 11.5px 0;..}...menu.top .login {.. display: table;.. float: left;.. height: 100%;.. width: 50%;..}...menu.top .login .login-contain {.. display: table-cell;.. vertical-align: middle;..}...menu.top .login a, .menu.top .login p {.. overflow: hidden;.. width: 165px;.. line-height: 15px;.. margin: 0;.. white-space: nowrap;.. -o-text-overflow: ellipsis;.. text-overflow: ellipsis;.. color: #777777

C:\chrome\img\icon128.png

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8045
Entropy (8bit):	7.928750167868089
Encrypted:	false
SSDEEP:	192:tyDU1MJVott6Sac7RBlKgSLFViqDV1kA14m39E:SU1Mno044gwkxPm32
MD5:	B5BCEE45F4A092AB900C3F4D60CDE4FD
SHA1:	FAD9A1A64C8A19049CA387005F61C161313EC195
SHA-256:	FA8468BED07A076CF131ACD3DE1D067A00C8ECAEE2A5C8DC222A510A9BC08DD7
SHA-512:	5CB52E7D2E742B843A8F04C1AA8E2E355635BF68011045851E29CCFEB7785A164444A908F28A269D9275ECD82752E122D53FCC0377B8E7B6EF73F8D1C0409272
Malicious:	false
Preview:	.PNG........IHDR..............>a....4IDATx..]gx\.>....$lB.>.d!m..,...Y..&<..d..R ..l.%` .Y..{..u.,..F..hT.^F..4....\....}.s...d.;E......-...y.....0.9+h..t..\|..2.#...?..e...)p7p..).@_.....n......C.4.`.0.o..v~.&..@O.Z.....7...........e.\|t]...O...e.C.4.;g'W"..{..e3/i....\|...^.3..w..\|k..g\|...+....m...B...xd.H"..8.a..L.z\|t].+.... aT..c.,"........x.H".Z.y.Do....4..J.M..EH..k.L..V7...I......x.~fYg./j.....v+..}......p....O.AX.Y...A.... ckw..1.....qD.a&..f%4.,$x.i.X.=E ....?..HLu.IB..]Q.=...............>~..m....&..`.+.c....4A.qV"K...E.....(Ht..D....b4......u...o..3.B.O.....HVv%..-...$@.4$....s..+Y.%v.p..xa]...C0..r..c'Q.V3...N..8o.p.-...d...... n.V....m...u....b..se.N~]..$L..v.t....$.)b...D.m.g...G.G.y.\|........G..x_..j....d..F.V..\|.V..&..g....3\.N.x..N..BH.3.L!.roR)R..$..A.=d...B~RI...H.RB0......p%..i....@..O...h.Sa..D...0.......R..p.r.!....8Y...7+..Z#~.`.B.%..0%H.X.......Z.m....5../.QG@.../...W'.v_.w.\|..d..T...J.~}./.w....E...g....a.....W....v.

C:\chrome\img\icon16.png

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.112817895062094
Encrypted:	false
SSDEEP:	24:I4w4r5H/mXS0U2Jemdblgb806Yn54eVBvgVfOFtJUlL0gHb:IZG5H/mXBAmdBW3v5T7opYU0g7
MD5:	A0C16EDC0E337D0F09078437D9AF28C0
SHA1:	F4E497223D3FA2BCC232FF0D7EEF19D130A2C9B6
SHA-256:	A6F9BCA8225B280B6AE5F54F25823A0D397D888DCB37B4E13CE4DC615E894EAE
SHA-512:	1954D8ED6F3A6C98CFB9FDBE08BCF3443948967FF1DF164EBDE67FD44075C579F41A9118EBE4E7D2BF4EF60C13C94ABC4B6C6AB0B6B4329BC073FD2862FAACDD
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...4PLTE.............................................~.......................t..z.....~................................................................................................................q..........................q.....................r..l................................................{.....................................................................................................................g.QJ....tRNS......../........{rx......GFy~.......M.....bpX..g.T.S,.)............r..........................:....../..Z..........y.........5%.R...........y.;...^.....Z........r..2=@IM....IDAT.....D...E.....T..........Ii...RiS,'..EE...........AR.JG..Y....1.e..?.....7#j.....J.W}S....F..a'..*I.....{.E..h..#.\M..Zt0..e .9..X..Le.=.j.x...r.>.p%-.K37.)....4..........r....@.....3q..@2..?.r.CO

C:\chrome\img\icon32.png

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	7.864298960699555
Encrypted:	false
SSDEEP:	48:iEthyZLq3BnmTZx85EFmERRfTNivLVcKKleVTfMky:phyw3Zi8qFzR5TkLKHMxMky
MD5:	2C2D74AE2084462E91FBD06127DAC9B2
SHA1:	E74C5C99876E663FE11AC0D59AA87EF92A0EA213
SHA-256:	B7A293CE0D444AFF1E3FA48AEF5BF9D91ABB130E318CD4EA239C7406DF513878
SHA-512:	AFF4B6A139F045E8463DA75BD2D3FBD4D727F43E30E80AC5E771E6A133B1656DE555583778D9CEA56B3373A2E7B84E39D9780EC1C7F496AA1EF2B708FAD7FEB5
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx^.U].\e.~..s.............+...Z0.hJ..x.6QC..o...5..l.+01.HH..1..FBb.D.....].Xv............3.d3.......s.o.y..}f.x...b..4E.......hG...'..f.z.$..(9.s/...9..Q....1....J..9.v=.l.RQ...db...0...v;..6.,......<.8Ajp{..?W,...\|.B....v......d..Y.n..Z.m.h...rt.}.(L..z.:Y>Y(.v...[.?o.....4O...!...6@n..).z..kvN.,..l&....?.?'..G./.G...O.......;(U..^..oL.f`pr..'.y..1...g.....)2.hL....L....L...b..6.R.....P.N.....I>9 >.s.....-.....g:p..d ..(..v..Q..+Q.G..$..w.!@g.R_j~sme....K..$`.Q......L...B....J.~W..~..\Z.~..p..(.S/..)p;....j.".1C>.....x...$...Q_.U{aeL..&...V.U..2.v.DH....i.........-..Js...C!..^..v.Q).H......p<..Hl...rS..\|......n..7?.++. ..w.@.Y..K.......?..cr..Wd.#.'I..F!.Y.....&z...X\.....f....B... ....ise..N.1...........sIb.Mj]0...wA...r.>.N....w.-...c..F&<...rLi.....i.g........ ...tW...A..\)@)....w......o....m(..AaE3.>.v........J.h..I((.N.........q...6..[W....7.....SC......p<.).+...W.=n;..5.x..y.$....<:.N./MA....

C:\chrome\img\icon48.png

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2797
Entropy (8bit):	7.928901698168445
Encrypted:	false
SSDEEP:	48:vzSqGTYt3yh3DwUgaF0sx9au0euD+9W4ZoVjV7KQYmhKH9JR5B:vzSytctxt9ajl4Z3mUPB
MD5:	D782AD43A049EBEB1268891C16E75639
SHA1:	FAA337D558E4A3E70067E9FF2EB234E6BE73CD2A
SHA-256:	4D23F5E99380810DCA6F5E35366F00EB2BC0C24964B1DD91FDA2F1B7BDA567A9
SHA-512:	21B6D90FFDE636C251CFBF43D2AC4BD0E7AA59E74906B080FD7A0810BD328DC24CD25A34E51D67B1F0B7F0ED8FEE968090EFD58B6C915F9A7B5E4901DF81C558
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......IDATh...l.g...i..$.N..$.&`...1.......I..bbB.S..2.&uS.tN'.i'N...}8..8n....;..8N..W.[...>.....q.'i$..+..........8...EA%....N.)~.^g..3z.q...K..l\|.w....6...m.o...!.Eo.{........u..FW.h....^.h....{..L......'zJL..K.q_...4.,....l.EQ}./E4.g.v...L.....xn../@.9?o...,q...l-n.{Q2b{.....O.....S..e1...<./..y1a...9C.\Q;..6.....xe..U.K..p`....^....N6...5.#.m.........#u..V..b.%<....4#...c0..`.xB....f.."a.. ....z....Qp..f...]6.......TO..........#Q..2,~..t...[.3.V.6.}./........=@(.......#..1...#.x_B8..U.^.-.o...8.j...{{9.Q.....7.db....7Hx4^..y.G..zE.r}bq.l.{.f mf..)x..#y....g...,...^.-U.U.[&.:.!..&....#T._aA.....).8B..C..C.C....#..S..'n..9P..c.....1'R....,...,!..I{n.k....:{!..yTd-.....[..%...&.i.....W..["......mJ%.7....1..8D.. ..yv......:DaB.o.#t..(%.l..5d.fR..$2x.I.c.4...-....t.0....f.GS...!~PB.(S.l...'o....&..+..PCx2....?o..V.%4..1J7:...J18(.{....7........Z.2.p..pE+....k.....D....u.2LN:.4.P.pSHx.6.....l..

C:\chrome\img\loading.gif

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	GIF image data, version 89a, 80 x 80
Category:	dropped
Size (bytes):	33157
Entropy (8bit):	6.241193219317502
Encrypted:	false
SSDEEP:	384:B1BI2kicUgtEv7M3sKpxq2ueBgezay+QchXtd2m+FPapT:LBvtFv7w9bSeBg2sT2mkWT
MD5:	798270E0096DC761F3A8CD3A6E48772A
SHA1:	FEF01F2496B4B4BD837C7C96CBC1EBB4D5EF2742
SHA-256:	0C6F543685460875B3BD8C6D32F8725FB9487BBAB55AB6C82D78A44A2FE4CBE9
SHA-512:	B4142A06E6386BEB5C2B7292B01D59BAA7AC12B9B757BAEAC9D4E34447A7113CA462F4AC07CDDA1B3247A05CBE8BBB94D00102E4C6AA1ECFBDF956E792BC530C
Malicious:	false
Preview:	GIF89aP.P..................................RRR...........................:::...jjjfffttt..............."""XXX>>>...............~~~\|\|\|...xxxvvv$$$<<<666....................**.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.....J.!..NETSCAPE2.0.....,....P.P........H......(\..B..#J.....)j......9...ra.....(P2...[...B...d...Q...6mn..D..e..`.i....&]..).R....j...n...*.T.B.@..X.\....v!..H.2uz.nY.u.B 2..O.qe..b..=..P@y...i}"8.....

C:\chrome\img\logo.png

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	PNG image data, 426 x 136, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5931
Entropy (8bit):	7.893349393924979
Encrypted:	false
SSDEEP:	96:XykbkdJoKdzLyNp7cN3r/Z0jIe5MXJkdy+DIqziis1JniIzAZUPnjn/zeYp4z3/b:ikIrXyN1csjD5MZkd/Liis1JijALzeY2
MD5:	7430943529E3F3E46B7FD529333A53A0
SHA1:	9CE6E73A40082E91D54991E116A05AEED5620EDE
SHA-256:	280B00947159676D14F34D89C02E07EBF1DA5F2A2880CFEBF7139FE4E7D43C09
SHA-512:	EB18D7D637DD9B32B64BDDF87012FC8BCA4B38454AC5B9A5E600F7DEE9F27519FD4DFBC832B06E67F2DDD4CCCE43BBA211753335B76B410F4CBE3FB1E44D99FB
Malicious:	false
Preview:	.PNG........IHDR..............B_M....PLTE.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................~........................................................................................................................................n........y.............................................................._m.....tRNS..........W.h..}w.oRZ...0....T....2dG>.l..O#.}m)..\S;7..._L/p5..@&..zF+......g.....rd>2.....zl....uiWIG.........c]T......zhOI:$.........\|uYVA;..............`_........6!....

C:\chrome\img\offline.svg

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1137
Entropy (8bit):	5.267495426950314
Encrypted:	false
SSDEEP:	24:2dkMA6LfgWlmrWU+e0WDDGSdCaWbs9ECnZVjpYEoRF:cpA+fypE0GSNFfFIn
MD5:	556F9131CEB63CB4F54D6ADDEFF1F97D
SHA1:	6059E6AA2BBA5D185997FCF44A3BD2381331DBDB
SHA-256:	34600A11920C178B6E90248A5358028DBC030DA26A3D1952398E976195F1DB5F
SHA-512:	DA33A1274D72DE8920E9C707E2D128D3621223E82EB63198EDAFDFE9C747E064E94212D951928FED219EC0636462CD7F47C45ADED0DD132FB74A1B1F1420EB93
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 18.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="-155 247 300 300" enable-background="new -155 247 300 300" xml:space="preserve">..<g>...<path fill="#DC3E3A" d="M-3.7,261.8c-74.6,0-135,60.4-135,135c0,74.6,60.4,135,135,135c74.6,0,135-60.4,135-135....C131.3,322.2,70.9,261.8-3.7,261.8z M-3.7,512.7c-64,0-115.9-51.9-115.9-115.9c0-64,51.9-115.9,115.9-115.9....c64,0,115.9,51.9,115.9,115.9C112.2,460.8,60.4,512.7-3.7,512.7z"/>...<path fill="#DC3E3A" d="M100.8,396.8c0,57.7-46.8,104.4-104.4,104.4c-57.7,0-104.4-46.8-104.4-104.4c0-57.7,46.8-104.4,104.4-104.4....C54,292.4,100.8,339.1,100.8,396.8z"/>...<g>....<path fill="#FFFFFF" d="M-3.7,335.7c14.3,0,25.9,11.6,25.9,25.9c0,14.3-11.6,25.9-25.9,25.9c-14.3,0-25.9-11.6-25.9-25.9.....S-18,335.7-3.7,335.7z"/>....<path fill="#FFFFFF" d=

C:\chrome\js\background.js

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27647
Entropy (8bit):	5.158703371828861
Encrypted:	false
SSDEEP:	768:3eKzcNUtBSdfpJx+UAqBSmY1/Nw+KZOUY22i+4umIL7+lyq9uZkUVc1VNY8QarY7:3H22i+4ub+lyv
MD5:	E111562094B90471739ED189D83E4F19
SHA1:	41648E562149A13E2929F11BB1E5028CE636AA8D
SHA-256:	B8CAAAF40CB3BC5884AD8DED3752499537E6C643CFD3C3BA88A913BF33BFA178
SHA-512:	D5440F1886894A41E1194A865EC6FBC8BE03B1F0FCF35C58DD90991B56252C44533A5FB10E74E5F168E98F66254DE6CA83B3A0007959B352D39078B4106C8830
Malicious:	false
Preview:	var regexMain = [], regexFolder = [], user = null, foundLinksByTab = [], indexLinksByTab = [], contextMenu, contextMenuStream, currentTabId = -1, currentTabUrl = "", addonSettings = {};..var default_client_id = "CEZWNFZ6BSSMK";..var timerAuthorize;..var authComplete = false;..var currentDomainNum = 1;..var i;....if (typeof chrome.storage.sync !== "undefined") {...var addonStorage = chrome.storage.sync;..} else {...var addonStorage = chrome.storage.local;..}....function isLinkAlreadyAdded(link, tabId) {...var mit, found = 0;...if (typeof foundLinksByTab[tabId] !== "undefined") {....for (mit = 0; mit < foundLinksByTab[tabId].length; mit += 1) {.....if (link == foundLinksByTab[tabId][mit].link)......found = 1;....}....if (found == 1).....return true;....else.....return false;...} else {....return false;...}..}....function debridLink(argument, callback, error) {...if (typeof error !== "undefined" \|\| addonSettings.accessToken == '' \|\| addonSettings.refreshToken == '') {....if (typeof argume

C:\chrome\js\parser.js

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	777
Entropy (8bit):	5.015135182475085
Encrypted:	false
SSDEEP:	24:VzYvHzxXxlK62ODu+MhSQxI0YvhYUK2tDuA3YvhYUHrY:VzY1XxH2DL+0YxgqYi
MD5:	41EB5E87E455E4B5CAAB25A9BF7AB612
SHA1:	5A61997AF6DCF03174C8DF739A8876B2011654E8
SHA-256:	D7FDFFD0B154DE730B16AE428D3775B6526A9F3E557E0FB83EDABE2E6557F57A
SHA-512:	09C4470C2A4B8451E2F55684BA163A5749BC8C9A7BE69178CF0E0DD9E29BA280A870510F7FF65DBA5E73DAF326161A228B926C4E1F5F614671A55754F46E715F
Malicious:	false
Preview:	if (typeof tabId !== "undefined") {...chrome.runtime.sendMessage({action: "getAutoDebrid"}, function (autoDebrid) {....if (typeof window.location.href !== "undefined") {.....if (autoDebrid === true) {......if (typeof document.body !== "undefined") {.......var documentContent = "\"" + window.location.href + "\"" + document.body.innerHTML.replace(/href="\//g, 'href="' + window.location.protocol + '//' + window.location.hostname + '/');.......chrome.runtime.sendMessage({action: "findLinks", tab_id: tabId, content: documentContent}, function (links) {});......}.....} else {......var documentContent = "\"" + window.location.href + "\"";......chrome.runtime.sendMessage({action: "findLinks", tab_id: tabId, content: documentContent}, function (links) {});.....}....}...});..}

C:\chrome\js\popup.js

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16585
Entropy (8bit):	5.112050392408763
Encrypted:	false
SSDEEP:	192:WKECkiU3GqaBGqk5FEZJUoLseMCn5hmhoeTR8mclw:W7Cs3PaEsP5hmhoeTemclw
MD5:	715869BB653A8FD8A05F6AF7ABDFF7BB
SHA1:	0FE5B36FDC747112D770CBEB8D0D9F5216D52C91
SHA-256:	B0D62C7E95BF8E296BB716DD09B3D3F67DC9B029C22F440A919A67CD960C4CD8
SHA-512:	49102ABAFBC17C9A7EACFE4B4E73F4254D009921E4A940EC334BD5CA6A37D7021484BCE7CF09CA330071DF8A53978149A4B3BDC89A11EEFE32FC7DC6D200A13F
Malicious:	false
Preview:	var CHECK = true;..var p = document;..var timerAuthorize;....function addClass(element, class_name) {.. if (typeof element != "undefined" && element !== null && typeof element.className != "undefined") {.. element.className += ' ' + class_name;.. element.className = element.className.replace(/^\s+\|\s+$/g, '');.. }.. return;..}....function removeClass(element, class_name) {.. if (typeof element != "undefined" && element !== null && typeof element.className != "undefined") {.. if (class_name == "") {.. element.className = "";.. } else {.. element.className = element.className.replace(new RegExp('(^\|\\b)' + class_name.split(' ').join('\|') + '(\\b\|$)', 'gi'), ' ').replace(/^\s+\|\s+$/g, '');.. }.. }.. return;..}....function hasClass(element, class_name) {.. var tmp_class_names = element.className + " ";.. if (element !== null && tmp_class_names.indexOf(class_name + " ") != -1).. return true;.. else..

C:\chrome\js\selection.js

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	385
Entropy (8bit):	4.835592372915975
Encrypted:	false
SSDEEP:	12:ZKUhkuatt+fXturaG/0pbFeFoK+RqMgxCHvtOym:Z8ua3QdurlLdMYYvtPm
MD5:	CB648DC26DB09F140BBF3D704E779812
SHA1:	AFA69D130169AE178029AD29F99F0BC28011F736
SHA-256:	EA897528D196288282360E1F1DEED2C9F4204BF38019A6922B3522D142674AC7
SHA-512:	862C356E3FEB40C1A3D2D33BBA1B95F28C151609828BB51165D95EAD642739A5251CC78AA424DD8CF9AA78DF537A1BBE590B2E12878207941395488CEB016428
Malicious:	false
Preview:	var text = window.getSelection();....if (text.rangeCount) {...var container = document.createElement("div");...for (var i = 0, len = text.rangeCount; i < len; ++i) {....container.appendChild(text.getRangeAt(i).cloneContents());...}...text = container.innerHTML;..} else {...text = text.toString();..}....chrome.runtime.sendMessage({action: "selectedText", data: text}, function () {});

C:\chrome\js\settings.js

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3257
Entropy (8bit):	5.024547409439401
Encrypted:	false
SSDEEP:	48:arRntPt143K2CRptVYat1utI3k2HvzsvYbYwd9BmJ2otReaKei1HK93WNyk2:0dgKRvjyCk0vDdfmBtRl9v3Iyk2
MD5:	650CBFD499EE739A0D514278FA28608E
SHA1:	67AC29118FB92F52F9526496890BF6E27560F25A
SHA-256:	91C41DF1DD10D6FEBC32921F188AA5F6FBF86DD66591A69B3B5C60739AED5C45
SHA-512:	1E76C65534B6C3D8BCC0F5059DA86BCE0C42F95860DCAE39B45E7ED56204F30C0D53E6CF8956FD5EB9D57E7D2F9A9D927F92CA34BE149191A2EF8FD592EC3C65
Malicious:	false
Preview:	var p = document;....function addClass(element, class_name) {.. if (typeof element != "undefined" && element !== null && typeof element.className != "undefined") {.. element.className += ' ' + class_name;.. element.className = element.className.replace(/^\s+\|\s+$/g, '');.. }.. return;..}....function removeClass(element, class_name) {.. if (typeof element != "undefined" && element !== null && typeof element.className != "undefined") {.. if (class_name == "") {.. element.className = "";.. } else {.. element.className = element.className.replace(new RegExp('(^\|\\b)' + class_name.split(' ').join('\|') + '(\\b\|$)', 'gi'), ' ').replace(/^\s+\|\s+$/g, '');.. }.. }.. return;..}....function ucfirst(str) {.. str += '';.. var f = str.charAt(0).toUpperCase();.. return f + str.substr(1);..}....function debrid() {.. window.location.href = "../view/popup.html";..}....function logout() {...chrome.runtime.sendMessage({

C:\chrome\manifest.json

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	4.645361840381768
Encrypted:	false
SSDEEP:	24:BaClm7Jbst1N3qwEy9VWWncMkxKSPeHe0LOOD:7m7JQ3N3qsoWKxCb
MD5:	E13D0E21D3EAE8DD48A74401F4EB50A6
SHA1:	9FD48761FAFB164448ED36485FEDA8C75FB69A7E
SHA-256:	435C594460340819CE18200C85EB933DFBC1891282974E63ECA91CE25DFDCFC6
SHA-512:	504FCF43CD402F800E510E69FEF506F3F926BA096C75BAADF3DF4F564CD52F0AFCEE7A2C5697AB8363CF1F58E994D3F172E70FB3E560A9272D53216B7176DC3C
Malicious:	false
Preview:	{."update_url": "https://clients2.google.com/service/update2/crx",... "manifest_version": 2,.. "name": "Real-Debrid extension",.. "description": "__MSG_description__",.. "default_locale": "en",.. "version": "1.5.9",.. "author": "Ludwig VASSEUR",.. "homepage_url": "https://real-debrid.com/",.. "icons": {.. "16": "img/icon16.png",.. "32": "img/icon32.png",.. "48": "img/icon48.png",.. "128": "img/icon128.png".. },.. "background": {.. "persistent": true,.. "scripts": ["js/background.js"].. },.. "permissions": [.. "<all_urls>",.. "tabs",.. "activeTab",.. "clipboardWrite",.. "contextMenus",.. "storage",...."notifications".. ],.. "content_scripts" : [ {.. "matches" : ["http:///", "https:///"],.. "js" : ["js/parser.js"].. } ],.. "browser_action": {.. "default_icon": "img/icon128.png",.. "default_popup": "view/popup.html".. }..}..

C:\chrome\view\popup.html

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1981
Entropy (8bit):	4.35691424960598
Encrypted:	false
SSDEEP:	24:0W8RrSJQWUQSUYpPMkXHYQ2dF2/9AghAtpA7NmADtdxAOHoqhXgrVM6:0W8wPTWVeF2/9AghAtpARmA3xAOHfXl6
MD5:	5BD3EAA86900DD8038A03DE0FE54F141
SHA1:	AB9715AC00E87BE914EE564CA2AE0593A8117772
SHA-256:	4AF7A5434F0CE30DE9A54CFE4121CFC5216ADF53C257015F2E61E4AB62F51847
SHA-512:	C3B9319E8D285BEFC4B4A07319DB7A7BB6DDDE6B34CF61A600A295905D861F1ABEF2286809A7BC919F5128F411798C3EA82C611ABA1A561D24B3C20398A3D7CD
Malicious:	false
Preview:	<!doctype html>..<html class="no-js" lang="en">.. <head>.. <meta charset="utf-8"/>.. <meta name="viewport" content="width=device-width, initial-scale=1.0"/>.. <title>Plugin RD</title>.. <link rel="stylesheet" href="../css/foundation.min.css"/>.. <link rel="stylesheet" href="../css/foundation-icons/foundation-icons.css"/>.. <link rel="stylesheet" href="../css/style.css"/>.. </head>.. <body>.. <div class="menu top">.. <div class="logo">.. <img height="100" width="100" alt="logo Real-Debrid" src="../img/logo.png"/>.. </div>.. <div class="login">.. <div id="overview" class="login-contain">.. <a id="connection" target="_blank" href="https://real-debrid.com/" class="hide"></a>.. <p id="username"></p>.. <p id="premium-ctn">Premium: <span id="premium"></span></p>.. </div>.. </div>.. </d

C:\chrome\view\settings.html

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2671
Entropy (8bit):	4.480564009937206
Encrypted:	false
SSDEEP:	48:0W8wPTWVenY+TbgfPSBm996wHZsZhZVoZdW6:RqVeY+TbgfPSBmLnKbVmd9
MD5:	E7D98E6FA95777600A70615A7E14704D
SHA1:	DAA52431DBB670BCAB2C78C83A59533A1063A544
SHA-256:	ECD7ADF68B9C1DF7AEA15CAD6D5E75E8519A9EABC57DBF4C3317DF97DC99C2FA
SHA-512:	2BB3849E6505924D21853D326C6D129427F13618C64D1757AA737266BA57DECD7CD34CAB61204F52F597356B94006B711EB35886F90EBECBAED2B18A6E67B301
Malicious:	false
Preview:	<!doctype html>..<html class="no-js" lang="en">.. <head>.. <meta charset="utf-8"/>.. <meta name="viewport" content="width=device-width, initial-scale=1.0"/>.. <title>Plugin RD</title>.. <link rel="stylesheet" href="../css/foundation.min.css"/>.. <link rel="stylesheet" href="../css/foundation-icons/foundation-icons.css"/>.. <link rel="stylesheet" href="../css/style.css"/>.. </head>.. <body>.. <div class="menu top">.. <div class="logo">.. <img height="100" width="100" alt="logo Real-Debrid" src="../img/logo.png"/>.. </div>.. <div class="login">.. <div id="overview" class="login-contain">.. <a id="connection" target="_blank" href="https://real-debrid.com/" class="hide"></a>.. <p id="username"></p>.. <p id="premium-ctn">Premium: <span id="premium"></span></p>.. </div>.. </div>.. </d

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2786)
Category:	downloaded
Size (bytes):	2791
Entropy (8bit):	5.853018194554053
Encrypted:	false
SSDEEP:	48:+iLOJhKlgZ01LFKaj/Ibx666600uZ3QQLtXcfURhh/JV0KNEBNt84VDhpHRSD0lL:POJQlieIN666600e3QCtM8xV9e9VDhTb
MD5:	2A315F1EF42A56BA97BCDDC8790D60BF
SHA1:	186037C57BBDD30997E944B9DC00C3FD11874D63
SHA-256:	1026597612623718825255023B11DD5CFFE1A3D93E7525D22D9D0B70768145A7
SHA-512:	AF7384D737F2EB49AC9CFCF6F7F6CE94F66482121447114E0357330F81A226DCA23FA5C56A668E93E6B7EEC6E9ECF4F7E313213A149E4F3225FFDF9D3A01037F
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["quordle hints march 29","big bite hot dog sparkling water","arik armstead 49ers","tesla software update 2024.8 7","eclipse michigan","orbital update nms","$300 direct deposit child tax credit","stores closed on easter sunday"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wdzY5czdzEixBcmlrIEFybXN0ZWFkIOKAlCBGb290YmFsbCBkZWZlbnNpdmUgbGluZW1hbjKnCmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBQzhBUUFNQklnQUNFUUVERVFIL3hBQWFBQUFEQUFNQkFBQUFBQUFBQUFBQUFBQUFCUWNFQmdnQy84UUFLaEFBQWdFRUFBWUNBZ0lEQVFBQUFBQUFBUUlEQUFRRkVRWVNJVEZoZ1NKUkJ4TkJjU015WWhUL3

Static File Info

General

File type:	Google Chrome extension, version 3
Entropy (8bit):	7.990907397154748
TrID:	Google Chrome Extension (11504/1) 100.00%
File name:	OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx
File size:	230'893 bytes
MD5:	063c62c7c191f34e3adf27912b679c46
SHA1:	237cf820913d7320f5a379148d76da801fe96139
SHA256:	dc2b59a19680bd2e88c4a89d24b5695819808fff2acb41ce827ad6aad2e51987
SHA512:	ca65087efeef9df2031496fe6fdc68166cfa5ae2a8600ac721a0f8963832c41e4658fcfc5d756fbee7896df0859e8f8b7ba2d8c77b35967476eb6b7b13b5528b
SSDEEP:	3072:0TKb6CroNW7QAs/UvUExqLdZ86/Rs7moq8wHystXr+CANQ57PZxYUSPFSi2hSx3G:iKbdrVs/UBxYNpJCFNQVPsUSohSx3O/
TLSH:	DC34126D374764A2C71B46B6D0A2B253C560CA0C8DAAB4677C034F6B5E31BBC5632D3E
File Content Preview:	Cr24..............0.."0....H.............0...........\7c.<.........Fto.8.2'5..qk...%.....2....C.F..9.#..e.xQ.......[...L\|.....3>/.....u..:T.7...(..yM....?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1......s...2..{*.6....Pp....obM

File Icon


Icon Hash:	72e2a2a292a2a2b2

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 11:45:37.856028080 CET	49675	443	192.168.2.4	173.222.162.32
Mar 29, 2024 11:45:39.668528080 CET	49678	443	192.168.2.4	104.46.162.224
Mar 29, 2024 11:45:43.294199944 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.294234991 CET	443	49734	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.294296026 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.294608116 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.294646025 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.294702053 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.296200037 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.296211958 CET	443	49734	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.296771049 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.296792984 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.346424103 CET	49737	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.346440077 CET	443	49737	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.346487999 CET	49737	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.347080946 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.347103119 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.347198009 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.347666979 CET	49737	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.347677946 CET	443	49737	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.347867966 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.347882032 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.563863039 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.564129114 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.564152002 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.565061092 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.565126896 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.566149950 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.566207886 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.566437006 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.566452980 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.567228079 CET	443	49734	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.567404032 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.567423105 CET	443	49734	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.568330050 CET	443	49734	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.568387985 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.568659067 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.568710089 CET	443	49734	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.568793058 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.568798065 CET	443	49734	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.607420921 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.622581959 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.626808882 CET	443	49737	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.627032995 CET	49737	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.627041101 CET	443	49737	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.628122091 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.628179073 CET	443	49737	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.628236055 CET	49737	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.628356934 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.628376961 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.628686905 CET	49737	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.628741026 CET	443	49737	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.628871918 CET	49737	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.628879070 CET	443	49737	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.629245996 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.629301071 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.629563093 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.629616976 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.682780981 CET	49737	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.683043003 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.683053017 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.745183945 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.844521999 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.844573021 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.844624996 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.844671965 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.844705105 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.847712994 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:43.847793102 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.847959042 CET	49735	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:43.847975969 CET	443	49735	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.162204981 CET	443	49737	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.162353039 CET	443	49737	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.164315939 CET	49737	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.164886951 CET	49737	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.164900064 CET	443	49737	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.167803049 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.177743912 CET	443	49734	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.177850962 CET	443	49734	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.177984953 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.178323030 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.178339005 CET	443	49734	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.178358078 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.178411007 CET	49734	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.179831982 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.179867029 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.179948092 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.180172920 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.180186033 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.208246946 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.299529076 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.299571991 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.299613953 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.299668074 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.299686909 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.299705982 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.301698923 CET	49738	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.301713943 CET	443	49738	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.451986074 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.452256918 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.452281952 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.452599049 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.452892065 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.452941895 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.453021049 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.498820066 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.498828888 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.720994949 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.721039057 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.721087933 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.721093893 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.721116066 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.721163988 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.721168995 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.721226931 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.721682072 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.721699953 CET	443	49741	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:44.721710920 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:44.721743107 CET	49741	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:46.943727016 CET	49743	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:46.943763018 CET	443	49743	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:46.943836927 CET	49743	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:46.944029093 CET	49743	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:46.944040060 CET	443	49743	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:47.215218067 CET	443	49743	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:47.215523958 CET	49743	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:47.215552092 CET	443	49743	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:47.215867043 CET	443	49743	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:47.216152906 CET	49743	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:47.216209888 CET	443	49743	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:47.260842085 CET	49743	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:47.463928938 CET	49675	443	192.168.2.4	173.222.162.32
Mar 29, 2024 11:45:47.861419916 CET	49744	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:47.861452103 CET	443	49744	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:47.861525059 CET	49744	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:47.862889051 CET	49744	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:47.862901926 CET	443	49744	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.184954882 CET	443	49744	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.185023069 CET	49744	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.187695026 CET	49744	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.187705994 CET	443	49744	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.187911034 CET	443	49744	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.225671053 CET	49744	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.272233009 CET	443	49744	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.493604898 CET	443	49744	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.493818998 CET	443	49744	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.493889093 CET	49744	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.493889093 CET	49744	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.493913889 CET	49744	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.493928909 CET	443	49744	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.531713963 CET	49745	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.531745911 CET	443	49745	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.531838894 CET	49745	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.532095909 CET	49745	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.532111883 CET	443	49745	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.851206064 CET	443	49745	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.851278067 CET	49745	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.852731943 CET	49745	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.852744102 CET	443	49745	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.852989912 CET	443	49745	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:48.854178905 CET	49745	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:48.900232077 CET	443	49745	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:49.168659925 CET	443	49745	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:49.168711901 CET	443	49745	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:49.168756962 CET	49745	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:49.169857025 CET	49745	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:49.169876099 CET	443	49745	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:49.169888973 CET	49745	443	192.168.2.4	23.56.8.114
Mar 29, 2024 11:45:49.169894934 CET	443	49745	23.56.8.114	192.168.2.4
Mar 29, 2024 11:45:57.215384960 CET	443	49743	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:57.215436935 CET	443	49743	142.251.111.99	192.168.2.4
Mar 29, 2024 11:45:57.215492010 CET	49743	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:57.730726004 CET	49743	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:45:57.730746984 CET	443	49743	142.251.111.99	192.168.2.4
Mar 29, 2024 11:46:00.172550917 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:00.172574997 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:00.172647953 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:00.174468040 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:00.174478054 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:00.579236031 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:00.579324007 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:00.583435059 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:00.583442926 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:00.583694935 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:00.632616043 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:00.950151920 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:00.992242098 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:01.212172031 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:01.214869976 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:01.214880943 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:01.214895964 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:01.214961052 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:01.215003967 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:01.215003967 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:01.215018034 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:01.215028048 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:01.215054035 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:01.215068102 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:01.215101957 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:01.218398094 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:01.430463076 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:01.430463076 CET	49752	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:01.430476904 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:01.430485010 CET	443	49752	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:09.044014931 CET	80	49723	69.164.0.0	192.168.2.4
Mar 29, 2024 11:46:09.044332981 CET	49723	80	192.168.2.4	69.164.0.0
Mar 29, 2024 11:46:09.044444084 CET	49723	80	192.168.2.4	69.164.0.0
Mar 29, 2024 11:46:09.138557911 CET	80	49723	69.164.0.0	192.168.2.4
Mar 29, 2024 11:46:37.887964964 CET	49758	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:37.888001919 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:37.888092041 CET	49758	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:37.888453960 CET	49758	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:37.888468981 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.289408922 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.289525032 CET	49758	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:38.293776035 CET	49758	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:38.293787003 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.293991089 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.302359104 CET	49758	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:38.348241091 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.682336092 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.682356119 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.682368994 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.682454109 CET	49758	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:38.682467937 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.682480097 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.682517052 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.682650089 CET	49758	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:38.688235044 CET	49758	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:38.688246965 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:38.688270092 CET	49758	443	192.168.2.4	13.85.23.86
Mar 29, 2024 11:46:38.688276052 CET	443	49758	13.85.23.86	192.168.2.4
Mar 29, 2024 11:46:46.997024059 CET	49760	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:46:46.997062922 CET	443	49760	142.251.111.99	192.168.2.4
Mar 29, 2024 11:46:46.997133970 CET	49760	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:46:46.997443914 CET	49760	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:46:46.997457981 CET	443	49760	142.251.111.99	192.168.2.4
Mar 29, 2024 11:46:47.269812107 CET	443	49760	142.251.111.99	192.168.2.4
Mar 29, 2024 11:46:47.270107985 CET	49760	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:46:47.270124912 CET	443	49760	142.251.111.99	192.168.2.4
Mar 29, 2024 11:46:47.270416975 CET	443	49760	142.251.111.99	192.168.2.4
Mar 29, 2024 11:46:47.270739079 CET	49760	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:46:47.270796061 CET	443	49760	142.251.111.99	192.168.2.4
Mar 29, 2024 11:46:47.323565006 CET	49760	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:46:57.271032095 CET	443	49760	142.251.111.99	192.168.2.4
Mar 29, 2024 11:46:57.271094084 CET	443	49760	142.251.111.99	192.168.2.4
Mar 29, 2024 11:46:57.271214962 CET	49760	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:46:58.620305061 CET	49724	80	192.168.2.4	72.21.81.240
Mar 29, 2024 11:46:58.715687037 CET	80	49724	72.21.81.240	192.168.2.4
Mar 29, 2024 11:46:58.715754986 CET	49724	80	192.168.2.4	72.21.81.240
Mar 29, 2024 11:47:10.309137106 CET	49760	443	192.168.2.4	142.251.111.99
Mar 29, 2024 11:47:10.309178114 CET	443	49760	142.251.111.99	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 11:45:42.429539919 CET	53	62584	1.1.1.1	192.168.2.4
Mar 29, 2024 11:45:42.541352987 CET	53	60906	1.1.1.1	192.168.2.4
Mar 29, 2024 11:45:42.551425934 CET	53	65201	1.1.1.1	192.168.2.4
Mar 29, 2024 11:45:43.166804075 CET	55579	53	192.168.2.4	1.1.1.1
Mar 29, 2024 11:45:43.167366028 CET	51798	53	192.168.2.4	1.1.1.1
Mar 29, 2024 11:45:43.262270927 CET	53	51798	1.1.1.1	192.168.2.4
Mar 29, 2024 11:45:43.262285948 CET	53	55579	1.1.1.1	192.168.2.4
Mar 29, 2024 11:45:43.451436043 CET	53	62686	1.1.1.1	192.168.2.4
Mar 29, 2024 11:45:55.217601061 CET	53	56910	1.1.1.1	192.168.2.4
Mar 29, 2024 11:46:00.357454062 CET	53	60210	1.1.1.1	192.168.2.4
Mar 29, 2024 11:46:10.203959942 CET	138	138	192.168.2.4	192.168.2.255
Mar 29, 2024 11:46:19.068030119 CET	53	64528	1.1.1.1	192.168.2.4
Mar 29, 2024 11:46:41.482543945 CET	53	60185	1.1.1.1	192.168.2.4
Mar 29, 2024 11:46:42.343456030 CET	53	57270	1.1.1.1	192.168.2.4
Mar 29, 2024 11:47:10.407445908 CET	53	58806	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 29, 2024 11:45:43.166804075 CET	192.168.2.4	1.1.1.1	0xeebe	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:45:43.167366028 CET	192.168.2.4	1.1.1.1	0x45b0	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 29, 2024 11:45:43.262270927 CET	1.1.1.1	192.168.2.4	0x45b0	No error (0)	www.google.com		65	IN (0x0001)	false
Mar 29, 2024 11:45:43.262285948 CET	1.1.1.1	192.168.2.4	0xeebe	No error (0)	www.google.com	142.251.111.99	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:45:43.262285948 CET	1.1.1.1	192.168.2.4	0xeebe	No error (0)	www.google.com	142.251.111.103	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:45:43.262285948 CET	1.1.1.1	192.168.2.4	0xeebe	No error (0)	www.google.com	142.251.111.106	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:45:43.262285948 CET	1.1.1.1	192.168.2.4	0xeebe	No error (0)	www.google.com	142.251.111.104	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:45:43.262285948 CET	1.1.1.1	192.168.2.4	0xeebe	No error (0)	www.google.com	142.251.111.147	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:45:43.262285948 CET	1.1.1.1	192.168.2.4	0xeebe	No error (0)	www.google.com	142.251.111.105	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	142.251.111.99	443	7780	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:45:43 UTC	796	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-03-29 10:45:43 UTC	1703	IN	HTTP/1.1 200 OK Date: Fri, 29 Mar 2024 10:45:43 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-gEBEsxdMPpYdSZivgDGSwg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-03-29 10:45:43 UTC	1703	IN	Data Raw: 36 64 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 71 75 6f 72 64 6c 65 20 68 69 6e 74 73 20 6d 61 72 63 68 20 32 39 22 2c 22 62 69 67 20 62 69 74 65 20 68 6f 74 20 64 6f 67 20 73 70 61 72 6b 6c 69 6e 67 20 77 61 74 65 72 22 2c 22 61 72 69 6b 20 61 72 6d 73 74 65 61 64 20 34 39 65 72 73 22 2c 22 74 65 73 6c 61 20 73 6f 66 74 77 61 72 65 20 75 70 64 61 74 65 20 32 30 32 34 2e 38 20 37 22 2c 22 65 63 6c 69 70 73 65 20 6d 69 63 68 69 67 61 6e 22 2c 22 6f 72 62 69 74 61 6c 20 75 70 64 61 74 65 20 6e 6d 73 22 2c 22 24 33 30 30 20 64 69 72 65 63 74 20 64 65 70 6f 73 69 74 20 63 68 69 6c 64 20 74 61 78 20 63 72 65 64 69 74 22 2c 22 73 74 6f 72 65 73 20 63 6c 6f 73 65 64 20 6f 6e 20 65 61 73 74 65 72 20 73 75 6e 64 61 79 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 Data Ascii: 6d4)]}'["",["quordle hints march 29","big bite hot dog sparkling water","arik armstead 49ers","tesla software update 2024.8 7","eclipse michigan","orbital update nms","$300 direct deposit child tax credit","stores closed on easter sunday"],["","","",""
2024-03-29 10:45:43 UTC	52	IN	Data Raw: 51 58 4a 51 54 6c 4e 59 4d 6d 46 30 65 6d 6f 77 55 44 5a 57 64 56 6c 75 62 47 31 61 52 47 39 6e 54 55 39 75 57 43 74 55 4d 6e 4a 76 59 58 42 34 4d 6a 0d 0a Data Ascii: QXJQTlNYMmF0emowUDZWdVlubG1aRG9nTU9uWCtUMnJvYXB4Mj
2024-03-29 10:45:43 UTC	1050	IN	Data Raw: 34 31 33 0d 0a 46 68 61 6b 78 6c 52 46 5a 4a 62 32 39 76 63 47 78 4b 62 33 4a 58 4f 43 39 34 63 6d 67 34 53 33 70 33 64 45 74 69 63 54 64 56 4e 6b 35 32 59 69 39 4a 63 57 59 72 61 6a 4a 59 4d 6d 51 72 53 33 68 51 65 56 5a 74 4e 55 31 59 61 47 78 30 59 6c 70 74 55 7a 52 32 55 31 56 45 63 57 52 47 52 55 67 72 65 45 49 72 4b 32 39 49 64 6e 68 56 62 47 6c 57 56 55 68 4c 62 30 46 42 63 47 46 68 57 58 4e 4f 51 6d 4a 6c 62 54 5a 58 54 57 78 32 62 58 6c 49 59 6d 70 73 59 6b 52 34 51 6e 68 73 62 58 4d 77 55 32 74 56 4e 7a 51 72 4d 6a 45 77 61 6e 52 59 53 56 6b 72 55 79 39 6a 4b 33 52 44 63 31 68 48 56 7a 68 4e 61 30 56 58 4f 55 67 35 55 54 46 79 4e 6e 42 5a 54 7a 6c 4e 4f 45 64 4d 56 6a 64 75 61 33 55 31 62 57 64 59 62 45 70 46 61 57 68 70 5a 43 39 59 55 32 78 4d Data Ascii: 413FhakxlRFZJb29vcGxKb3JXOC94cmg4S3p3dEticTdVNk52Yi9JcWYrajJYMmQrS3hQeVZtNU1YaGx0YlptUzR2U1VEcWRGRUgreEIrK29IdnhVbGlWVUhLb0FBcGFhWXNOQmJlbTZXTWx2bXlIYmpsYkR4QnhsbXMwU2tVNzQrMjEwanRYSVkrUy9jK3RDc1hHVzhNa0VXOUg5UTFyNnBZTzlNOEdMVjdua3U1bWdYbEpFaWhpZC9YU2xM
2024-03-29 10:45:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	142.251.111.99	443	7780	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:45:43 UTC	699	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-03-29 10:45:44 UTC	1480	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmpTArGNe3mrAGIjDCQcX2g0chw2hR2lhqwQl7GKIAAERYj72DhBlTjaLxXCCV9uiNHZqyaKNCQKQb3CUyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgsI2LeasAYQiPuROhIEZqUwKw Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Fri, 29 Mar 2024 10:45:44 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-03-29-10; expires=Sun, 28-Apr-2024 10:45:44 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-29 10:45:44 UTC	458	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	142.251.111.99	443	7780	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:45:43 UTC	542	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-03-29 10:45:44 UTC	1398	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmpTArGNe3mrAGIjCxSZ32kqtf1wo2hYSgiWWMiLq2BR_jmSiISbxHrDb_-NdiagK04Su2Nr5B77ol5IgyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgsI2LeasAYQocixMxIEZqUwKw Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Fri, 29 Mar 2024 10:45:44 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-03-29-10; expires=Sun, 28-Apr-2024 10:45:44 GMT; path=/; domain=.google.com; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-29 10:45:44 UTC	417	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	142.251.111.99	443	7780	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:45:44 UTC	738	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmpTArGNe3mrAGIjCxSZ32kqtf1wo2hYSgiWWMiLq2BR_jmSiISbxHrDb_-NdiagK04Su2Nr5B77ol5IgyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2024-03-29-10
2024-03-29 10:45:44 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 29 Mar 2024 10:45:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3112 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-29 10:45:44 UTC	896	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2024-03-29 10:45:44 UTC	1252	IN	Data Raw: 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 67 54 4b 2d 61 44 45 38 52 4c 65 6c 6f 38 31 34 47 58 48 49 36 79 44 4b 37 2d 53 73 69 48 Data Ascii: llback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="gTK-aDE8RLelo814GXHI6yDK7-SsiH
2024-03-29 10:45:44 UTC	964	IN	Data Raw: 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 Data Ascii: hen Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	142.251.111.99	443	7780	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:45:44 UTC	912	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmpTArGNe3mrAGIjDCQcX2g0chw2hR2lhqwQl7GKIAAERYj72DhBlTjaLxXCCV9uiNHZqyaKNCQKQb3CUyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2024-03-29-10
2024-03-29 10:45:44 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 29 Mar 2024 10:45:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3184 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-29 10:45:44 UTC	896	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2024-03-29 10:45:44 UTC	1252	IN	Data Raw: 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 4e 4b 75 72 36 76 Data Ascii: pt><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="NKur6v
2024-03-29 10:45:44 UTC	1036	IN	Data Raw: 31 35 70 78 20 30 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 Data Ascii: 15px 0; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire short

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	23.56.8.114	443

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:45:48 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-29 10:45:48 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=159487 Date: Fri, 29 Mar 2024 10:45:48 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	23.56.8.114	443

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:45:48 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-29 10:45:49 UTC	531	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Content-Type: application/octet-stream ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=159439 Date: Fri, 29 Mar 2024 10:45:49 GMT Content-Length: 55 Connection: close X-CID: 2
2024-03-29 10:45:49 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49752	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:46:00 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gfryM5gE1NH7xWc&MD=kPKxn24p HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-03-29 10:46:01 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f8be6fba-7135-4daf-b361-9b092dfbf49e MS-RequestId: 2d1c7252-e3c9-479b-be10-ddeb6ed3dc12 MS-CV: n1ZgqnCTN0ywurOV.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 29 Mar 2024 10:46:00 GMT Connection: close Content-Length: 24490
2024-03-29 10:46:01 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-03-29 10:46:01 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49758	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:46:38 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gfryM5gE1NH7xWc&MD=kPKxn24p HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-03-29 10:46:38 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: ace9448e-478f-41d0-91cb-68359fbe1737 MS-RequestId: 98baa530-89d1-49fe-8d24-26f0bb2a0c4d MS-CV: KurL5S+/8UeIry1D.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 29 Mar 2024 10:46:37 GMT Connection: close Content-Length: 25457
2024-03-29 10:46:38 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-03-29 10:46:38 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	11:45:40
Start date:	29/03/2024
Path:	C:\Windows\System32\7za.exe
Wow64 process (32bit):	true
Commandline:	7za.exe x -oC:\chrome "C:\Users\user\Desktop\OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx"
Imagebase:	0x270000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:45:40
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:45:40
Start date:	29/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\chrome
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:45:41
Start date:	29/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1664 --field-trial-handle=2016,i,859544963767796602,16029275681761701210,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\chrome\LICENSE

C:\chrome\_locales\en\messages.json

C:\chrome\_locales\fr\messages.json

C:\chrome\_metadata\verified_contents.json

C:\chrome\css\foundation-icons\foundation-icons.css

C:\chrome\css\foundation-icons\foundation-icons.eot

C:\chrome\css\foundation-icons\foundation-icons.svg

C:\chrome\css\foundation-icons\foundation-icons.ttf

C:\chrome\css\foundation-icons\foundation-icons.woff

C:\chrome\css\foundation-icons\svgs\fi-clipboard-notes.svg

C:\chrome\css\foundation-icons\svgs\fi-loop.svg

C:\chrome\css\foundation.min.css

C:\chrome\css\style.css

C:\chrome\img\icon128.png

C:\chrome\img\icon16.png

C:\chrome\img\icon32.png

C:\chrome\img\icon48.png

C:\chrome\img\loading.gif

C:\chrome\img\logo.png

C:\chrome\img\offline.svg

C:\chrome\js\background.js

C:\chrome\js\parser.js

C:\chrome\js\popup.js

C:\chrome\js\selection.js

C:\chrome\js\settings.js

C:\chrome\manifest.json

C:\chrome\view\popup.html

Windows Analysis Report
OEFKKGFCAHBECCGCKJGBNFCLCMNJGIDG_1_5_9_0 (1).crx