Edit tour

Windows Analysis Report
http://rakuten.co.jp.rakutle.xyz/

Overview

General Information

Sample URL:	http://rakuten.co.jp.rakutle.xyz/
Analysis ID:	1427112
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2408 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1988,i,11608860953232660502,2173063063525198547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://rakuten.co.jp.rakutle.xyz/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: unknown

DNS traffic detected: queries for: rakuten.co.jp.rakutle.xyz

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713312146898&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.33.134.2:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.134.2:443 -> 192.168.2.5:49720 version: TLS 1.2

Source: classification engine

Classification label: mal68.troj.win@20/6@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1988,i,11608860953232660502,2173063063525198547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://rakuten.co.jp.rakutle.xyz/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1988,i,11608860953232660502,2173063063525198547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://rakuten.co.jp.rakutle.xyz/	17%	Virustotal		Browse
http://rakuten.co.jp.rakutle.xyz/	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
rakuten.co.jp.rakutle.xyz	17%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
rakuten.co.jp.rakutle.xyz	172.67.206.68	true	true	17%, Virustotal, Browse	unknown
www.google.com	74.125.136.99	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	69.164.42.0	true	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
74.125.136.99	www.google.com	United States	15169	GOOGLEUS	false
104.21.58.190	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427112
Start date and time:	2024-04-17 02:01:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://rakuten.co.jp.rakutle.xyz/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.troj.win@20/6@6/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.105.94, 64.233.185.139, 64.233.185.101, 64.233.185.113, 64.233.185.138, 64.233.185.100, 64.233.185.102, 74.125.138.84, 34.104.35.123, 40.68.123.157, 72.21.81.240, 192.229.211.108, 20.242.39.171, 13.85.23.206, 74.125.138.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 23:02:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9666196416925548
Encrypted:	false
SSDEEP:	48:87dcTgkLHpidAKZdA19ehwiZUklqehRy+3:8Sfvey
MD5:	D1972CFA045DB3BB77CC6CE524247808
SHA1:	546462059EAC897E1245A9618EE71B24029C9D16
SHA-256:	5CC4BB1614F3B93C9E5446C9C5B50416DEA9742C5522C0B122C963D847E7DCE1
SHA-512:	C303C8649D3397D249217EE2EACED3E2B8B5B798159A5E2E3475C46DA8FA8C003477E555CFCA57F9D33124B4A0C333A79EECE66835DE8176548519F0D3572116
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......Z...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XT.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XT.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XT.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XT............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XW............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............W.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 23:02:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9791196237555435
Encrypted:	false
SSDEEP:	48:8SdcTgkLHpidAKZdA1weh/iZUkAQkqehOy+2:8RfV9Qjy
MD5:	D0838580A79C1CDFB6320741EA8161BC
SHA1:	E2FC713C189C0C16524EA8838464CB1AD6CF6DAB
SHA-256:	C19024E6557AF4533807E7CA72C9A42B161C820C5D3CC83FABD23E4BBF876B43
SHA-512:	C68EDE6A6563FF273EB089986FC6BC5737B699552760E9695638F746755E0FEECA326EFA1F95918E0B7FAEF585787C69C0D1E373AC0994AE4692EC6F57896273
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....pE.Z...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XT.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XT.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XT.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XT............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XW............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............W.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9946153953580534
Encrypted:	false
SSDEEP:	48:8x1dcTgksHpidAKZdA14tseh7sFiZUkmgqeh7soy+BX:8xEf4nyy
MD5:	3FCB432DF76794F0E69512F867320494
SHA1:	9C00D994298414B2BA9C6E58B219992574951CF1
SHA-256:	F51DE0A6209875D14483D18B890EA133EE754411A311BABF335C8C4D419D9405
SHA-512:	985C18DE64090289CBEA9F004A63B965F959E3E063D17A500D647BE7657046B1F13BEE82070C95347036B8BF1335FBAFED85621987634841415CE8EB84C7298C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XT.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XT.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XT.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XT............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............W.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 23:02:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.980848743823937
Encrypted:	false
SSDEEP:	48:8JdcTgkLHpidAKZdA1vehDiZUkwqehKy+R:8gf2Ay
MD5:	A5CEA7ED425ABDF4469CCDC51E9401E2
SHA1:	D586A99BF07CA96C1E08F63CEFDC2F28BCBA959F
SHA-256:	345C188F4DD7D47F31CFBB39300566578D815773519532E6E9BE0EF8C0DE0572
SHA-512:	2A24D046BAF578C96EE93096AB71D60C392D09FBA1ED11E892105EEEAE3421E4F734BE9496DC89B9A1416C5976656D89689E56F2F6E9FD91F77668D91D68D8BC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....B..Z...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XT.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XT.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XT.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XT............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XW............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............W.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 23:02:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.971192210466872
Encrypted:	false
SSDEEP:	48:8PadcTgkLHpidAKZdA1hehBiZUk1W1qehMy+C:8PZfW9sy
MD5:	893D259980C179C7CE573388E45792F1
SHA1:	2D44FD6E3A10A99A318ECE100D2C04DD0513A818
SHA-256:	AE60D2DD43AD192B0447EF63BAFE1D0F6512FCB83BEF3C1687B0CB9907710FC8
SHA-512:	604A26EBF9D8ED9C758B203E1513A26BDB7EEB5EB13FAAF33C0C07985EE44E59F7E69C28768B3CF39EE18755AC6B6818664887C332DEE55FFD334CBAEC6F4A27
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......Z...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XT.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XT.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XT.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XT............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XW............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............W.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 23:02:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9763084598695237
Encrypted:	false
SSDEEP:	48:8FJdcTgkLHpidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbyy+yT+:8efoT/TbxWOvTbyy7T
MD5:	60FCD7210E1B2209B22653AA0C210E8A
SHA1:	15F9F036B38788CCFC129D37748E2FCC56BBEF28
SHA-256:	0D18E0D162ACF10E2F8885D53B82A1318E2CC7B6AAED62295E5CB34C01B9F0DE
SHA-512:	E9D3A39B5A0D561E30692E8A95092356DACC9C699D5892B649481E1F22DF4DBE081A6A80D1686062119FA6B6C15C70AFB8FDAD096A89E512BBBF81622351B883
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....j\.Z...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XT.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XT.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XT.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XT............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XW............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............W.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 02:02:36.892606974 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:36.892611027 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:37.001960993 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:44.935365915 CEST	49710	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:44.935415983 CEST	443	49710	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:44.935540915 CEST	49710	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:44.935772896 CEST	49710	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:44.935787916 CEST	443	49710	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:45.235558033 CEST	49711	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:02:45.235615969 CEST	443	49711	74.125.136.99	192.168.2.5
Apr 17, 2024 02:02:45.235691071 CEST	49711	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:02:45.235886097 CEST	49711	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:02:45.235898018 CEST	443	49711	74.125.136.99	192.168.2.5
Apr 17, 2024 02:02:45.355493069 CEST	443	49710	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:45.355892897 CEST	443	49710	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:45.355947971 CEST	49710	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:45.375391006 CEST	49710	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:45.375433922 CEST	443	49710	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:45.375785112 CEST	49712	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:45.375900030 CEST	443	49712	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:45.375981092 CEST	49712	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:45.376204967 CEST	49712	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:45.376240015 CEST	443	49712	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:45.454267025 CEST	443	49711	74.125.136.99	192.168.2.5
Apr 17, 2024 02:02:45.454591990 CEST	49711	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:02:45.454659939 CEST	443	49711	74.125.136.99	192.168.2.5
Apr 17, 2024 02:02:45.455569029 CEST	443	49711	74.125.136.99	192.168.2.5
Apr 17, 2024 02:02:45.455658913 CEST	49711	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:02:45.456933975 CEST	49711	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:02:45.457012892 CEST	443	49711	74.125.136.99	192.168.2.5
Apr 17, 2024 02:02:45.496937037 CEST	49711	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:02:45.497016907 CEST	443	49711	74.125.136.99	192.168.2.5
Apr 17, 2024 02:02:45.544826984 CEST	49711	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:02:45.796173096 CEST	443	49712	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:45.796490908 CEST	443	49712	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:45.796562910 CEST	49712	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:45.796642065 CEST	49712	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:45.796679974 CEST	443	49712	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:46.503005028 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:46.503021002 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:46.603729010 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:46.838733912 CEST	49715	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:46.838809013 CEST	443	49715	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:46.838866949 CEST	49715	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:46.839684010 CEST	49716	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:46.839724064 CEST	443	49716	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:46.839780092 CEST	49716	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:46.840169907 CEST	49715	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:46.840186119 CEST	443	49715	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:46.840523005 CEST	49716	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:46.840543032 CEST	443	49716	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.260477066 CEST	443	49715	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.260690928 CEST	49715	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.260759115 CEST	443	49715	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.260802031 CEST	49715	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.261215925 CEST	443	49716	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.261311054 CEST	49717	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.261348963 CEST	443	49717	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.261415958 CEST	49717	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.261539936 CEST	49716	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.261697054 CEST	443	49716	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.261738062 CEST	49718	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.261750937 CEST	49716	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.261770010 CEST	443	49718	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.261835098 CEST	49718	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.262073994 CEST	49717	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.262088060 CEST	443	49717	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.262213945 CEST	49718	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.262233019 CEST	443	49718	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.682163954 CEST	443	49718	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.682279110 CEST	443	49717	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.682796001 CEST	443	49717	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.682854891 CEST	49717	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.682873011 CEST	443	49718	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.682921886 CEST	49718	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.791299105 CEST	49718	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.791330099 CEST	443	49718	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:47.791498899 CEST	49717	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:47.791532040 CEST	443	49717	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:48.000871897 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:48.000969887 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:48.110778093 CEST	49719	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.110846996 CEST	443	49719	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.110974073 CEST	49719	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.114032984 CEST	49719	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.114062071 CEST	443	49719	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.344566107 CEST	443	49719	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.344691038 CEST	49719	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.347896099 CEST	49719	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.347924948 CEST	443	49719	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.348231077 CEST	443	49719	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.393721104 CEST	49719	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.458830118 CEST	49719	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.504112959 CEST	443	49719	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.564007998 CEST	443	49719	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.564076900 CEST	443	49719	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.564161062 CEST	49719	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.564518929 CEST	49719	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.564543962 CEST	443	49719	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.564659119 CEST	49719	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.564665079 CEST	443	49719	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.604470968 CEST	49720	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.604537964 CEST	443	49720	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.604620934 CEST	49720	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.605459929 CEST	49720	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.605478048 CEST	443	49720	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.817693949 CEST	443	49720	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.817795038 CEST	49720	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.819071054 CEST	49720	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.819087029 CEST	443	49720	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.819355011 CEST	443	49720	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:48.820624113 CEST	49720	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:48.868135929 CEST	443	49720	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:49.025702953 CEST	443	49720	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:49.025770903 CEST	443	49720	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:49.025824070 CEST	49720	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:49.026650906 CEST	49720	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:49.026680946 CEST	443	49720	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:49.026698112 CEST	49720	443	192.168.2.5	23.33.134.2
Apr 17, 2024 02:02:49.026704073 CEST	443	49720	23.33.134.2	192.168.2.5
Apr 17, 2024 02:02:53.859458923 CEST	49721	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:53.859543085 CEST	443	49721	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:53.859599113 CEST	49721	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:53.859756947 CEST	49722	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:53.859808922 CEST	443	49722	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:53.859853983 CEST	49722	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:53.860285044 CEST	49721	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:53.860299110 CEST	443	49721	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:53.860445023 CEST	49722	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:53.860460043 CEST	443	49722	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.280282974 CEST	443	49721	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.280581951 CEST	443	49722	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.280584097 CEST	49721	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.280688047 CEST	443	49721	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.280734062 CEST	49721	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.281111956 CEST	49723	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.281152964 CEST	443	49723	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.281198025 CEST	49723	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.281287909 CEST	443	49722	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.281332016 CEST	49722	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.281369925 CEST	49722	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.281384945 CEST	443	49722	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.281758070 CEST	49724	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.281790018 CEST	443	49724	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.281837940 CEST	49724	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.282258034 CEST	49723	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.282269955 CEST	443	49723	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.282499075 CEST	49724	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.282516956 CEST	443	49724	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.702548027 CEST	443	49723	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.702769995 CEST	49723	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.702882051 CEST	443	49723	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.702934027 CEST	49723	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.704020023 CEST	443	49724	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.705389023 CEST	443	49724	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:54.705435991 CEST	49724	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.706084013 CEST	49724	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:02:54.706096888 CEST	443	49724	104.21.58.190	192.168.2.5
Apr 17, 2024 02:02:55.448225975 CEST	443	49711	74.125.136.99	192.168.2.5
Apr 17, 2024 02:02:55.448376894 CEST	443	49711	74.125.136.99	192.168.2.5
Apr 17, 2024 02:02:55.449251890 CEST	49711	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:02:57.365542889 CEST	49711	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:02:57.365557909 CEST	443	49711	74.125.136.99	192.168.2.5
Apr 17, 2024 02:02:58.317028999 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:58.317348003 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:58.319998026 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:58.320041895 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:58.320107937 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:58.320772886 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:58.320791006 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:58.472419024 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:58.472436905 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:58.718254089 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:58.718332052 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:58.773883104 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:58.773905039 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:58.774420977 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:58.774477959 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:58.776022911 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:58.776066065 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:58.776313066 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:58.776320934 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:59.274673939 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:59.274792910 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:59.275208950 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:59.275280952 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:59.275305986 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:59.275322914 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:59.282237053 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:59.282258034 CEST	443	49729	23.1.237.91	192.168.2.5
Apr 17, 2024 02:02:59.282277107 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:02:59.282342911 CEST	49729	443	192.168.2.5	23.1.237.91
Apr 17, 2024 02:03:24.730849028 CEST	49732	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:24.730916977 CEST	443	49732	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:24.730988026 CEST	49732	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:24.731489897 CEST	49733	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:24.731522083 CEST	443	49733	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:24.731575966 CEST	49733	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:24.732413054 CEST	49733	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:24.732431889 CEST	443	49733	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:24.732559919 CEST	49732	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:24.732578993 CEST	443	49732	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.152489901 CEST	443	49733	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.153366089 CEST	443	49732	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.153592110 CEST	443	49733	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.153850079 CEST	49733	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.154267073 CEST	443	49732	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.154330015 CEST	49732	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.168535948 CEST	49732	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.168564081 CEST	443	49732	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.169282913 CEST	49734	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.169322968 CEST	443	49734	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.169397116 CEST	49734	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.169663906 CEST	49733	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.169678926 CEST	443	49733	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.170156002 CEST	49735	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.170180082 CEST	443	49735	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.170243979 CEST	49735	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.170759916 CEST	49734	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.170778990 CEST	443	49734	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.170907021 CEST	49735	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.170917988 CEST	443	49735	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.592071056 CEST	443	49734	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.592664957 CEST	49734	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.592725039 CEST	443	49734	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.592936039 CEST	49734	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.594440937 CEST	443	49735	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.594791889 CEST	49735	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:25.594888926 CEST	443	49735	104.21.58.190	192.168.2.5
Apr 17, 2024 02:03:25.594949007 CEST	49735	443	192.168.2.5	104.21.58.190
Apr 17, 2024 02:03:45.192259073 CEST	49738	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:03:45.192300081 CEST	443	49738	74.125.136.99	192.168.2.5
Apr 17, 2024 02:03:45.192372084 CEST	49738	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:03:45.192661047 CEST	49738	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:03:45.192673922 CEST	443	49738	74.125.136.99	192.168.2.5
Apr 17, 2024 02:03:45.406972885 CEST	443	49738	74.125.136.99	192.168.2.5
Apr 17, 2024 02:03:45.407288074 CEST	49738	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:03:45.407306910 CEST	443	49738	74.125.136.99	192.168.2.5
Apr 17, 2024 02:03:45.407601118 CEST	443	49738	74.125.136.99	192.168.2.5
Apr 17, 2024 02:03:45.408018112 CEST	49738	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:03:45.408077002 CEST	443	49738	74.125.136.99	192.168.2.5
Apr 17, 2024 02:03:45.456433058 CEST	49738	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:03:55.409749985 CEST	443	49738	74.125.136.99	192.168.2.5
Apr 17, 2024 02:03:55.409817934 CEST	443	49738	74.125.136.99	192.168.2.5
Apr 17, 2024 02:03:55.410000086 CEST	49738	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:03:57.366780996 CEST	49738	443	192.168.2.5	74.125.136.99
Apr 17, 2024 02:03:57.366823912 CEST	443	49738	74.125.136.99	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 02:02:43.260015011 CEST	53	58343	1.1.1.1	192.168.2.5
Apr 17, 2024 02:02:43.269562960 CEST	53	56145	1.1.1.1	192.168.2.5
Apr 17, 2024 02:02:43.870486975 CEST	53	59584	1.1.1.1	192.168.2.5
Apr 17, 2024 02:02:44.672285080 CEST	50842	53	192.168.2.5	1.1.1.1
Apr 17, 2024 02:02:44.672432899 CEST	53595	53	192.168.2.5	1.1.1.1
Apr 17, 2024 02:02:44.781205893 CEST	53	50842	1.1.1.1	192.168.2.5
Apr 17, 2024 02:02:44.782522917 CEST	53	53595	1.1.1.1	192.168.2.5
Apr 17, 2024 02:02:44.784980059 CEST	65316	53	192.168.2.5	1.1.1.1
Apr 17, 2024 02:02:44.787157059 CEST	60569	53	192.168.2.5	1.1.1.1
Apr 17, 2024 02:02:44.898829937 CEST	53	60569	1.1.1.1	192.168.2.5
Apr 17, 2024 02:02:44.934664011 CEST	53	65316	1.1.1.1	192.168.2.5
Apr 17, 2024 02:02:45.129650116 CEST	53017	53	192.168.2.5	1.1.1.1
Apr 17, 2024 02:02:45.129873991 CEST	61938	53	192.168.2.5	1.1.1.1
Apr 17, 2024 02:02:45.234208107 CEST	53	53017	1.1.1.1	192.168.2.5
Apr 17, 2024 02:02:45.234657049 CEST	53	61938	1.1.1.1	192.168.2.5
Apr 17, 2024 02:03:00.922732115 CEST	53	53544	1.1.1.1	192.168.2.5
Apr 17, 2024 02:03:19.937061071 CEST	53	50635	1.1.1.1	192.168.2.5
Apr 17, 2024 02:03:42.610424995 CEST	53	49362	1.1.1.1	192.168.2.5
Apr 17, 2024 02:03:43.026354074 CEST	53	64331	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 17, 2024 02:02:44.672285080 CEST	192.168.2.5	1.1.1.1	0xc13e	Standard query (0)	rakuten.co.jp.rakutle.xyz	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:44.672432899 CEST	192.168.2.5	1.1.1.1	0xa9dc	Standard query (0)	rakuten.co.jp.rakutle.xyz	65	IN (0x0001)	false
Apr 17, 2024 02:02:44.784980059 CEST	192.168.2.5	1.1.1.1	0xcf65	Standard query (0)	rakuten.co.jp.rakutle.xyz	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:44.787157059 CEST	192.168.2.5	1.1.1.1	0x6572	Standard query (0)	rakuten.co.jp.rakutle.xyz	65	IN (0x0001)	false
Apr 17, 2024 02:02:45.129650116 CEST	192.168.2.5	1.1.1.1	0xeb13	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:45.129873991 CEST	192.168.2.5	1.1.1.1	0xf6e	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 17, 2024 02:02:44.781205893 CEST	1.1.1.1	192.168.2.5	0xc13e	No error (0)	rakuten.co.jp.rakutle.xyz		172.67.206.68	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:44.781205893 CEST	1.1.1.1	192.168.2.5	0xc13e	No error (0)	rakuten.co.jp.rakutle.xyz		104.21.58.190	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:44.782522917 CEST	1.1.1.1	192.168.2.5	0xa9dc	No error (0)	rakuten.co.jp.rakutle.xyz			65	IN (0x0001)	false
Apr 17, 2024 02:02:44.898829937 CEST	1.1.1.1	192.168.2.5	0x6572	No error (0)	rakuten.co.jp.rakutle.xyz			65	IN (0x0001)	false
Apr 17, 2024 02:02:44.934664011 CEST	1.1.1.1	192.168.2.5	0xcf65	No error (0)	rakuten.co.jp.rakutle.xyz		104.21.58.190	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:44.934664011 CEST	1.1.1.1	192.168.2.5	0xcf65	No error (0)	rakuten.co.jp.rakutle.xyz		172.67.206.68	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:45.234208107 CEST	1.1.1.1	192.168.2.5	0xeb13	No error (0)	www.google.com		74.125.136.99	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:45.234208107 CEST	1.1.1.1	192.168.2.5	0xeb13	No error (0)	www.google.com		74.125.136.103	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:45.234208107 CEST	1.1.1.1	192.168.2.5	0xeb13	No error (0)	www.google.com		74.125.136.105	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:45.234208107 CEST	1.1.1.1	192.168.2.5	0xeb13	No error (0)	www.google.com		74.125.136.104	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:45.234208107 CEST	1.1.1.1	192.168.2.5	0xeb13	No error (0)	www.google.com		74.125.136.106	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:45.234208107 CEST	1.1.1.1	192.168.2.5	0xeb13	No error (0)	www.google.com		74.125.136.147	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:02:45.234657049 CEST	1.1.1.1	192.168.2.5	0xf6e	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 17, 2024 02:02:57.909780979 CEST	1.1.1.1	192.168.2.5	0xab0	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2024 02:02:57.909780979 CEST	1.1.1.1	192.168.2.5	0xab0	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:03:35.046745062 CEST	1.1.1.1	192.168.2.5	0x2ab3	No error (0)	windowsupdatebg.s.llnwi.net		69.164.42.0	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:03:55.862540960 CEST	1.1.1.1	192.168.2.5	0x601e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 17, 2024 02:03:55.862540960 CEST	1.1.1.1	192.168.2.5	0x601e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

https:

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49719	23.33.134.2	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 00:02:48 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-17 00:02:48 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=111620 Date: Wed, 17 Apr 2024 00:02:48 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49720	23.33.134.2	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 00:02:48 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-17 00:02:49 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=111701 Date: Wed, 17 Apr 2024 00:02:48 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-17 00:02:49 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49729	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-17 00:02:58 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713312146898&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-17 00:02:58 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-17 00:02:58 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-17 00:02:59 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 348EC2B54DF846BD8ECD501CB952F2C5 Ref B: LAX311000108007 Ref C: 2024-04-17T00:02:59Z Date: Wed, 17 Apr 2024 00:02:59 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1713312178.2ade8d4

Target ID:	0
Start time:	02:02:37
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:02:39
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1988,i,11608860953232660502,2173063063525198547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:02:43
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://rakuten.co.jp.rakutle.xyz/"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: rakuten.co.jp.rakutle.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: rakuten.co.jp.rakutle.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: rakuten.co.jp.rakutle.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: rakuten.co.jp.rakutle.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.134.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://rakuten.co.jp.rakutle.xyz/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5840, Parent PID: 5424

General

Chronological Activities

Analysis Process: chrome.exePID: 2408, Parent PID: 5840

General

Chronological Activities

Analysis Process: chrome.exePID: 348, Parent PID: 5424

General

Chronological Activities

Disassembly

Windows Analysis Report
http://rakuten.co.jp.rakutle.xyz/