Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://www.eki.longin.co.jp.h9rmvf.cn/

Overview

General Information

Sample URL:https://www.eki.longin.co.jp.h9rmvf.cn/
Analysis ID:1430619
Infos:
Errors
  • URL not reachable

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 5772 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • chrome.exe (PID: 3108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1980,i,10276287720731017888,14131806788820569140,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • chrome.exe (PID: 2680 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.eki.longin.co.jp.h9rmvf.cn/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownHTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49729 version: TLS 1.0
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49729 version: TLS 1.0
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.eki.longin.co.jp.h9rmvf.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: unknownDNS traffic detected: queries for: www.eki.longin.co.jp.h9rmvf.cn
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: classification engineClassification label: unknown0.win@17/0@4/4
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1980,i,10276287720731017888,14131806788820569140,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.eki.longin.co.jp.h9rmvf.cn/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1980,i,10276287720731017888,14131806788820569140,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://www.eki.longin.co.jp.h9rmvf.cn/0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
www.eki.longin.co.jp.h9rmvf.cn
165.22.249.193
truefalse
    		unknown
    www.google.com
    		142.250.101.103
    		truefalse
      		high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      https://www.eki.longin.co.jp.h9rmvf.cn/false
        		unknown

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        142.250.101.103
        		www.google.comUnited States
        		15169GOOGLEUSfalse
        239.255.255.250
        		unknownReserved
        		unknownunknownfalse
        165.22.249.193
        		www.eki.longin.co.jp.h9rmvf.cnUnited States
        		14061DIGITALOCEAN-ASNUSfalse

        Private

        IP
        192.168.2.6

        General Information

        Joe Sandbox version:40.0.0 Tourmaline
        Analysis ID:1430619
        Start date and time:2024-04-24 00:32:25 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 2m 3s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:browseurl.jbs
        Sample URL:https://www.eki.longin.co.jp.h9rmvf.cn/
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:7
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Detection:UNKNOWN
        Classification:unknown0.win@17/0@4/4
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 0
        Cookbook Comments:
        • URL browsing timeout or error

        Errors

        • URL not reachable

        Warnings

        • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
        • Excluded IPs from analysis (whitelisted): 142.251.2.94, 142.251.2.139, 142.251.2.113, 142.251.2.101, 142.251.2.102, 142.251.2.138, 142.251.2.100, 142.251.2.84, 184.27.80.206, 34.104.35.123, 23.61.214.98, 52.165.165.26, 192.229.211.108, 52.165.164.15
        • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
        • Not all processes where analyzed, report is missing behavior information
        • Report size getting too big, too many NtSetInformationFile calls found.
        • VT rate limit hit for: https://www.eki.longin.co.jp.h9rmvf.cn/

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        ⊘No static file info

        Network Behavior

        Network Port Distribution

        TCP Packets

        TimestampSource PortDest PortSource IPDest IP
        Apr 24, 2024 00:33:10.604978085 CEST49674443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:10.604984045 CEST49673443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:10.917500973 CEST49672443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:14.055830956 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:14.055880070 CEST4434971320.7.2.167192.168.2.6
        Apr 24, 2024 00:33:14.055954933 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:14.056571960 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:14.056586981 CEST4434971320.7.2.167192.168.2.6
        Apr 24, 2024 00:33:14.733247042 CEST4434971320.7.2.167192.168.2.6
        Apr 24, 2024 00:33:14.733392000 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:15.582170010 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:15.582212925 CEST4434971320.7.2.167192.168.2.6
        Apr 24, 2024 00:33:15.582562923 CEST4434971320.7.2.167192.168.2.6
        Apr 24, 2024 00:33:15.719836950 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:15.742295027 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:15.785919905 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:15.785940886 CEST4434971320.7.2.167192.168.2.6
        Apr 24, 2024 00:33:15.786545992 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:15.832118988 CEST4434971320.7.2.167192.168.2.6
        Apr 24, 2024 00:33:16.006591082 CEST4434971320.7.2.167192.168.2.6
        Apr 24, 2024 00:33:16.006690979 CEST4434971320.7.2.167192.168.2.6
        Apr 24, 2024 00:33:16.006776094 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:16.156373978 CEST49713443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:16.156409025 CEST4434971320.7.2.167192.168.2.6
        Apr 24, 2024 00:33:18.918787003 CEST49720443192.168.2.6142.250.101.103
        Apr 24, 2024 00:33:18.918823004 CEST44349720142.250.101.103192.168.2.6
        Apr 24, 2024 00:33:18.918916941 CEST49720443192.168.2.6142.250.101.103
        Apr 24, 2024 00:33:18.919145107 CEST49720443192.168.2.6142.250.101.103
        Apr 24, 2024 00:33:18.919162035 CEST44349720142.250.101.103192.168.2.6
        Apr 24, 2024 00:33:19.179419041 CEST49723443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.179469109 CEST44349723165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.179550886 CEST49723443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.179791927 CEST49724443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.179837942 CEST44349724165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.180047035 CEST49723443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.180078983 CEST44349723165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.180092096 CEST49724443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.180336952 CEST49724443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.180366039 CEST44349724165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.282840014 CEST44349720142.250.101.103192.168.2.6
        Apr 24, 2024 00:33:19.283174038 CEST49720443192.168.2.6142.250.101.103
        Apr 24, 2024 00:33:19.283200979 CEST44349720142.250.101.103192.168.2.6
        Apr 24, 2024 00:33:19.284320116 CEST44349720142.250.101.103192.168.2.6
        Apr 24, 2024 00:33:19.284399986 CEST49720443192.168.2.6142.250.101.103
        Apr 24, 2024 00:33:19.285492897 CEST49720443192.168.2.6142.250.101.103
        Apr 24, 2024 00:33:19.285559893 CEST44349720142.250.101.103192.168.2.6
        Apr 24, 2024 00:33:19.339200020 CEST49720443192.168.2.6142.250.101.103
        Apr 24, 2024 00:33:19.339210033 CEST44349720142.250.101.103192.168.2.6
        Apr 24, 2024 00:33:19.386801958 CEST49720443192.168.2.6142.250.101.103
        Apr 24, 2024 00:33:19.858535051 CEST44349723165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.860867977 CEST44349724165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.900198936 CEST49723443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.900214911 CEST44349723165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.900587082 CEST49724443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.900604010 CEST44349724165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.901770115 CEST44349724165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.901839972 CEST49724443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.902156115 CEST44349723165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.902209044 CEST49723443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.908236027 CEST49724443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.908329010 CEST44349724165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.909430027 CEST49723443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.909568071 CEST44349723165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.910334110 CEST49724443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.910342932 CEST44349724165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.963963032 CEST49723443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:19.963973999 CEST44349723165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:19.964005947 CEST49724443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:20.009911060 CEST49723443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:20.212425947 CEST49674443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:20.212430954 CEST49673443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:20.519762993 CEST49672443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:20.568126917 CEST49725443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:20.568154097 CEST4434972520.7.2.167192.168.2.6
        Apr 24, 2024 00:33:20.568281889 CEST49725443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:20.569109917 CEST49725443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:20.569123030 CEST4434972520.7.2.167192.168.2.6
        Apr 24, 2024 00:33:21.181236029 CEST44349724165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:21.181317091 CEST44349724165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:21.181402922 CEST49724443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:21.182238102 CEST49724443192.168.2.6165.22.249.193
        Apr 24, 2024 00:33:21.182317019 CEST44349724165.22.249.193192.168.2.6
        Apr 24, 2024 00:33:21.255122900 CEST4434972520.7.2.167192.168.2.6
        Apr 24, 2024 00:33:21.255211115 CEST49725443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:21.257786036 CEST49725443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:21.257798910 CEST4434972520.7.2.167192.168.2.6
        Apr 24, 2024 00:33:21.258639097 CEST4434972520.7.2.167192.168.2.6
        Apr 24, 2024 00:33:21.260353088 CEST49725443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:21.260432959 CEST49725443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:21.260445118 CEST4434972520.7.2.167192.168.2.6
        Apr 24, 2024 00:33:21.260569096 CEST49725443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:21.304130077 CEST4434972520.7.2.167192.168.2.6
        Apr 24, 2024 00:33:21.481904030 CEST4434972520.7.2.167192.168.2.6
        Apr 24, 2024 00:33:21.482075930 CEST4434972520.7.2.167192.168.2.6
        Apr 24, 2024 00:33:21.482142925 CEST49725443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:21.484503984 CEST49725443192.168.2.620.7.2.167
        Apr 24, 2024 00:33:21.484549046 CEST4434972520.7.2.167192.168.2.6
        Apr 24, 2024 00:33:21.911441088 CEST44349704173.222.162.64192.168.2.6
        Apr 24, 2024 00:33:21.911600113 CEST49704443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:29.281137943 CEST44349720142.250.101.103192.168.2.6
        Apr 24, 2024 00:33:29.281235933 CEST44349720142.250.101.103192.168.2.6
        Apr 24, 2024 00:33:29.282092094 CEST49720443192.168.2.6142.250.101.103
        Apr 24, 2024 00:33:30.993535995 CEST49720443192.168.2.6142.250.101.103
        Apr 24, 2024 00:33:30.993554115 CEST44349720142.250.101.103192.168.2.6
        Apr 24, 2024 00:33:32.670627117 CEST49704443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:32.670785904 CEST49704443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:32.671109915 CEST49729443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:32.671137094 CEST44349729173.222.162.64192.168.2.6
        Apr 24, 2024 00:33:32.671226025 CEST49729443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:32.671550035 CEST49729443192.168.2.6173.222.162.64
        Apr 24, 2024 00:33:32.671566010 CEST44349729173.222.162.64192.168.2.6
        Apr 24, 2024 00:33:32.831806898 CEST44349704173.222.162.64192.168.2.6
        Apr 24, 2024 00:33:32.831845045 CEST44349704173.222.162.64192.168.2.6
        Apr 24, 2024 00:33:33.014394999 CEST44349729173.222.162.64192.168.2.6
        Apr 24, 2024 00:33:33.014624119 CEST49729443192.168.2.6173.222.162.64

        UDP Packets

        TimestampSource PortDest PortSource IPDest IP
        Apr 24, 2024 00:33:16.596163034 CEST53582971.1.1.1192.168.2.6
        Apr 24, 2024 00:33:16.734555006 CEST53524361.1.1.1192.168.2.6
        Apr 24, 2024 00:33:17.719492912 CEST53515931.1.1.1192.168.2.6
        Apr 24, 2024 00:33:18.248019934 CEST6438853192.168.2.61.1.1.1
        Apr 24, 2024 00:33:18.248447895 CEST5304753192.168.2.61.1.1.1
        Apr 24, 2024 00:33:18.764164925 CEST6183753192.168.2.61.1.1.1
        Apr 24, 2024 00:33:18.764245033 CEST5743453192.168.2.61.1.1.1
        Apr 24, 2024 00:33:18.917434931 CEST53574341.1.1.1192.168.2.6
        Apr 24, 2024 00:33:18.917491913 CEST53618371.1.1.1192.168.2.6
        Apr 24, 2024 00:33:19.178560019 CEST53643881.1.1.1192.168.2.6
        Apr 24, 2024 00:33:19.178709030 CEST53530471.1.1.1192.168.2.6
        Apr 24, 2024 00:33:34.885973930 CEST53587371.1.1.1192.168.2.6

        DNS Queries

        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
        Apr 24, 2024 00:33:18.248019934 CEST192.168.2.61.1.1.10x5cfbStandard query (0)www.eki.longin.co.jp.h9rmvf.cnA (IP address)IN (0x0001)false
        Apr 24, 2024 00:33:18.248447895 CEST192.168.2.61.1.1.10xc1a1Standard query (0)www.eki.longin.co.jp.h9rmvf.cn65IN (0x0001)false
        Apr 24, 2024 00:33:18.764164925 CEST192.168.2.61.1.1.10x9fdbStandard query (0)www.google.comA (IP address)IN (0x0001)false
        Apr 24, 2024 00:33:18.764245033 CEST192.168.2.61.1.1.10xd748Standard query (0)www.google.com65IN (0x0001)false

        DNS Answers

        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
        Apr 24, 2024 00:33:18.917434931 CEST1.1.1.1192.168.2.60xd748No error (0)www.google.com65IN (0x0001)false
        Apr 24, 2024 00:33:18.917491913 CEST1.1.1.1192.168.2.60x9fdbNo error (0)www.google.com142.250.101.103A (IP address)IN (0x0001)false
        Apr 24, 2024 00:33:18.917491913 CEST1.1.1.1192.168.2.60x9fdbNo error (0)www.google.com142.250.101.147A (IP address)IN (0x0001)false
        Apr 24, 2024 00:33:18.917491913 CEST1.1.1.1192.168.2.60x9fdbNo error (0)www.google.com142.250.101.105A (IP address)IN (0x0001)false
        Apr 24, 2024 00:33:18.917491913 CEST1.1.1.1192.168.2.60x9fdbNo error (0)www.google.com142.250.101.104A (IP address)IN (0x0001)false
        Apr 24, 2024 00:33:18.917491913 CEST1.1.1.1192.168.2.60x9fdbNo error (0)www.google.com142.250.101.106A (IP address)IN (0x0001)false
        Apr 24, 2024 00:33:18.917491913 CEST1.1.1.1192.168.2.60x9fdbNo error (0)www.google.com142.250.101.99A (IP address)IN (0x0001)false
        Apr 24, 2024 00:33:19.178560019 CEST1.1.1.1192.168.2.60x5cfbNo error (0)www.eki.longin.co.jp.h9rmvf.cn165.22.249.193A (IP address)IN (0x0001)false

        HTTP Request Dependency Graph

        • www.eki.longin.co.jp.h9rmvf.cn

        HTTPS Proxied Packets

        Session IDSource IPSource PortDestination IPDestination Port
        0192.168.2.64971320.7.2.167443
        TimestampBytes transferredDirectionData
        2024-04-23 22:33:15 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 4f 70 30 50 57 69 42 74 45 4b 42 57 50 6f 42 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 31 33 63 61 32 37 30 36 36 66 36 34 65 65 64 0d 0a 0d 0a
        Data Ascii: CNT 1 CON 305MS-CV: HOp0PWiBtEKBWPoB.1Context: 213ca27066f64eed
        2024-04-23 22:33:15 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
        2024-04-23 22:33:15 UTC1076OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 48 4f 70 30 50 57 69 42 74 45 4b 42 57 50 6f 42 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 31 33 63 61 32 37 30 36 36 66 36 34 65 65 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b
        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: HOp0PWiBtEKBWPoB.2Context: 213ca27066f64eed<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
        2024-04-23 22:33:15 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 48 4f 70 30 50 57 69 42 74 45 4b 42 57 50 6f 42 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 31 33 63 61 32 37 30 36 36 66 36 34 65 65 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
        Data Ascii: BND 3 CON\WNS 0 197MS-CV: HOp0PWiBtEKBWPoB.3Context: 213ca27066f64eed<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
        2024-04-23 22:33:16 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
        Data Ascii: 202 1 CON 58
        2024-04-23 22:33:16 UTC58INData Raw: 4d 53 2d 43 56 3a 20 77 62 7a 59 6d 4f 41 33 63 55 2b 2f 72 65 4f 37 64 45 34 46 53 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
        Data Ascii: MS-CV: wbzYmOA3cU+/reO7dE4FSA.0Payload parsing failed.


        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
        1192.168.2.649724165.22.249.1934433108C:\Program Files\Google\Chrome\Application\chrome.exe
        TimestampBytes transferredDirectionData
        2024-04-23 22:33:19 UTC673OUTGET / HTTP/1.1
        Host: www.eki.longin.co.jp.h9rmvf.cn
        Connection: keep-alive
        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
        sec-ch-ua-mobile: ?0
        sec-ch-ua-platform: "Windows"
        Upgrade-Insecure-Requests: 1
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
        Sec-Fetch-Site: none
        Sec-Fetch-Mode: navigate
        Sec-Fetch-User: ?1
        Sec-Fetch-Dest: document
        Accept-Encoding: gzip, deflate, br
        Accept-Language: en-US,en;q=0.9
        2024-04-23 22:33:21 UTC451INHTTP/1.1 403 Not Found
        Date: Tue, 23 Apr 2024 22:33:20 GMT
        Server: Apache
        Access-Control-Allow-Origin: *
        Access-Control-Allow-Methods: *
        Access-Control-Allow-Credentials: true
        Expires: Thu, 19 Nov 1981 08:52:00 GMT
        Cache-Control: no-store, no-cache, must-revalidate
        Pragma: no-cache
        Set-Cookie: PHPSESSID=av65ko85bekd4o0qmfsq0f4nvf; path=/
        Upgrade: h2
        Connection: Upgrade, close
        Content-Length: 0
        Content-Type: text/html;charset=utf-8


        Session IDSource IPSource PortDestination IPDestination Port
        2192.168.2.64972520.7.2.167443
        TimestampBytes transferredDirectionData
        2024-04-23 22:33:21 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 34 56 4e 55 30 79 48 51 45 53 4b 6b 78 4d 79 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 37 33 39 31 34 38 35 66 34 33 33 35 64 38 0d 0a 0d 0a
        Data Ascii: CNT 1 CON 305MS-CV: p4VNU0yHQESKkxMy.1Context: 707391485f4335d8
        2024-04-23 22:33:21 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
        2024-04-23 22:33:21 UTC1064OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 70 34 56 4e 55 30 79 48 51 45 53 4b 6b 78 4d 79 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 37 33 39 31 34 38 35 66 34 33 33 35 64 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 39 4a 43 4b 32 7a 72 45 75 50 47 49 67 61 4b 4f 6a 71 48 45 72 4b 72 54 73 4d 6d 75 36 65 5a 30 36 58 52 6f 31 34 70 59 4a 65 5a 35 4c 6c 41 55 56 56 39 74 36 41 6f 56 42 74 33 50 66 77 34 52 46 6f 68 67 49 45 39 43 56 69 69 5a 37 47 4e 74 62 63 42 2b 50 5a 47 54 2b 30 6d 64 70 61 46 4c 67 50 49 6a 47 56 75 47 69 6d 65 68
        Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: p4VNU0yHQESKkxMy.2Context: 707391485f4335d8<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAc9JCK2zrEuPGIgaKOjqHErKrTsMmu6eZ06XRo14pYJeZ5LlAUVV9t6AoVBt3Pfw4RFohgIE9CViiZ7GNtbcB+PZGT+0mdpaFLgPIjGVuGimeh
        2024-04-23 22:33:21 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 70 34 56 4e 55 30 79 48 51 45 53 4b 6b 78 4d 79 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 37 33 39 31 34 38 35 66 34 33 33 35 64 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
        Data Ascii: BND 3 CON\WNS 0 197MS-CV: p4VNU0yHQESKkxMy.3Context: 707391485f4335d8<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
        2024-04-23 22:33:21 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
        Data Ascii: 202 1 CON 58
        2024-04-23 22:33:21 UTC58INData Raw: 4d 53 2d 43 56 3a 20 2b 55 68 77 4d 39 6a 54 4e 30 65 4a 77 54 51 37 73 62 66 70 6e 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
        Data Ascii: MS-CV: +UhwM9jTN0eJwTQ7sbfpnA.0Payload parsing failed.


        Statistics

        CPU Usage

        Click to jump to process

        Memory Usage

        Click to jump to process

        Behavior

        Click to jump to process

        System Behavior

        General

        Target ID:0
        Start time:00:33:10
        Start date:24/04/2024
        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
        Wow64 process (32bit):false
        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
        Imagebase:0x7ff684c40000
        File size:3'242'272 bytes
        MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false

        General

        Target ID:2
        Start time:00:33:12
        Start date:24/04/2024
        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
        Wow64 process (32bit):false
        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1980,i,10276287720731017888,14131806788820569140,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Imagebase:0x7ff684c40000
        File size:3'242'272 bytes
        MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false

        General

        Target ID:3
        Start time:00:33:16
        Start date:24/04/2024
        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
        Wow64 process (32bit):false
        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.eki.longin.co.jp.h9rmvf.cn/"
        Imagebase:0x7ff684c40000
        File size:3'242'272 bytes
        MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:true

        Disassembly

        ⊘No disassembly