Edit tour

Windows Analysis Report
IDProtect Manager.exe

Overview

General Information

Sample name:	IDProtect Manager.exe
Analysis ID:	1432382
MD5:	1c9346769dc9ada9f73b7269170ad1b7
SHA1:	fa91f3c98128408afa678e2e178ccade48af04f7
SHA256:	38728ac836784cd661dffdb6f169ab7a45d0816dfba3372ec601d57392b9dab1
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

Stores files to the Windows start menu directory

Uses 32bit PE files

Classification

Analysis Advice

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64_ra

IDProtect Manager.exe (PID: 7044 cmdline: "C:\Users\user\Desktop\IDProtect Manager.exe" MD5: 1C9346769DC9ADA9F73B7269170AD1B7)

chrome.exe (PID: 7160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:/// MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6360 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1960,i,4465652620104932970,15968156762818287997,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 7468 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

IDProtect Manager.exe (PID: 7648 cmdline: "C:\Users\user\Desktop\IDProtect Manager.exe" MD5: 1C9346769DC9ADA9F73B7269170AD1B7)

IDProtect Manager.exe (PID: 7800 cmdline: "C:\Users\user\Desktop\IDProtect Manager.exe" MD5: 1C9346769DC9ADA9F73B7269170AD1B7)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: IDProtect Manager.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49719 version: TLS 1.2

Source:	Binary string: m:\ML5.0\aseCertTool\Release\IDProtect Manager.pdb`I source: IDProtect Manager.exe
Source:	Binary string: m:\ML5.0\aseCertTool\Release\IDProtect Manager.pdb source: IDProtect Manager.exe

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGN3HsLEGIjBXNY7YcegvyOHYSwdfu5I_M0N2dcx3FvhLYsqeDJ9GBKii4_kEKNqzeEuer1mYsD0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-21; NID=513=WYsgsoAnXbh5kTXg22fbLRA2rzBcNnL29dPS7CkA-NJHuMAshogS_aUMAACkaP757xA_ybPm2Hjw1EmnrItw2kt4mSuhkdJzJRZjGOcqA3rs8mdLanpY01d3FmYbJDrQEzn08lb2c1yH7cBMHiuQKUMOus6atPA_lVztzx-iUuI
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGN3HsLEGIjBX3BfcQ98qwWOS90Bukqjp-iVTJvobixLhl4MnGPX3CMTHq4gdZ2y95_O1i-7EVc0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-21; NID=513=WYsgsoAnXbh5kTXg22fbLRA2rzBcNnL29dPS7CkA-NJHuMAshogS_aUMAACkaP757xA_ybPm2Hjw1EmnrItw2kt4mSuhkdJzJRZjGOcqA3rs8mdLanpY01d3FmYbJDrQEzn08lb2c1yH7cBMHiuQKUMOus6atPA_lVztzx-iUuI
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dSFZlPbYWaFfoLW&MD=1HK1+YEa HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dSFZlPbYWaFfoLW&MD=1HK1+YEa HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49719 version: TLS 1.2

Source: IDProtect Manager.exe

Static PE information: invalid certificate

Source: IDProtect Manager.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean2.winEXE@20/8@2/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\IDProtect Manager.exe

Mutant created: NULL

Source: IDProtect Manager.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\IDProtect Manager.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Users\user\Desktop\IDProtect Manager.exe "C:\Users\user\Desktop\IDProtect Manager.exe"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1960,i,4465652620104932970,15968156762818287997,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\Desktop\IDProtect Manager.exe "C:\Users\user\Desktop\IDProtect Manager.exe"
Source: unknown	Process created: C:\Users\user\Desktop\IDProtect Manager.exe "C:\Users\user\Desktop\IDProtect Manager.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1960,i,4465652620104932970,15968156762818287997,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: asevcapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: asevcapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Section loaded: wintypes.dll	Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\IDProtect Manager.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: IDProtect Manager.exe	Static PE information: section name: RT_CURSOR
Source: IDProtect Manager.exe	Static PE information: section name: RT_BITMAP
Source: IDProtect Manager.exe	Static PE information: section name: RT_ICON
Source: IDProtect Manager.exe	Static PE information: section name: RT_MENU
Source: IDProtect Manager.exe	Static PE information: section name: RT_DIALOG
Source: IDProtect Manager.exe	Static PE information: section name: RT_STRING
Source: IDProtect Manager.exe	Static PE information: section name: RT_ACCELERATOR
Source: IDProtect Manager.exe	Static PE information: section name: RT_GROUP_ICON

Source: IDProtect Manager.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: m:\ML5.0\aseCertTool\Release\IDProtect Manager.pdb`I source: IDProtect Manager.exe
Source:	Binary string: m:\ML5.0\aseCertTool\Release\IDProtect Manager.pdb source: IDProtect Manager.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\IDProtect Manager.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IDProtect Manager.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Rundll32	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
IDProtect Manager.exe	0%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.217.196	true	false		high

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGN3HsLEGIjBXNY7YcegvyOHYSwdfu5I_M0N2dcx3FvhLYsqeDJ9GBKii4_kEKNqzeEuer1mYsD0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGN3HsLEGIjBX3BfcQ98qwWOS90Bukqjp-iVTJvobixLhl4MnGPX3CMTHq4gdZ2y95_O1i-7EVc0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.217.196	www.google.com	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432382
Start date and time:	2024-04-26 23:59:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IDProtect Manager.exe
Detection:	CLEAN
Classification:	clean2.winEXE@20/8@2/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.165.195, 173.194.212.84, 142.250.217.238, 34.104.35.123, 72.21.81.240, 142.250.80.67, 142.250.80.78
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target IDProtect Manager.exe, PID 7044 because there are no executed function
Execution Graph export aborted for target IDProtect Manager.exe, PID 7648 because there are no executed function
Execution Graph export aborted for target IDProtect Manager.exe, PID 7800 because there are no executed function
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: IDProtect Manager.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://palmettoanimalclinic.aweb.page/p/0ac693e3-6f85-4fd6-86d7-f770e6e73d32	Get hash	malicious	Unknown	Browse
	Lab5-3.exe	Get hash	malicious	Chaos, Conti, LockBit ransomware, TrojanRansom	Browse
	http://www.superiorbillingsolutions.com	Get hash	malicious	Unknown	Browse
	Document_a51_19i793302-14b09981a5569-3684u8.js	Get hash	malicious	Latrodectus	Browse
	https://rise.articulate.com/share/zO8B8EFq4bxdit8kVRcUzBOZMbkl1WSz#/lessons/2GyyR-D75sLlZcXDanN5dOaLxSSkgNvo	Get hash	malicious	HTMLPhisher	Browse
	360total.dll.dll	Get hash	malicious	Latrodectus	Browse
	2k632W2O.exe	Get hash	malicious	Clipboard Hijacker	Browse
	https://sites.google.com/authorizewebcenter.com/565hu4?usp=sharing	Get hash	malicious	HTMLPhisher	Browse
	http://carajasnutricaoanimal.com	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0 - 2024-04-26T151509.287.eml	Get hash	malicious	HTMLPhisher	Browse

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://palmettoanimalclinic.aweb.page/p/0ac693e3-6f85-4fd6-86d7-f770e6e73d32	Get hash	malicious	Unknown	Browse	20.114.59.183
	Lab5-3.exe	Get hash	malicious	Chaos, Conti, LockBit ransomware, TrojanRansom	Browse	20.114.59.183
	http://www.superiorbillingsolutions.com	Get hash	malicious	Unknown	Browse	20.114.59.183
	Document_a51_19i793302-14b09981a5569-3684u8.js	Get hash	malicious	Latrodectus	Browse	20.114.59.183
	https://rise.articulate.com/share/zO8B8EFq4bxdit8kVRcUzBOZMbkl1WSz#/lessons/2GyyR-D75sLlZcXDanN5dOaLxSSkgNvo	Get hash	malicious	HTMLPhisher	Browse	20.114.59.183
	360total.dll.dll	Get hash	malicious	Latrodectus	Browse	20.114.59.183
	2k632W2O.exe	Get hash	malicious	Clipboard Hijacker	Browse	20.114.59.183
	wxfSIz4PAi.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.114.59.183
	https://sites.google.com/authorizewebcenter.com/565hu4?usp=sharing	Get hash	malicious	HTMLPhisher	Browse	20.114.59.183
	http://carajasnutricaoanimal.com	Get hash	malicious	Unknown	Browse	20.114.59.183

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 20:59:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9860235414371963
Encrypted:	false
SSDEEP:	48:83dyTea3H0idAKZdA1FehwiZUklqehBy+3:8U/q2y
MD5:	A6D93B1B83EE82061832586D4438224E
SHA1:	590EA2A9E62C37EDBD193725F24C4918EC017D4E
SHA-256:	9B4FED35481A3E36F3069DEF1BC0C5FA0B66D5A177AB211C5BC291FD1DFEF013
SHA-512:	781DB81EFAF41621FFA5C8CD75BB9C4275CB30065B7FD4639B9C55501B85C74D5E0F9B507399E268BC4E3AFDC56F801F0326004C0B7ED968942C9CBFF31EC577
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....y...%...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xr.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X}............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 20:59:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003106175129667
Encrypted:	false
SSDEEP:	48:8xdyTea3H0idAKZdA1seh/iZUkAQkqehmy+2:8W/E9QLy
MD5:	545BF3BDF80A29A9C3F7FE6E7322FD81
SHA1:	C9DB752A804426144A1160E5BCB9C831A19509DB
SHA-256:	D1BBE13D55895DAE1869FD59AD292B6BF6714A76477251D919F260970968C1DE
SHA-512:	472D87197842E055604AA078EEC317E416BD8B228C7B3DBA8931E5DBB976F903721BC82F96CD27A12BE623433A8ED885B8BE91DCE2D70EFE8FAA3FFD3D9F9E8E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....M...%...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xr.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X}............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.009685739800147
Encrypted:	false
SSDEEP:	48:8ZdyTeaAH0idAKZdA14meh7sFiZUkmgqeh7s4y+BX:8u/1nyy
MD5:	9AA0BAE4AEFAA14FFA71C67926DC9102
SHA1:	0D3DEDED7B60C62EB7199933CF2A69D04ED934BD
SHA-256:	3A4A7B9147178917D532184402D8A0785ADB669E6B258AC84372BCC8B7195753
SHA-512:	9FEAFA271ED6C599FE9D15833A1DA8F307E40A8EB7B992C1AE7BFC18B5EBACAE36A9FF3276EB52A3757C0C6BD0D81F2C1486C47EE5EE1AF65FCA4313423F733D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xr.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 20:59:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9988284461375825
Encrypted:	false
SSDEEP:	48:8+ldyTea3H0idAKZdA1TehDiZUkwqehKy+R:83/fQy
MD5:	569FEC96552F3E0906BD60F9D39C17CD
SHA1:	E8D86A56BFA92F0A6B52D5D87EDEC7AC3FEC83C0
SHA-256:	067FEE3F1AC07092825F158490D75299430A3EBAB5A7A551AF489967D04F3ED8
SHA-512:	ADAB029AF6E827F3F3893F69FE54173E9C84D37769E130331C8679F5926207A446D20512F91001C123357EF5D9D41C1DEC38A75357CEC75D530D2282C309F104
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........%...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xr.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X}............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 20:59:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.989969531384953
Encrypted:	false
SSDEEP:	48:89dyTea3H0idAKZdA1dehBiZUk1W1qehEy+C:8C//9ky
MD5:	6933DDD979BEDD5E1716D0B818CBCC2D
SHA1:	0B037095623299F2BDAC89E1FB15CD5484A9451B
SHA-256:	5948AC8E36C294B2AE10F48F3D2644A86DD09BF4B5A82FE4498393F1A69F5842
SHA-512:	86189645E0914360097B62FAC688AA10D24E3D8973B4BF59A16BF31023FAE135629794CBDEE290C5DF5C2DC034DBA7569384642F6F9CBC274A6CEA8184616AF5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Z..%...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xr.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X}............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 20:59:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.001041247863082
Encrypted:	false
SSDEEP:	48:8FdyTea3H0idAKZdA1duTeehOuTbbiZUk5OjqehOuTbyy+yT+:86/DTfTbxWOvTbyy7T
MD5:	39A4F9D6085CED87F89DF15F2B7F1551
SHA1:	AD30D76485468C0DEB90F195941D589B39B57A52
SHA-256:	2FFDD4DF24109F4B2055584276540E6600E113E7E8435739440AC44DA24B2168
SHA-512:	2B485F8FA3D7C75D55849972700A5E0676BCD073B5A8E0DEF31DE9AFC32563926612A9397537EDD41302EB16D8506AD60DF996C3E9B634950CB61C3179FA8D45
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....<...%...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xr.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X}............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............\y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3753)
Category:	downloaded
Size (bytes):	3758
Entropy (8bit):	5.835655281397477
Encrypted:	false
SSDEEP:	96:pxCliyH6666/CfOrhXsxIyL2XBBs8IjknxX6lqJffffffL:pSDH6666/+z2XBi5Yv9
MD5:	1F736500AC8D93E11DAB8798C6D4920A
SHA1:	2F7BBB62DEA9BF5796F763B3E537B77C5A5BA0DA
SHA-256:	3EAF9EB48A0BADBF081572E7EEFBEFF3711C6AAAE4B3D20D3229CAB769DDB9A6
SHA-512:	A8B9048266B3988F6259D3CAB2BECBC3FBB19B8289507C998CF1FCA5F3DD0BED4BE38E011EB5E9AC13B37C280D3822BFFB447B9690E907FD5DB289E0F85B15E8
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["laguardia airport","wwe draft","ring doorbell lawsuit settlement","rangers vs capitals predictions","apple iphone 16 pro max release date","jt song lyrics","arab football coach","manor lords game"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWp2bjZ6eV82EgpWaWRlbyBnYW1lMrcQZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBYUFBQUNBd0VCQUFBQUFBQUFBQUFBQUFBRUJnTUZCd0lCLzhRQU1SQUFBZ0VEQXdNREFnVURCUUFBQUFBQUFRSURCQVVSQUJJaEV6RkJCbEdCSW5FVU1tR1JvU1BSNFFja0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.17647073876802
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IDProtect Manager.exe
File size:	893'008 bytes
MD5:	1c9346769dc9ada9f73b7269170ad1b7
SHA1:	fa91f3c98128408afa678e2e178ccade48af04f7
SHA256:	38728ac836784cd661dffdb6f169ab7a45d0816dfba3372ec601d57392b9dab1
SHA512:	bdaa5e60e4141b316bc283ee95c75361fd834b49a8a5d9b1b8f32188071a17b85f4dee9e6f7304e918e4f591718f07fd641f0c30837acbc26fee5f02c9781a9c
SSDEEP:	12288:h0cijm/HuJgJemXEpwXFciRG6zaVx2Tq5TMi76aITeKVDMWZrOtvK:ecijm/HuJH0ciJzaV5TMi6vVHZsK
TLSH:	D615181132B5C83BF6A23131086A6265F566FC106F25EEC76282BB3E9B361D15E3531F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FmC...-...-...-.%.P...-.%.@...-.%._...-.%.V...-...,...-../....-../1...-.%.C...-.%.Q...-...-...-.%.U...-.Rich..-................

File Icon


Icon Hash:	7bc4a4ec66f31904

Static PE Info

General

Entrypoint:	0x454a81
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4BD7F40A [Wed Apr 28 08:38:34 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d9a0291cbc4e65a605c7d493d0b220d8

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	A certificate chain could not be built to a trusted root authority
Error Number:	-2146762486
Not Before, Not After	30/04/2009 02:00:00 16/06/2011 01:59:59
Subject Chain	CN=Athena Smartcard Solutions, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Athena Smartcard Solutions, L=Herzliya, S=Herzliya, C=IL
Version:	3
Thumbprint MD5:	CEE46F618A66BACFEC4ABCD1DFB57C23
Thumbprint SHA-1:	46893033A74433E28B3D58A78C97D322E1379AF4
Thumbprint SHA-256:	93834C47A10014ED6356685AFD316275AC76F7E19B8FDDD070C95B1264246F36
Serial:	438192A562899CDCE1489D1C27800049

Entrypoint Preview

Instruction
call 00007F6FB929A61Fh
jmp 00007F6FB92936FCh
push ebp
mov ebp, esp
push esi
mov esi, dword ptr [ebp+14h]
push edi
xor edi, edi
cmp esi, edi
jne 00007F6FB92938E6h
xor eax, eax
jmp 00007F6FB9293947h
cmp dword ptr [ebp+08h], edi
jne 00007F6FB92938FDh
call 00007F6FB92966CCh
push 00000016h
pop esi
mov dword ptr [eax], esi
push edi
push edi
push edi
push edi
push edi
call 00007F6FB9294F5Ah
add esp, 14h
mov eax, esi
jmp 00007F6FB9293927h
cmp dword ptr [ebp+10h], edi
je 00007F6FB92938F8h
cmp dword ptr [ebp+0Ch], esi
jc 00007F6FB92938F3h
push esi
push dword ptr [ebp+10h]
push dword ptr [ebp+08h]
call 00007F6FB9294AD2h
add esp, 0Ch
jmp 00007F6FB92938A3h
push dword ptr [ebp+0Ch]
push edi
push dword ptr [ebp+08h]
call 00007F6FB9293DE1h
add esp, 0Ch
cmp dword ptr [ebp+10h], edi
je 00007F6FB9293898h
cmp dword ptr [ebp+0Ch], esi
jnc 00007F6FB92938F0h
call 00007F6FB929667Dh
push 00000022h
pop ecx
mov dword ptr [eax], ecx
mov esi, ecx
jmp 00007F6FB929388Fh
push 00000016h
pop eax
pop edi
pop esi
pop ebp
ret
push ecx
mov dword ptr [ecx], 00482D0Ch
call 00007F6FB929A627h
pop ecx
ret
push esi
mov esi, ecx
call 00007F6FB92938CFh
test byte ptr [esp+08h], 00000001h
je 00007F6FB92938E9h
push esi
call 00007F6FB9272A13h
pop ecx
mov eax, esi
pop esi
retn 0004h
mov eax, dword ptr [esp+04h]
add ecx, 09h
push ecx
add eax, 09h
push eax
call 00007F6FB929A674h
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax

Rich Headers

Programming Language:

[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[C++] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9364c	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9f000	0x3d528	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xd9000	0x1050	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7b880	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7b000	0x5dc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x935c4	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x79521	0x7a000	1dc02e6d4a3a257ecd5b2f2f94ee64c4	False	0.5263011494620902	data	6.603338464035834	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7b000	0x1a64e	0x1b000	ee92c2b46fe510ee9ba2a936e5dc5438	False	0.31608977141203703	data	4.557612420337262	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x96000	0x88b8	0x5000	879945234a642a3327472c4ec168f136	False	0.2212890625	data	3.6839649411477056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9f000	0x3d528	0x3e000	a7173d939ea2bedcc454f356abfa71c7	False	0.21239053049395162	data	5.075671653969763	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xd6cf8	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0xd6e30	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_CURSOR	0xd6f10	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.36363636363636365
RT_CURSOR	0xd7060	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.35714285714285715
RT_CURSOR	0xd71b0	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0xd7300	0x134	data	English	United States	0.37662337662337664
RT_CURSOR	0xd7450	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0xd75a0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.37662337662337664
RT_CURSOR	0xd76f0	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0xd7840	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0xd7990	0x134	data	English	United States	0.44155844155844154
RT_CURSOR	0xd7ae0	0x134	data	English	United States	0.4155844155844156
RT_CURSOR	0xd7c30	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.5422077922077922
RT_CURSOR	0xd7d80	0x134	data	English	United States	0.2662337662337662
RT_CURSOR	0xd7ed0	0x134	data	English	United States	0.2824675324675325
RT_CURSOR	0xd8020	0x134	data	English	United States	0.3246753246753247
RT_BITMAP	0xc6878	0xa928	Device independent bitmap graphic, 960 x 90 x 4, image size 43200, 16 important colors	English	United States	0.00688158137816368
RT_BITMAP	0xd11a0	0x4b8	Device independent bitmap graphic, 96 x 23 x 4, image size 1104, 16 important colors	English	United States	0.24668874172185432
RT_BITMAP	0xd1658	0x778	Device independent bitmap graphic, 24 x 26 x 24, image size 1872	English	United States	0.5648535564853556
RT_BITMAP	0xd1dd0	0x48ac	Device independent bitmap graphic, 121 x 51 x 24, image size 18564	English	United States	0.5423027305955709
RT_BITMAP	0xd8290	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0xd8348	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0xa0ed0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	United States	0.6486486486486487
RT_ICON	0xa0ff8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5027075812274369
RT_ICON	0xa18a0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 256	English	United States	0.6151315789473685
RT_ICON	0xa19d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5765895953757225
RT_ICON	0xa1f78	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.09005376344086022
RT_ICON	0xa2260	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.10613540197461213
RT_ICON	0xa38b0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.09005376344086022
RT_ICON	0xa3b98	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.3751763046544429
RT_ICON	0xa51e8	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.222672778561354
RT_ICON	0xa6810	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4608	English	United States	0.2260225669957687
RT_ICON	0xa7e60	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.42930183356840623
RT_ICON	0xa94a0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.20026881720430106
RT_ICON	0xa9788	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.36486486486486486
RT_ICON	0xa98d8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.2903225806451613
RT_ICON	0xa9bc0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.46283783783783783
RT_ICON	0xa9d10	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.2445345557122708
RT_ICON	0xab350	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.33796296296296297
RT_ICON	0xac010	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.2941358024691358
RT_ICON	0xaccd0	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768	English	United States	0.3704128440366973
RT_ICON	0xad050	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.21635802469135804
RT_ICON	0xadd10	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768	English	United States	0.19954128440366972
RT_ICON	0xae090	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.2851851851851852
RT_ICON	0xaed50	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768	English	United States	0.8061926605504587
RT_ICON	0xaf0b8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5009025270758123
RT_ICON	0xaf988	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.2243827160493827
RT_ICON	0xb0648	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.17716049382716048
RT_ICON	0xb1308	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.1712962962962963
RT_ICON	0xb1fc8	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.2564814814814815
RT_ICON	0xb2c88	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.1728395061728395
RT_ICON	0xb3948	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.21820987654320986
RT_ICON	0xb4608	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.22870370370370371
RT_ICON	0xb52c8	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.23271604938271606
RT_ICON	0xb5f88	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.24876543209876542
RT_ICON	0xb6c48	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.31635802469135804
RT_ICON	0xb7908	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.2515432098765432
RT_ICON	0xb85c8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.3737009919697685
RT_ICON	0xbc808	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.38468351440717996
RT_ICON	0xc0a48	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.2920996693434105
RT_MENU	0xd66b0	0x92	data	English	United States	0.678082191780822
RT_MENU	0xd6748	0x1ca	data	English	United States	0.5218340611353712
RT_MENU	0xd6918	0x1ea	data	English	United States	0.5081632653061224
RT_DIALOG	0xc4c88	0x204	data	English	United States	0.5581395348837209
RT_DIALOG	0xc59c0	0x176	data	English	United States	0.5294117647058824
RT_DIALOG	0xc5140	0x1e0	data	English	United States	0.46875
RT_DIALOG	0xc5320	0x136	data	English	United States	0.6129032258064516
RT_DIALOG	0xc4fd0	0x16a	data	English	United States	0.638121546961326
RT_DIALOG	0xc4e90	0x13a	data	English	United States	0.6337579617834395
RT_DIALOG	0xc5458	0x320	data	English	United States	0.4775
RT_DIALOG	0xc5778	0x244	data	English	United States	0.5155172413793103
RT_DIALOG	0xc5b38	0x30c	data	English	United States	0.4782051282051282
RT_DIALOG	0xd6b08	0x1e0	data	Hebrew	Israel	0.5604166666666667
RT_DIALOG	0xc5f58	0x184	dBase III DBT, next free block index 4294901761	English	United States	0.5773195876288659
RT_DIALOG	0xc5e48	0x110	data	English	United States	0.6139705882352942
RT_DIALOG	0xd8170	0xe8	data	English	United States	0.6336206896551724
RT_DIALOG	0xd8258	0x34	data	English	United States	0.9038461538461539
RT_STRING	0xd8490	0x7a	data	English	United States	0.6967213114754098
RT_STRING	0xd8510	0x21a	data	English	United States	0.4646840148698885
RT_STRING	0xd8ab0	0xb6	data	English	United States	0.5604395604395604
RT_STRING	0xd8838	0x12c	data	English	United States	0.5533333333333333
RT_STRING	0xd8b68	0x38	data	English	United States	0.6607142857142857
RT_STRING	0xd8730	0x106	data	English	United States	0.5801526717557252
RT_STRING	0xd8968	0x146	data	English	United States	0.5368098159509203
RT_STRING	0xdac58	0x42	data	English	United States	0.6666666666666666
RT_STRING	0xd8ba0	0x156	data	English	United States	0.5555555555555556
RT_STRING	0xd8cf8	0x1b0	data	English	United States	0.47453703703703703
RT_STRING	0xd8ea8	0x372	data	English	United States	0.3526077097505669
RT_STRING	0xd9220	0x5d0	data	English	United States	0.2762096774193548
RT_STRING	0xd97f0	0x49c	data	English	United States	0.35084745762711866
RT_STRING	0xd9c90	0x400	data	English	United States	0.3291015625
RT_STRING	0xda090	0x4b4	data	English	United States	0.36212624584717606
RT_STRING	0xda548	0x310	data	English	United States	0.38903061224489793
RT_STRING	0xda858	0x210	data	English	United States	0.44696969696969696
RT_STRING	0xdaa68	0x1ee	data	English	United States	0.44129554655870445
RT_STRING	0xdaca0	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0xdad28	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0xdad58	0x192	data	English	United States	0.48009950248756217
RT_STRING	0xdaef0	0x4e2	data	English	United States	0.376
RT_STRING	0xdb768	0x31a	data	English	United States	0.2682619647355164
RT_STRING	0xdb488	0x2dc	data	English	United States	0.36885245901639346
RT_STRING	0xdc2c8	0x8a	data	English	United States	0.6594202898550725
RT_STRING	0xdb3d8	0xac	data	English	United States	0.45348837209302323
RT_STRING	0xdc1b8	0xde	data	English	United States	0.536036036036036
RT_STRING	0xdba88	0x4c4	data	English	United States	0.3221311475409836
RT_STRING	0xdbf50	0x264	data	English	United States	0.3741830065359477
RT_STRING	0xdc298	0x2c	data	English	United States	0.5227272727272727
RT_STRING	0xdc358	0x42	data	English	United States	0.6060606060606061
RT_ACCELERATOR	0xd6ce8	0x10	data	Hebrew	Israel	1.375
RT_GROUP_CURSOR	0xd6ee8	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0xd76d8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd7048	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd7588	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd7438	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd7d68	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd72e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd7978	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd7198	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd7828	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd7ac8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd7c18	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd7eb8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd8008	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xd8158	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0xa1f38	0x3e	data	English	United States	0.8548387096774194
RT_GROUP_ICON	0xa3888	0x22	data	English	United States	1.1470588235294117
RT_GROUP_ICON	0xa51c0	0x22	data	English	United States	1.1176470588235294
RT_GROUP_ICON	0xa7e38	0x22	data	English	United States	0.8529411764705882
RT_GROUP_ICON	0xa9488	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xa98b0	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0xa9ce8	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0xab338	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xabff8	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xaccb8	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xad038	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xadcf8	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xae078	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xaed38	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xaf960	0x22	data	English	United States	1.088235294117647
RT_GROUP_ICON	0xb0630	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xb12f0	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xb1fb0	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xb2c70	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xb3930	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xb45f0	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xb52b0	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xb5f70	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xb6c30	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xb78f0	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xb85b0	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xbc7f0	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xc0a30	0x14	data	English	United States	1.25
RT_GROUP_ICON	0xc4c70	0x14	data	English	United States	1.25
RT_VERSION	0xc60e0	0x340	data	English	United States	0.43149038461538464
RT_MANIFEST	0xdc3a0	0x188	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (332), with CRLF line terminators	English	United States	0.673469387755102
RT_MANIFEST	0xc6420	0x453	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4173441734417344
None	0xd6680	0x1c	data	English	United States	1.2142857142857142
None	0xd66a0	0x10	data	English	United States	1.5

Imports

DLL	Import
KERNEL32.dll	GetVersion, VirtualQuery, FlushInstructionCache, GetSystemDirectoryA, GetWindowsDirectoryA, GetModuleFileNameA, GetModuleHandleA, FreeLibrary, InterlockedExchange, CompareStringA, CreateThread, LoadLibraryA, CreateFileA, GetCurrentProcessId, GetLocalTime, GetCurrentDirectoryA, CloseHandle, CreateProcessA, Sleep, InterlockedDecrement, SetLastError, ResetEvent, WaitForSingleObject, SetEvent, LocalFree, GetLastError, LoadResource, LockResource, SizeofResource, SetEnvironmentVariableA, SetStdHandle, GetConsoleOutputCP, WriteConsoleA, IsValidLocale, EnumSystemLocalesA, GetLocaleInfoA, GetUserDefaultLCID, GetStringTypeA, GetConsoleMode, GetConsoleCP, LCMapStringA, GetOEMCP, GetACP, GetTimeZoneInformation, QueryPerformanceCounter, VirtualFree, HeapCreate, HeapDestroy, GetStartupInfoA, GetFileType, SetHandleCount, GetCommandLineW, GetCommandLineA, GetEnvironmentStrings, FreeEnvironmentStringsA, GetStdHandle, GetSystemInfo, VirtualAlloc, VirtualProtect, HeapSize, ExitProcess, HeapReAlloc, GetVersionExA, LocalAlloc, OpenMutexA, CreateMutexA, ReleaseMutex, OpenProcess, lstrlenA, FreeResource, GlobalFree, GlobalUnlock, GlobalLock, MulDiv, GlobalAlloc, GlobalDeleteAtom, GetCurrentThreadId, lstrcmpA, EnumResourceLanguagesW, ConvertDefaultLocale, GetCurrentThread, GlobalFlags, LeaveCriticalSection, TlsGetValue, EnterCriticalSection, GlobalReAlloc, GlobalHandle, InitializeCriticalSection, TlsAlloc, TlsSetValue, LocalReAlloc, DeleteCriticalSection, TlsFree, InterlockedIncrement, GetThreadLocale, FileTimeToSystemTime, ReadFile, WriteFile, SetFilePointer, FlushFileBuffers, LockFile, UnlockFile, SetEndOfFile, GetFileSize, DuplicateHandle, GetCurrentProcess, FindClose, SetErrorMode, FileTimeToLocalFileTime, GetFileTime, GetTickCount, HeapFree, HeapAlloc, GetProcessHeap, RtlUnwind, GetSystemTimeAsFileTime, RaiseException, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent
ADVAPI32.dll	RegCreateKeyExA, FreeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAce, AddAccessDeniedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, RegOpenKeyExA, RegQueryValueExA, CryptReleaseContext, CryptImportKey, CryptSetKeyParam, CryptAcquireContextA, CryptGetProvParam, CryptGetKeyParam, CryptDestroyKey, CryptGetUserKey, CryptExportKey, CryptAcquireContextW, CryptSetProvParam, RegCloseKey
USER32.dll	GetDesktopWindow, GetMenuState, SystemParametersInfoA, IntersectRect, SetWindowPos, PtInRect, DeferWindowPos, EqualRect, AdjustWindowRectEx, GetSysColor, UpdateWindow, IsWindowVisible, GetKeyState, TrackPopupMenu, ScrollWindow, MapWindowPoints, GetMessageTime, UnhookWindowsHookEx, GetTopWindow, EndDeferWindowPos, BeginDeferWindowPos, GetLastActivePopup, SetFocus, GetFocus, CallNextHookEx, GetCapture, IsChild, SendDlgItemMessageA, CheckMenuItem, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, MoveWindow, InflateRect, DestroyMenu, PostQuitMessage, ValidateRect, GetCursorPos, TranslateMessage, SetCursor, ReleaseDC, GetDC, EndDialog, GetActiveWindow, SetWindowContextHelpId, GetWindowDC, BeginPaint, EndPaint, FlashWindow, SetRect, KillTimer, GetSysColorBrush, SetCapture, ReleaseCapture, IsRectEmpty, InvalidateRgn, GetNextDlgGroupItem, GetDCEx, LockWindowUpdate, SetParent, UnregisterClassA, GetSystemMetrics, GetMessagePos, SetForegroundWindow, AttachThreadInput, GetForegroundWindow, GetWindowThreadProcessId, ShowWindow, GetWindowPlacement, GetDlgCtrlID, GetDlgItem, SetActiveWindow, MessageBeep, SetTimer, GetWindow, CopyRect, OffsetRect, DrawIcon, DeleteMenu, EnableMenuItem, SetMenuDefaultItem, GetMenuItemCount, GetMenuItemID, GetSubMenu, RemoveMenu, GetMenu, SetMenu, IsIconic, GetWindowRect, GetClientRect, ClientToScreen, ScreenToClient, DestroyWindow, IsWindow, IsWindowEnabled, GetParent, MapDialogRect, GetNextDlgTabItem, SetRectEmpty, WindowFromPoint, InvalidateRect
SHELL32.dll	ShellExecuteA
CRYPT32.dll	CertOpenStore, CertEnumCertificatesInStore, CertDeleteCertificateFromStore, CertGetCertificateContextProperty, CertSetCertificateContextProperty, CertOpenSystemStoreW, CertAddCertificateContextToStore, CertCloseStore, CertCreateCertificateContext, CertCompareCertificate, CertGetNameStringA, CertGetIntendedKeyUsage, CertFreeCertificateContext, CertGetEnhancedKeyUsage, CertGetNameStringW
WinSCard.dll	SCardReleaseContext, SCardEstablishContext, SCardStatusA, SCardReconnect, SCardFreeMemory, SCardDisconnect, SCardGetStatusChangeA, SCardBeginTransaction, SCardEndTransaction, SCardListReadersA, g_rgSCardT0Pci, SCardTransmit, g_rgSCardT1Pci, SCardConnectA
WTSAPI32.dll	WTSFreeMemory, WTSQuerySessionInformationA
COMCTL32.dll	InitCommonControlsEx
SHLWAPI.dll	PathFindExtensionW, PathFindFileNameW, PathStripToRootW, PathIsUNCW
ole32.dll	OleRun, CoCreateInstance, CoUninitialize, CoCreateGuid, CoInitialize, CoTaskMemFree, CoTaskMemAlloc, CLSIDFromProgID, CLSIDFromString, CoGetClassObject, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CreateILockBytesOnHGlobal, OleUninitialize, CoFreeUnusedLibraries, OleInitialize, CoRevokeClassObject, CoRegisterMessageFilter, OleIsCurrentClipboard, OleFlushClipboard
OLEAUT32.dll	SysAllocString, OleCreateFontIndirect, SystemTimeToVariantTime, SafeArrayDestroy, SysStringLen, SysAllocStringLen, VariantTimeToSystemTime, VariantChangeType, VariantClear, VariantInit, VariantCopy, SysFreeString, SysStringByteLen, SysAllocStringByteLen, GetErrorInfo
PSAPI.DLL	EnumProcessModules, GetModuleBaseNameA
GDI32.dll	GetRgnBox, GetTextColor, GetMapMode, CombineRgn, SetRectRgn, GetBkColor, GetClipBox, SetTextColor, CreatePatternBrush, ExtSelectClipRgn, ScaleWindowExtEx, SetWindowExtEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, Escape, RectVisible, SetBkColor, CreateBitmap, CreateCompatibleDC, DeleteObject, SelectObject, DeleteDC, StretchDIBits, CreateCompatibleBitmap, CreateRectRgnIndirect, PatBlt, SaveDC, RestoreDC, SetBkMode, GetStockObject, PtVisible, GetWindowExtEx, GetViewportExtEx, CreateRectRgn, GetDeviceCaps, SelectClipRgn, IntersectClipRect, ExcludeClipRect, SetMapMode
WINSPOOL.DRV	ClosePrinter

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Hebrew	Israel

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 23:59:56.631649971 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:56.631697893 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:56.631758928 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:56.632332087 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:56.632345915 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:56.941304922 CEST	49704	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:56.941427946 CEST	443	49704	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:56.941514969 CEST	49704	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:56.941699028 CEST	49704	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:56.941735983 CEST	443	49704	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.022367001 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.025253057 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.025275946 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.026133060 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.026202917 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.028664112 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.028770924 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.029298067 CEST	49705	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.029325962 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.029550076 CEST	49705	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.029783964 CEST	49706	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.029824972 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.029892921 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.029901028 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.029922009 CEST	49706	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.030114889 CEST	49705	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.030133009 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.030318022 CEST	49706	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.030337095 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.082911968 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.329706907 CEST	443	49704	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.330001116 CEST	49704	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.330044031 CEST	443	49704	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.330914974 CEST	443	49704	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.330988884 CEST	49704	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.331259966 CEST	49704	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.331321955 CEST	443	49704	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.331379890 CEST	49704	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.363903046 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.364177942 CEST	49705	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.364191055 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.364695072 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.365067959 CEST	49705	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.365151882 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.365180016 CEST	49705	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.376125097 CEST	443	49704	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.384845972 CEST	49704	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.384866953 CEST	443	49704	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.412122011 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.413332939 CEST	49704	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.413418055 CEST	443	49704	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.413482904 CEST	49704	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.416825056 CEST	49705	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.421863079 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.422106028 CEST	49706	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.422137022 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.422789097 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.423082113 CEST	49706	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.423176050 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.423194885 CEST	49706	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.435662031 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.435700893 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.435719967 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.435736895 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.435767889 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.435784101 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.435816050 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.447114944 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.447169065 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.447246075 CEST	49701	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.447262049 CEST	443	49701	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:57.463860989 CEST	49706	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:57.463913918 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.149374962 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.149451971 CEST	49705	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.149471045 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.149558067 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.149605989 CEST	49705	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.300950050 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.301044941 CEST	49706	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.301110029 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.301542997 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.301603079 CEST	49706	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.425776958 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 23:59:58.433998108 CEST	49705	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.434020042 CEST	443	49705	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.434565067 CEST	49706	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.434616089 CEST	443	49706	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.447952986 CEST	49707	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.448012114 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.448149920 CEST	49707	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.448582888 CEST	49707	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.448611975 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.730958939 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 23:59:58.771342039 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.771399975 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.771469116 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.777365923 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.777380943 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.819948912 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.828847885 CEST	49707	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.828891039 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.829315901 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.830600977 CEST	49707	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.830698013 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:58.844969988 CEST	49707	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:58.888163090 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.151356936 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.151416063 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.151473999 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.151473999 CEST	49707	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.151519060 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.151576996 CEST	49707	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.151592970 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.151613951 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.151667118 CEST	49707	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.152007103 CEST	49707	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.152033091 CEST	443	49707	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.170430899 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.170686960 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.170711040 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.171698093 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.171765089 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.172068119 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.172131062 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.172199011 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.172207117 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.223820925 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.335865974 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 26, 2024 23:59:59.561316013 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.561351061 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.561424971 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.561427116 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.561464071 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.561502934 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.561511993 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.561522007 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.561562061 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.562309027 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.562326908 CEST	443	49708	142.250.217.196	192.168.2.16
Apr 26, 2024 23:59:59.562335014 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 26, 2024 23:59:59.562370062 CEST	49708	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:00:00.164160013 CEST	49689	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:00.543283939 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 27, 2024 00:00:01.240596056 CEST	49714	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:00:01.240633011 CEST	443	49714	142.250.217.196	192.168.2.16
Apr 27, 2024 00:00:01.240737915 CEST	49714	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:00:01.294642925 CEST	49714	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:00:01.294661045 CEST	443	49714	142.250.217.196	192.168.2.16
Apr 27, 2024 00:00:02.958930969 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 27, 2024 00:00:06.278307915 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 27, 2024 00:00:06.581928968 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 27, 2024 00:00:07.194859982 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 27, 2024 00:00:07.771856070 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 27, 2024 00:00:08.405438900 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 27, 2024 00:00:10.750180006 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:10.813891888 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 27, 2024 00:00:11.053862095 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:11.656883955 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:12.870862007 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:15.275923967 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:15.627880096 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 27, 2024 00:00:17.386866093 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 27, 2024 00:00:20.079902887 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:25.239017010 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 27, 2024 00:00:25.769047022 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:25.769078016 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:25.769187927 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:25.771430969 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:25.771450996 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.276400089 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.276482105 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:26.288064957 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:26.288081884 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.288369894 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.337888002 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:26.398574114 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:26.440148115 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.753664970 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.753726006 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.753747940 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.753787041 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.753814936 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:26.753837109 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.753849983 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.753931999 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:26.753981113 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.754076004 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:26.754082918 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.754204988 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.754264116 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:26.785938025 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:26.785957098 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:26.785974026 CEST	49716	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:00:26.785980940 CEST	443	49716	20.114.59.183	192.168.2.16
Apr 27, 2024 00:00:29.684202909 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:31.280348063 CEST	49714	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:00:31.324170113 CEST	443	49714	142.250.217.196	192.168.2.16
Apr 27, 2024 00:00:32.978291988 CEST	443	49714	142.250.217.196	192.168.2.16
Apr 27, 2024 00:00:32.978373051 CEST	49714	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:00:33.308116913 CEST	49693	80	192.168.2.16	152.195.50.149
Apr 27, 2024 00:00:33.308167934 CEST	49694	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:33.611931086 CEST	49694	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:33.611939907 CEST	49693	80	192.168.2.16	152.195.50.149
Apr 27, 2024 00:00:34.219913960 CEST	49694	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:34.219964981 CEST	49693	80	192.168.2.16	152.195.50.149
Apr 27, 2024 00:00:35.433912039 CEST	49694	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:35.433917046 CEST	49693	80	192.168.2.16	152.195.50.149
Apr 27, 2024 00:00:37.836029053 CEST	49694	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:37.836040974 CEST	49693	80	192.168.2.16	152.195.50.149
Apr 27, 2024 00:00:42.641020060 CEST	49693	80	192.168.2.16	152.195.50.149
Apr 27, 2024 00:00:42.641027927 CEST	49694	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:52.244010925 CEST	49694	80	192.168.2.16	192.229.211.108
Apr 27, 2024 00:00:52.244041920 CEST	49693	80	192.168.2.16	152.195.50.149
Apr 27, 2024 00:01:00.253048897 CEST	49688	443	192.168.2.16	204.79.197.200
Apr 27, 2024 00:01:01.212340117 CEST	49718	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:01:01.212383032 CEST	443	49718	142.250.217.196	192.168.2.16
Apr 27, 2024 00:01:01.212481976 CEST	49718	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:01:01.212789059 CEST	49718	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:01:01.212801933 CEST	443	49718	142.250.217.196	192.168.2.16
Apr 27, 2024 00:01:01.497951031 CEST	443	49718	142.250.217.196	192.168.2.16
Apr 27, 2024 00:01:01.498279095 CEST	49718	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:01:01.498306036 CEST	443	49718	142.250.217.196	192.168.2.16
Apr 27, 2024 00:01:01.498671055 CEST	443	49718	142.250.217.196	192.168.2.16
Apr 27, 2024 00:01:01.498971939 CEST	49718	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:01:01.499036074 CEST	443	49718	142.250.217.196	192.168.2.16
Apr 27, 2024 00:01:01.546972990 CEST	49718	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:01:03.505112886 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:03.505204916 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:03.505326986 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:03.505808115 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:03.505842924 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:03.995737076 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:03.995841980 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:03.998737097 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:03.998744965 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:03.998979092 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.000232935 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:04.044157982 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.479098082 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.479121923 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.479140997 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.479216099 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:04.479250908 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.479302883 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:04.480037928 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.480077982 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.480106115 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:04.480115891 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.480134964 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.480170012 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:04.480211973 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:04.483335018 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:04.483350992 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:04.483377934 CEST	49719	443	192.168.2.16	20.114.59.183
Apr 27, 2024 00:01:04.483383894 CEST	443	49719	20.114.59.183	192.168.2.16
Apr 27, 2024 00:01:11.496412992 CEST	443	49718	142.250.217.196	192.168.2.16
Apr 27, 2024 00:01:11.496473074 CEST	443	49718	142.250.217.196	192.168.2.16
Apr 27, 2024 00:01:11.496553898 CEST	49718	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:01:12.794481993 CEST	49718	443	192.168.2.16	142.250.217.196
Apr 27, 2024 00:01:12.794526100 CEST	443	49718	142.250.217.196	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 23:59:56.497664928 CEST	60738	53	192.168.2.16	1.1.1.1
Apr 26, 2024 23:59:56.497859001 CEST	58397	53	192.168.2.16	1.1.1.1
Apr 26, 2024 23:59:56.610913038 CEST	53	58876	1.1.1.1	192.168.2.16
Apr 26, 2024 23:59:56.630825996 CEST	53	59006	1.1.1.1	192.168.2.16
Apr 26, 2024 23:59:56.630866051 CEST	53	58397	1.1.1.1	192.168.2.16
Apr 26, 2024 23:59:56.630882025 CEST	53	60738	1.1.1.1	192.168.2.16
Apr 26, 2024 23:59:57.466397047 CEST	53	52117	1.1.1.1	192.168.2.16
Apr 27, 2024 00:00:21.848592043 CEST	53	52960	1.1.1.1	192.168.2.16
Apr 27, 2024 00:00:44.841448069 CEST	53	57820	1.1.1.1	192.168.2.16
Apr 27, 2024 00:00:56.498756886 CEST	53	52719	1.1.1.1	192.168.2.16
Apr 27, 2024 00:01:02.453963041 CEST	138	138	192.168.2.16	192.168.2.255
Apr 27, 2024 00:01:14.935237885 CEST	53	58446	1.1.1.1	192.168.2.16
Apr 27, 2024 00:02:01.625503063 CEST	53	64086	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 23:59:56.610991001 CEST	192.168.2.16	1.1.1.1	c238	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:04.628695011 CEST	192.168.2.1	192.168.2.16	c1f4	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:04.683773041 CEST	192.168.2.1	192.168.2.16	c1f4	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:04.910720110 CEST	192.168.2.1	192.168.2.16	c1f2	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:04.910831928 CEST	192.168.2.1	192.168.2.16	c1f2	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:04.910974026 CEST	192.168.2.1	192.168.2.16	c1f2	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:04.911107063 CEST	192.168.2.1	192.168.2.16	c1f2	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:06.278342009 CEST	192.168.2.1	192.168.2.16	8197	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:06.720902920 CEST	192.168.2.1	192.168.2.16	c1f4	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:07.741601944 CEST	192.168.2.1	192.168.2.16	c1f4	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:08.757520914 CEST	192.168.2.1	192.168.2.16	c1f4	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:09.761007071 CEST	192.168.2.1	192.168.2.16	c1f4	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:10.750253916 CEST	192.168.2.1	192.168.2.16	5422	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:15.627908945 CEST	192.168.2.1	192.168.2.16	8197	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:17.386902094 CEST	192.168.2.1	192.168.2.16	51eb	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:17.885059118 CEST	192.168.2.1	192.168.2.16	c1f2	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:17.914328098 CEST	192.168.2.1	192.168.2.16	c1f2	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:17.999636889 CEST	192.168.2.1	192.168.2.16	c1f2	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:18.028049946 CEST	192.168.2.1	192.168.2.16	c1f2	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:18.031125069 CEST	192.168.2.1	192.168.2.16	c1f2	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:19.044256926 CEST	192.168.2.1	192.168.2.16	c1fc	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:20.079936981 CEST	192.168.2.1	192.168.2.16	5422	(Port unreachable)	Destination Unreachable
Apr 27, 2024 00:00:21.055027962 CEST	192.168.2.1	192.168.2.16	c1fc	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 23:59:56.497664928 CEST	192.168.2.16	1.1.1.1	0x2d33	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 23:59:56.497859001 CEST	192.168.2.16	1.1.1.1	0x6ca3	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 23:59:56.630866051 CEST	1.1.1.1	192.168.2.16	0x6ca3	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 23:59:56.630882025 CEST	1.1.1.1	192.168.2.16	0x2d33	No error (0)	www.google.com		142.250.217.196	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49701	142.250.217.196	443	6360	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 21:59:57 UTC	627	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 21:59:57 UTC	1703	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 21:59:57 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-n5XDbjC092wHFAPwLYWCDw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 21:59:57 UTC	1703	IN	Data Raw: 65 61 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6c 61 67 75 61 72 64 69 61 20 61 69 72 70 6f 72 74 22 2c 22 77 77 65 20 64 72 61 66 74 22 2c 22 72 69 6e 67 20 64 6f 6f 72 62 65 6c 6c 20 6c 61 77 73 75 69 74 20 73 65 74 74 6c 65 6d 65 6e 74 22 2c 22 72 61 6e 67 65 72 73 20 76 73 20 63 61 70 69 74 61 6c 73 20 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 22 61 70 70 6c 65 20 69 70 68 6f 6e 65 20 31 36 20 70 72 6f 20 6d 61 78 20 72 65 6c 65 61 73 65 20 64 61 74 65 22 2c 22 6a 74 20 73 6f 6e 67 20 6c 79 72 69 63 73 22 2c 22 61 72 61 62 20 66 6f 6f 74 62 61 6c 6c 20 63 6f 61 63 68 22 2c 22 6d 61 6e 6f 72 20 6c 6f 72 64 73 20 67 61 6d 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 Data Ascii: eae)]}'["",["laguardia airport","wwe draft","ring doorbell lawsuit settlement","rangers vs capitals predictions","apple iphone 16 pro max release date","jt song lyrics","arab football coach","manor lords game"],["","","","","","","",""],[],{"google:cli
2024-04-26 21:59:57 UTC	1703	IN	Data Raw: 61 32 35 30 4d 30 64 51 5a 6c 4a 73 62 58 4a 4c 5a 54 55 77 61 56 52 34 64 55 5a 4b 59 33 67 33 56 31 42 4b 57 57 55 7a 65 48 6f 35 64 46 70 5a 62 46 45 30 56 47 52 48 4e 6c 52 4c 4d 6b 31 71 53 56 42 5a 4f 58 56 6c 5a 6a 51 77 57 55 6f 31 53 58 6c 71 61 6b 38 35 52 7a 52 72 52 55 38 77 52 57 34 79 53 6a 64 75 4e 44 41 76 5a 6a 68 42 4d 47 5a 71 61 55 64 30 62 55 46 32 4d 32 74 36 4e 54 63 32 4f 45 5a 4b 61 6a 49 78 62 54 6c 43 4e 6d 78 79 59 55 4a 30 4d 47 70 7a 64 32 73 79 65 44 68 75 63 30 4a 75 53 47 49 33 62 6d 70 57 63 33 5a 79 54 6c 46 35 61 57 52 77 62 48 6c 6a 57 6b 4a 4b 52 32 5a 4a 4d 57 5a 51 62 58 6b 78 4e 30 39 6c 63 33 49 35 52 47 34 72 52 33 67 31 52 32 64 79 4f 56 68 77 57 6d 4a 49 56 7a 4e 44 56 58 4a 30 63 44 52 70 4e 6d 68 31 65 6b 34 Data Ascii: a250M0dQZlJsbXJLZTUwaVR4dUZKY3g3V1BKWWUzeHo5dFpZbFE0VGRHNlRLMk1qSVBZOXVlZjQwWUo1SXlqak85RzRrRU8wRW4ySjduNDAvZjhBMGZqaUd0bUF2M2t6NTc2OEZKajIxbTlCNmxyYUJ0MGpzd2syeDhuc0JuSGI3bmpWc3ZyTlF5aWRwbHljWkJKR2ZJMWZQbXkxN09lc3I5RG4rR3g1R2dyOVhwWmJIVzNDVXJ0cDRpNmh1ek4
2024-04-26 21:59:57 UTC	359	IN	Data Raw: 6a 65 6c 6c 51 55 56 4e 35 52 54 4e 4e 65 58 6b 35 55 33 6c 4e 61 33 5a 54 61 57 78 58 55 30 56 66 54 56 52 52 56 55 46 7a 56 47 74 4c 4f 46 46 77 42 41 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 2c 38 30 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c Data Ascii: jellQUVN5RTNNeXk5U3lNa3ZTaWxXU0VfTVRRVUFzVGtLOFFwBA\u003d\u003d","zl":10002}],"google:suggestrelevance":[1256,1255,1254,1253,1252,1251,1250,800],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],
2024-04-26 21:59:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49704	142.250.217.196	443	6360	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 21:59:57 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49705	142.250.217.196	443	6360	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 21:59:57 UTC	530	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 21:59:58 UTC	1842	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGN3HsLEGIjBXNY7YcegvyOHYSwdfu5I_M0N2dcx3FvhLYsqeDJ9GBKii4_kEKNqzeEuer1mYsD0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgsI3sewsQYQsOrFIhIEZoGY3A Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 21:59:58 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-21; expires=Sun, 26-May-2024 21:59:58 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=ob37hIuTWQzvVqD4f_ifskWGS6X8-1dDHzB2SR61XzfgwaTJ7RkpM4uvHqfvQ-BgnLxeyZpihjAFOrazTjBlV7Vxdia1WKqONsILGC-pGDJUPsJ6kPhDgPrvxgC98UFaAmIAThIWxZ0ceSQADP_yWHSwV3mspICVXqUvT71qt7o; expires=Sat, 26-Oct-2024 21:59:57 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 21:59:58 UTC	458	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49706	142.250.217.196	443	6360	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 21:59:57 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 21:59:58 UTC	1760	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGN3HsLEGIjBX3BfcQ98qwWOS90Bukqjp-iVTJvobixLhl4MnGPX3CMTHq4gdZ2y95_O1i-7EVc0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgsI3sewsQYQvMioWxIEZoGY3A Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 21:59:58 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-21; expires=Sun, 26-May-2024 21:59:58 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=WYsgsoAnXbh5kTXg22fbLRA2rzBcNnL29dPS7CkA-NJHuMAshogS_aUMAACkaP757xA_ybPm2Hjw1EmnrItw2kt4mSuhkdJzJRZjGOcqA3rs8mdLanpY01d3FmYbJDrQEzn08lb2c1yH7cBMHiuQKUMOus6atPA_lVztzx-iUuI; expires=Sat, 26-Oct-2024 21:59:57 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 21:59:58 UTC	417	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49707	142.250.217.196	443	6360	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 21:59:58 UTC	932	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGN3HsLEGIjBXNY7YcegvyOHYSwdfu5I_M0N2dcx3FvhLYsqeDJ9GBKii4_kEKNqzeEuer1mYsD0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-21; NID=513=WYsgsoAnXbh5kTXg22fbLRA2rzBcNnL29dPS7CkA-NJHuMAshogS_aUMAACkaP757xA_ybPm2Hjw1EmnrItw2kt4mSuhkdJzJRZjGOcqA3rs8mdLanpY01d3FmYbJDrQEzn08lb2c1yH7cBMHiuQKUMOus6atPA_lVztzx-iUuI
2024-04-26 21:59:59 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 21:59:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3186 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 21:59:59 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2024-04-26 21:59:59 UTC	1255	IN	Data Raw: 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 69 39 38 43 63 44 6e 54 45 Data Ascii: <script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="i98CcDnTE
2024-04-26 21:59:59 UTC	1032	IN	Data Raw: 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 Data Ascii: ; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly aft

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49708	142.250.217.196	443	6360	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 21:59:59 UTC	738	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGN3HsLEGIjBX3BfcQ98qwWOS90Bukqjp-iVTJvobixLhl4MnGPX3CMTHq4gdZ2y95_O1i-7EVc0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-21; NID=513=WYsgsoAnXbh5kTXg22fbLRA2rzBcNnL29dPS7CkA-NJHuMAshogS_aUMAACkaP757xA_ybPm2Hjw1EmnrItw2kt4mSuhkdJzJRZjGOcqA3rs8mdLanpY01d3FmYbJDrQEzn08lb2c1yH7cBMHiuQKUMOus6atPA_lVztzx-iUuI
2024-04-26 21:59:59 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 21:59:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3114 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 21:59:59 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2024-04-26 21:59:59 UTC	1255	IN	Data Raw: 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 4a 75 4f 54 51 6c 58 4b 31 6c 42 4a 42 38 78 44 4c 6a 52 7a 66 41 5f 44 6f 42 34 47 65 50 56 56 5f Data Ascii: ack = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="JuOTQlXK1lBJB8xDLjRzfA_DoB4GePVV_
2024-04-26 21:59:59 UTC	960	IN	Data Raw: 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e Data Ascii: ogle automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solvin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49716	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:00:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dSFZlPbYWaFfoLW&MD=1HK1+YEa HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 22:00:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 680b3b0f-b056-460f-b523-ceb89a38df5d MS-RequestId: e05a76b8-b5b4-4232-bf27-120131c3b021 MS-CV: nssfvKubhE2vB0fr.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 22:00:26 GMT Connection: close Content-Length: 24490
2024-04-26 22:00:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 22:00:26 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49719	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:01:03 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dSFZlPbYWaFfoLW&MD=1HK1+YEa HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 22:01:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 13690f0d-28c5-44ec-a6e0-a826fd524a5c MS-RequestId: 1778f705-d6fa-4947-9465-df3da0bede04 MS-CV: HcHWYpcksUOJIoSX.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 22:01:03 GMT Connection: close Content-Length: 25457
2024-04-26 22:01:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 22:01:04 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: IDProtect Manager.exePID: 7044, Parent PID: 4380

General

Target ID:	0
Start time:	23:59:50
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\IDProtect Manager.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IDProtect Manager.exe"
Imagebase:	0x400000
File size:	893'008 bytes
MD5 hash:	1C9346769DC9ADA9F73B7269170AD1B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7160, Parent PID: 4792

General

Target ID:	2
Start time:	23:59:54
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6360, Parent PID: 7160

General

Target ID:	3
Start time:	23:59:55
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1960,i,4465652620104932970,15968156762818287997,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7468, Parent PID: 804

General

Target ID:	14
Start time:	00:00:06
Start date:	27/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff7530a0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: IDProtect Manager.exePID: 7648, Parent PID: 4380

General

Target ID:	15
Start time:	00:00:11
Start date:	27/04/2024
Path:	C:\Users\user\Desktop\IDProtect Manager.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IDProtect Manager.exe"
Imagebase:	0x400000
File size:	893'008 bytes
MD5 hash:	1C9346769DC9ADA9F73B7269170AD1B7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: IDProtect Manager.exePID: 7800, Parent PID: 4380

General

Target ID:	16
Start time:	00:00:32
Start date:	27/04/2024
Path:	C:\Users\user\Desktop\IDProtect Manager.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IDProtect Manager.exe"
Imagebase:	0x400000
File size:	893'008 bytes
MD5 hash:	1C9346769DC9ADA9F73B7269170AD1B7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IDProtect Manager.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 56

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
IDProtect Manager.exe