Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
http://live.rezync.com

Overview

General Information

Sample URL:http://live.rezync.com
Analysis ID:1321218
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Stores files to the Windows start menu directory
Creates files inside the system directory

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • chrome.exe (PID: 5168 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • chrome.exe (PID: 6376 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2044,i,5139326226676354790,2101690900924711023,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • chrome.exe (PID: 6688 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://live.rezync.com MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

  • • Compliance
  • • Networking
  • • System Summary
  • • Boot Survival

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.98.116.138:443 -> 192.168.2.3:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.190.196:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.60:443 -> 192.168.2.3:49728 version: TLS 1.2
Source: unknownDNS traffic detected: queries for: clients2.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49676 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49677 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49681 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.43
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.155
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.155
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.43
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.43
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.155
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.134Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.3448/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.3031&MK=v3hcvP3pTd4SwmM&MD=HRKHuT92 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.3448/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.3031&MK=v3hcvP3pTd4SwmM&MD=HRKHuT92 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A410900F086X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-Device-Manufacturer: hobtxi, Inc.X-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAUzDFHKHhs0DpMVB1drr0HZS1A2u0ZmwCj9jT%2BEygAsown1HcVeioYFY2kfMMGPMqMbQ8D1VaNc7qU8imqRvBiPFYS7g%2BpeET7imHJiJO0MWfST6Ize0WidvhfGA5SA04KdShhCxvLU8t1H%2BEYUF5pc/3C2XB4T1HVpVWEizupFvDjWDkhF0T%2Bx412WFPyndSRQf2/O5CM8%2BVUmjl%2BGyxrnv%2B6n8ujSLzxLt6M0fKsQvD5lqtYiuU3%2B7uUBWVFALZ1irhpmof3VDLU3r8il21Nf1WwC5bMsVqZcYGTSKkeuEnV4D7EMz93v67h0fLc0ntL6y%2B8mrpvPcFnI/0fHCPyUDZgAACK2kSqzLi2nSqAFq8ZInQYFIrs4jOvTVgEAxEvnWiOisAqMpdc3bOpNTTODJBMXcwOPpTabNJgKOcA%2B4Hnxy1Kcpb13q2IzAMwXTsBYQfheyyb7ZB0gjCbESrGT2XzPfdssdzhhlQ5BDN8SWoUsuy%2BYRQ6AwRGXvm%2BDW8ajh77SPC5ZTpYRgY5AUbLK7oAznqF%2B7ArngbfT6IjpJsPBMq1xRZEK5xk2x46MHNgJW5Gk0yCowwc581z5HG0oRv/5TlziYcxYEMxvp22Dd2spAbLklHRZoGtzgFFRawTMMR61ciEnmnrDREZlTal6iWqU3a41fFw/xpPdj4709VVCsynWJ/dgQcvwKwJl/Ni1A2Hlt5RtbewI2EMxQFwKsd1epssdRb/UDeTvKZLidpacDe/Qe2hjBDZyMdOGv%2BkKKG2HZ4IYQ4xiUHmslHsPmtu5yYfNlU%2BIypqJ3holefdUH%2BV/Cq8xhR52cxHGXNqmSvQjAMKUXG%2BuVdawY4jEAPnnglKCGD/XO1W5kmyeThp7tW6R4d/MXGJCwGXypOsLgC2CrXUfmJNMeLZ7QUouekL4VLM/l2wE%3D%26p%3DX-Agent-DeviceId: 01000A410900F086X-Device-Product: hobtxi20,1X-BM-CBT: 1696620262User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.10.19041; 10.0.0.0.19045.3448) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 241C37D58E874170803545E59DD3A66BX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=1DFC5692B3C14AD1B3C2CC78B83DC83F&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231005; SRCHHPGUSR=SRCHLANG=en&IPMH=757efe17&IPMID=1696515430661&LUT=1696515430501&HV=1696515336; CortanaAppUID=693D16295E37B41DFA9B23B1924E43EE; MUID=CC2DC5E356C849EFB6E563149520FA2C; MUIDB=CC2DC5E356C849EFB6E563149520FA2C
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: live.rezync.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: live.rezync.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://live.rezync.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Content-Length: 0Connection: keep-aliveDate: Fri, 06 Oct 2023 19:23:21 GMTVary: CookieSet-Cookie: sd-session-id=eyJfcGVybWFuZW50Ijp0cnVlLCJzZXNzaW9uX2lkIjoiYzVjMTkyNGEtNTdiMi00ZDljLThiZmEtZDk2NzMwOWM3MGMwOjE2OTY2MjAyMDEuNTA2MzM5NiJ9.ZSBeqQ.Ul7mdbsX4kUJNM5NPTuosmUrNPk; Expires=Wed, 30 Oct 2024 19:23:21 GMT; HttpOnly; Path=/; SameSite=NoneServer: lighttpd/1.4.69X-Cache: Error from cloudfrontVia: 1.1 81643bff8844b667cc968721a35ef95a.cloudfront.net (CloudFront)X-Amz-Cf-Pop: LAX50-C2X-Amz-Cf-Id: G3Y1b_E3IrDf3OazQ-QHvfZf0yiXZu1F5bZxx0MfmnkuKWfzNHb_SA==
Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2023-10-05-14; NID=511=OL3WgnA24QwPfMpspsItpZ2c_g7YXAAMilzUqiZdxG8z8Ka1c00AfG24ctRwvhPMrHVqO7oNbKVSwiOA0g2EzuMjPJIvQtOS7zZy99O8OkMoKSMKDFs-L1TjxHc_KVN5KBVb4BTfsPAzvlWsn_iACmkP3ulD50w_qpZ6JVqkr7w
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.98.116.138:443 -> 192.168.2.3:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.190.196:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.60:443 -> 192.168.2.3:49728 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_BITS_5168_868387352Jump to behavior
Source: classification engineClassification label: clean1.win@16/6@8/6
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2044,i,5139326226676354790,2101690900924711023,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://live.rezync.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2044,i,5139326226676354790,2101690900924711023,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Google Drive.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		11
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth4
Non-Application Layer Protocol		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration5
Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer3
Ingress Tool Transfer		SIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1321218 URL: http://live.rezync.com Startdate: 06/10/2023 Architecture: WINDOWS Score: 1 5 chrome.exe 9 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.3, 138, 443, 49264 unknown unknown 5->13 15 239.255.255.250 unknown Reserved 5->15 10 chrome.exe 5->10         started        process4 dnsIp5 17 clients.l.google.com 142.250.217.142, 443, 49714 GOOGLEUS United States 10->17 19 www.google.com 142.251.40.36, 443, 49719, 49726 GOOGLEUS United States 10->19 21 3 other IPs or domains 10->21

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
http://live.rezync.com0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
accounts.google.com
172.217.14.109
truefalse
    		high
    www.google.com
    		142.251.40.36
    		truefalse
      		high
      clients.l.google.com
      		142.250.217.142
      		truefalse
        		high
        live.rezync.com
        		13.226.225.23
        		truefalse
          		high
          clients2.google.com
          		unknown
          		unknownfalse
            		high

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1false
              		high
              http://live.rezync.com/false
                		high
                http://live.rezync.com/false
                  		high
                  https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
                    		high
                    http://live.rezync.com/favicon.icofalse
                      		high

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      142.251.40.36
                      		www.google.comUnited States
                      		15169GOOGLEUSfalse
                      13.226.225.23
                      		live.rezync.comUnited States
                      		16509AMAZON-02USfalse
                      142.250.217.142
                      		clients.l.google.comUnited States
                      		15169GOOGLEUSfalse
                      172.217.14.109
                      		accounts.google.comUnited States
                      		15169GOOGLEUSfalse
                      239.255.255.250
                      		unknownReserved
                      		unknownunknownfalse

                      Private

                      IP
                      192.168.2.3

                      General Information

                      Joe Sandbox Version:38.0.0 Ammolite
                      Analysis ID:1321218
                      Start date and time:2023-10-06 21:22:29 +02:00
                      Joe Sandbox Product:CloudBasic
                      Overall analysis duration:0h 2m 57s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:browseurl.jbs
                      Sample URL:http://live.rezync.com
                      Analysis system description:Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:27
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Detection:CLEAN
                      Classification:clean1.win@16/6@8/6
                      EGA Information:Failed
                      HCA Information:
                      • Successful, ratio: 100%
                      • Number of executed functions: 0
                      • Number of non-executed functions: 0
                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, MoUsoCoreWorker.exe, svchost.exe
                      • Excluded IPs from analysis (whitelisted): 142.250.68.67, 34.104.35.123, 142.250.176.3
                      • Excluded domains from analysis (whitelisted): www.bing.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, login.live.com, update.googleapis.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com
                      • Not all processes where analyzed, report is missing behavior information
                      • VT rate limit hit for: http://live.rezync.com

                      Simulations

                      Behavior and APIs

                      ⊘No simulations

                      Joe Sandbox View / Context

                      IPs

                      ⊘No context

                      Domains

                      ⊘No context

                      ASNs

                      ⊘No context

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 18:23:20 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2675
                      Entropy (8bit):3.973199598804598
                      Encrypted:false
                      SSDEEP:48:8OtdzjTT3K3nHkidAKZdA1kLehwiZUklqehyy+3:8O3HEbdy
                      MD5:6B84394AA505E61AD3A9657EEFDA5BD3
                      SHA1:B2A90A497CEC5ECF2421BFF17B04BC41CCE9854D
                      SHA-256:CEE6F2595668854453137CE7D2C79627863DB33765B2C900B4FFB8EF45588C7C
                      SHA-512:440A883662AFF7A3EF706C0DF8B5816A1B96F3C9DA5689A6666A19C991A01C5D679F3CA7F7886E5BB4EF72595A44511D50E964422E3ED559D70F63413AADF76B
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,............v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.q..PROGRA~1..t......O.IFW.....B...............J.....o4_.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFW.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.f..Chrome..>......CW.VFW.....M.....................c...C.h.r.o.m.e.....`.1.....EW.f..APPLIC~1..H......CW.VFW............................P..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VFW.....O......................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..+.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 18:23:20 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2677
                      Entropy (8bit):3.9923712758889973
                      Encrypted:false
                      SSDEEP:48:8AdzjTT3K3nHkidAKZdA1DLeh/iZUkAQkqehNy+2:8QHEP9Qoy
                      MD5:6241FDDB3DCC06CA4FEE57C32DE84445
                      SHA1:5E9E28302E04CEF4BB9300135339F5372C292390
                      SHA-256:618565FB2B1317B027C1DF00D434768D63D7003006628B3892BFBCB04E62DD8B
                      SHA-512:8E20606F652F099141C282E0EDEC71C25A98BCC3013FEA542CBFDEADB4E6245887575CE6164E7FF4A885ABB2C507E36A2E8F7D4E1997AA1982D065E8522E85F5
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,............v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.q..PROGRA~1..t......O.IFW.....B...............J.....o4_.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFW.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.f..Chrome..>......CW.VFW.....M.....................c...C.h.r.o.m.e.....`.1.....EW.f..APPLIC~1..H......CW.VFW............................P..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VFW.....O......................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..+.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 13:13:28 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2691
                      Entropy (8bit):4.00403363699547
                      Encrypted:false
                      SSDEEP:48:8mdzjTT3CnHkidAKZdA14PLeh7sFiZUkmgqeh7sDy+BX:8SHCZn5y
                      MD5:8A2685620A8716FF514CFBBF54E0E074
                      SHA1:B5C7FA88F1608FFD3800C19E643A1941409369C5
                      SHA-256:9D0AC794CC1CFAD048A939A2EDBC209F8B66962AE43E2CDCC2442521DCD64B1A
                      SHA-512:9749AD4613462CA151685FF2375D9599C342F53D9A0C68DA05EF488B4521E6789AA26E7A48BF10B65FA925186EDA8376E472DACDA1EB496B47CE101D03F15AE4
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,.....k........v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.q..PROGRA~1..t......O.IFW.....B...............J.....o4_.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFW.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.f..Chrome..>......CW.VFW.....M.....................c...C.h.r.o.m.e.....`.1.....EW.f..APPLIC~1..H......CW.VFW............................P..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.q....O......................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..+.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 18:23:20 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2679
                      Entropy (8bit):3.9902841587816704
                      Encrypted:false
                      SSDEEP:48:8wdzjTT3K3nHkidAKZdA1mLehDiZUkwqehBy+R:8AHEKLy
                      MD5:84218BCCBF6CE012B7F26090FECCC8E2
                      SHA1:DB14DB9B125181D0832F908F7EDCB36E6BD9447F
                      SHA-256:1870798655A2A5BF746A281941C852D5FC6367EB82B337B2DAC15CF4F29D282A
                      SHA-512:E3D8A97F1BAF0D81EC9493641011FB95C7430BCB21E238179ADAE328EE9B28BDA8F7D53C7A64AF4FCD6AE0F97C170F21F2EBA5956D00AE19EAFC1102B03401EB
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,.............v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.q..PROGRA~1..t......O.IFW.....B...............J.....o4_.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFW.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.f..Chrome..>......CW.VFW.....M.....................c...C.h.r.o.m.e.....`.1.....EW.f..APPLIC~1..H......CW.VFW............................P..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VFW.....O......................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..+.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 18:23:20 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2679
                      Entropy (8bit):3.97828951903104
                      Encrypted:false
                      SSDEEP:48:8ddzjTT3K3nHkidAKZdA1oLehBiZUk1W1qeh/y+C:8nHE69fy
                      MD5:289937074B3E435F1649A17421A4C119
                      SHA1:DEFF7DB5B4C0A10A6C246A870D65DF6CB83239E2
                      SHA-256:3D6015058C796B55C4F6906481D4FE019990F6C1C047299FE293176C8A497A09
                      SHA-512:9CA5006752AB3EB43BEBBB110D81477A4FBF03DD05CA2DC16F047C436D83572154DBE58B842519974046BE389230B1A2E7B85AFAD97162B77BB6B4ED3828CF37
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,.....0......v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.q..PROGRA~1..t......O.IFW.....B...............J.....o4_.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFW.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.f..Chrome..>......CW.VFW.....M.....................c...C.h.r.o.m.e.....`.1.....EW.f..APPLIC~1..H......CW.VFW............................P..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VFW.....O......................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..+.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 18:23:20 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2681
                      Entropy (8bit):3.9913314122967543
                      Encrypted:false
                      SSDEEP:48:8jdzjTT3K3nHkidAKZdA1duTBLehOuTbbiZUk5OjqehOuTb5y+yT+:8JHEDT6TbxWOvTb5y7T
                      MD5:EC597D2D54A0E63F69853726F57DBE1F
                      SHA1:B23EE92A86CA64E582779A14CB26D33783599B7D
                      SHA-256:B46871515999BC98BABCBE74EB418BC93CD2C05331A4379D9FC1582E31804CB9
                      SHA-512:8955EAB84A84AC0A7603DDD3C15EA61534784E91C298BB3B6B6A3A7E9D058470D5E4895E9063EE2D3AECB4493B15FA971223367DBFEF04CBEB077E3BE38A1CF4
                      Malicious:false
                      Reputation:low
                      Preview:L..................F.@.. ...$+.,...../.......v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.q..PROGRA~1..t......O.IFW.....B...............J.....o4_.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFW.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.f..Chrome..>......CW.VFW.....M.....................c...C.h.r.o.m.e.....`.1.....EW.f..APPLIC~1..H......CW.VFW............................P..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VFW.....O......................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........5..+.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      Static File Info

                      ⊘No static file info

                      Network Behavior

                      Download Network PCAP: filtered – full

                      Network Port Distribution

                      • Total Packets: 159
                      • • 443 (HTTPS)
                      • • 80 (HTTP)
                      • • 53 (DNS)
                      TimestampSource PortDest PortSource IPDest IP
                      Oct 6, 2023 21:23:11.924036026 CEST49677443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:11.924063921 CEST49674443192.168.2.3173.222.162.43
                      Oct 6, 2023 21:23:11.924065113 CEST49675443192.168.2.3104.98.116.155
                      Oct 6, 2023 21:23:11.924164057 CEST49676443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:12.330218077 CEST49672443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:14.174330950 CEST49681443192.168.2.320.189.173.5
                      Oct 6, 2023 21:23:14.486519098 CEST49681443192.168.2.320.189.173.5
                      Oct 6, 2023 21:23:15.095797062 CEST49681443192.168.2.320.189.173.5
                      Oct 6, 2023 21:23:15.502053976 CEST49671443192.168.2.3204.79.197.203
                      Oct 6, 2023 21:23:16.299053907 CEST49681443192.168.2.320.189.173.5
                      Oct 6, 2023 21:23:16.736428976 CEST49675443192.168.2.3104.98.116.155
                      Oct 6, 2023 21:23:16.736432076 CEST49677443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:16.736547947 CEST49676443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:16.740206957 CEST49674443192.168.2.3173.222.162.43
                      Oct 6, 2023 21:23:17.142679930 CEST49672443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:18.705173016 CEST49681443192.168.2.320.189.173.5
                      Oct 6, 2023 21:23:19.601247072 CEST49712443192.168.2.3172.217.14.109
                      Oct 6, 2023 21:23:19.601305008 CEST44349712172.217.14.109192.168.2.3
                      Oct 6, 2023 21:23:19.601377010 CEST49712443192.168.2.3172.217.14.109
                      Oct 6, 2023 21:23:19.603049994 CEST49712443192.168.2.3172.217.14.109
                      Oct 6, 2023 21:23:19.603063107 CEST44349712172.217.14.109192.168.2.3
                      Oct 6, 2023 21:23:19.643688917 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:19.643737078 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:19.643835068 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:19.645442963 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:19.645458937 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:19.944070101 CEST44349712172.217.14.109192.168.2.3
                      Oct 6, 2023 21:23:19.944871902 CEST49712443192.168.2.3172.217.14.109
                      Oct 6, 2023 21:23:19.944878101 CEST44349712172.217.14.109192.168.2.3
                      Oct 6, 2023 21:23:19.947216034 CEST44349712172.217.14.109192.168.2.3
                      Oct 6, 2023 21:23:19.947330952 CEST49712443192.168.2.3172.217.14.109
                      Oct 6, 2023 21:23:19.949678898 CEST49712443192.168.2.3172.217.14.109
                      Oct 6, 2023 21:23:19.949763060 CEST44349712172.217.14.109192.168.2.3
                      Oct 6, 2023 21:23:19.957643986 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:19.959393024 CEST49712443192.168.2.3172.217.14.109
                      Oct 6, 2023 21:23:19.959399939 CEST44349712172.217.14.109192.168.2.3
                      Oct 6, 2023 21:23:19.959521055 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:19.959527969 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:19.960042000 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:19.960100889 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:19.961036921 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:19.961102962 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:19.961868048 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:19.961945057 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:19.961993933 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:19.961998940 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:20.060122967 CEST49712443192.168.2.3172.217.14.109
                      Oct 6, 2023 21:23:20.060209036 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:20.263200045 CEST44349712172.217.14.109192.168.2.3
                      Oct 6, 2023 21:23:20.263566971 CEST44349712172.217.14.109192.168.2.3
                      Oct 6, 2023 21:23:20.263628006 CEST49712443192.168.2.3172.217.14.109
                      Oct 6, 2023 21:23:20.264208078 CEST49712443192.168.2.3172.217.14.109
                      Oct 6, 2023 21:23:20.264223099 CEST44349712172.217.14.109192.168.2.3
                      Oct 6, 2023 21:23:20.282247066 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:20.282630920 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:20.282685041 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:20.282855034 CEST49714443192.168.2.3142.250.217.142
                      Oct 6, 2023 21:23:20.282865047 CEST44349714142.250.217.142192.168.2.3
                      Oct 6, 2023 21:23:21.048743963 CEST4971580192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:21.049185991 CEST4971680192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:21.170089960 CEST4971780192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:21.193519115 CEST804971613.226.225.23192.168.2.3
                      Oct 6, 2023 21:23:21.193742037 CEST4971680192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:21.193842888 CEST4971680192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:21.195050001 CEST804971513.226.225.23192.168.2.3
                      Oct 6, 2023 21:23:21.195249081 CEST4971580192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:21.317575932 CEST804971713.226.225.23192.168.2.3
                      Oct 6, 2023 21:23:21.317879915 CEST4971780192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:21.337239027 CEST804971613.226.225.23192.168.2.3
                      Oct 6, 2023 21:23:21.389283895 CEST804971613.226.225.23192.168.2.3
                      Oct 6, 2023 21:23:21.430623055 CEST4971680192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:21.575143099 CEST804971613.226.225.23192.168.2.3
                      Oct 6, 2023 21:23:21.602385998 CEST804971613.226.225.23192.168.2.3
                      Oct 6, 2023 21:23:21.642765999 CEST4971680192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:22.359117031 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:22.359258890 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:23.514427900 CEST49681443192.168.2.320.189.173.5
                      Oct 6, 2023 21:23:23.997195959 CEST49719443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:23:23.997219086 CEST44349719142.251.40.36192.168.2.3
                      Oct 6, 2023 21:23:23.997272015 CEST49719443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:23:23.997474909 CEST49719443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:23:23.997483015 CEST44349719142.251.40.36192.168.2.3
                      Oct 6, 2023 21:23:24.302767992 CEST44349719142.251.40.36192.168.2.3
                      Oct 6, 2023 21:23:24.303055048 CEST49719443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:23:24.303066969 CEST44349719142.251.40.36192.168.2.3
                      Oct 6, 2023 21:23:24.304694891 CEST44349719142.251.40.36192.168.2.3
                      Oct 6, 2023 21:23:24.304763079 CEST49719443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:23:24.306138039 CEST49719443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:23:24.306221008 CEST44349719142.251.40.36192.168.2.3
                      Oct 6, 2023 21:23:24.357131958 CEST49719443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:23:24.357139111 CEST44349719142.251.40.36192.168.2.3
                      Oct 6, 2023 21:23:24.404009104 CEST49719443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:23:25.107218981 CEST49671443192.168.2.3204.79.197.203
                      Oct 6, 2023 21:23:26.343636990 CEST49674443192.168.2.3173.222.162.43
                      Oct 6, 2023 21:23:26.343636990 CEST49675443192.168.2.3104.98.116.155
                      Oct 6, 2023 21:23:26.343703985 CEST49677443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:26.343732119 CEST49676443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:26.749758005 CEST49672443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:33.123285055 CEST49681443192.168.2.320.189.173.5
                      Oct 6, 2023 21:23:34.286070108 CEST44349719142.251.40.36192.168.2.3
                      Oct 6, 2023 21:23:34.286230087 CEST44349719142.251.40.36192.168.2.3
                      Oct 6, 2023 21:23:34.286314011 CEST49719443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:23:34.926789999 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:34.926835060 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:34.926912069 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:34.929651976 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:34.929666996 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:35.744426966 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:35.744673014 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:35.749691010 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:35.749711037 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:35.750155926 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:35.795116901 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:35.815006018 CEST49719443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:23:35.815052032 CEST44349719142.251.40.36192.168.2.3
                      Oct 6, 2023 21:23:35.981854916 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:36.022454977 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:36.533101082 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:36.533190012 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:36.533212900 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:36.533278942 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:36.533318996 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:36.533394098 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:36.533415079 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:36.533427954 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:36.533502102 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:36.533567905 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:36.533675909 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:36.533683062 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:36.533772945 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:36.533823967 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:36.555470943 CEST49720443192.168.2.340.127.169.103
                      Oct 6, 2023 21:23:36.555485964 CEST4434972040.127.169.103192.168.2.3
                      Oct 6, 2023 21:23:37.403331995 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.550811052 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:37.571652889 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:37.571718931 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:37.571758986 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:37.571796894 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:37.571850061 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.571851015 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.571851015 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.571851015 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.719325066 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:37.719357967 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:37.719537020 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.720367908 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.722449064 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.869955063 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:37.886657000 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:37.886766911 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.887432098 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.887505054 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.887686968 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:37.887868881 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:38.034730911 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:38.034787893 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:38.034805059 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:38.034820080 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:38.034838915 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:38.048522949 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:38.048557997 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:38.048890114 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:38.113502979 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:38.113940954 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:38.154819012 CEST44349709104.98.116.138192.168.2.3
                      Oct 6, 2023 21:23:38.155291080 CEST49709443192.168.2.3104.98.116.138
                      Oct 6, 2023 21:23:51.340228081 CEST804971513.226.225.23192.168.2.3
                      Oct 6, 2023 21:23:51.340781927 CEST4971580192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:51.467147112 CEST804971713.226.225.23192.168.2.3
                      Oct 6, 2023 21:23:51.467263937 CEST4971780192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:51.780545950 CEST4971580192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:51.780623913 CEST4971780192.168.2.313.226.225.23
                      Oct 6, 2023 21:23:51.925859928 CEST804971713.226.225.23192.168.2.3
                      Oct 6, 2023 21:23:51.925892115 CEST804971513.226.225.23192.168.2.3
                      Oct 6, 2023 21:24:05.106829882 CEST4970780192.168.2.323.64.190.239
                      Oct 6, 2023 21:24:05.106956005 CEST49708443192.168.2.3184.30.178.114
                      Oct 6, 2023 21:24:05.252698898 CEST804970723.64.190.239192.168.2.3
                      Oct 6, 2023 21:24:05.253026962 CEST4970780192.168.2.323.64.190.239
                      Oct 6, 2023 21:24:05.254724026 CEST44349708184.30.178.114192.168.2.3
                      Oct 6, 2023 21:24:05.254779100 CEST44349708184.30.178.114192.168.2.3
                      Oct 6, 2023 21:24:05.254915953 CEST49708443192.168.2.3184.30.178.114
                      Oct 6, 2023 21:24:05.254915953 CEST49708443192.168.2.3184.30.178.114
                      Oct 6, 2023 21:24:06.606878996 CEST4971680192.168.2.313.226.225.23
                      Oct 6, 2023 21:24:06.750967979 CEST804971613.226.225.23192.168.2.3
                      Oct 6, 2023 21:24:09.966604948 CEST4971180192.168.2.3192.229.211.108
                      Oct 6, 2023 21:24:09.966626883 CEST4971080192.168.2.38.250.197.254
                      Oct 6, 2023 21:24:10.103538036 CEST8049711192.229.211.108192.168.2.3
                      Oct 6, 2023 21:24:10.103842020 CEST4971180192.168.2.3192.229.211.108
                      Oct 6, 2023 21:24:10.158375025 CEST80497108.250.197.254192.168.2.3
                      Oct 6, 2023 21:24:10.158665895 CEST4971080192.168.2.38.250.197.254
                      Oct 6, 2023 21:24:12.911803961 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:12.911881924 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:12.911973953 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:12.912584066 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:12.912661076 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:13.736043930 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:13.736175060 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:13.737883091 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:13.737901926 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:13.738877058 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:13.740432978 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:13.782522917 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:14.533329964 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:14.533395052 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:14.533441067 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:14.533468008 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:14.533483982 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:14.533582926 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:14.533621073 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:14.533621073 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:14.533632040 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:14.533643007 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:14.533658028 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:14.533718109 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:14.533751011 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:14.533812046 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:14.536442041 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:14.536456108 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:14.536474943 CEST49721443192.168.2.340.127.169.103
                      Oct 6, 2023 21:24:14.536482096 CEST4434972140.127.169.103192.168.2.3
                      Oct 6, 2023 21:24:23.896744967 CEST49726443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:24:23.896795034 CEST44349726142.251.40.36192.168.2.3
                      Oct 6, 2023 21:24:23.896866083 CEST49726443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:24:23.897177935 CEST49726443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:24:23.897186995 CEST44349726142.251.40.36192.168.2.3
                      Oct 6, 2023 21:24:24.200627089 CEST44349726142.251.40.36192.168.2.3
                      Oct 6, 2023 21:24:24.200942039 CEST49726443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:24:24.200987101 CEST44349726142.251.40.36192.168.2.3
                      Oct 6, 2023 21:24:24.201649904 CEST44349726142.251.40.36192.168.2.3
                      Oct 6, 2023 21:24:24.202121019 CEST49726443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:24:24.202217102 CEST44349726142.251.40.36192.168.2.3
                      Oct 6, 2023 21:24:24.246987104 CEST49726443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:24:25.005667925 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.005700111 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.005832911 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.007885933 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.007896900 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.487562895 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.487694025 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.532906055 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.532929897 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.533442974 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.534672022 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.534720898 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.534758091 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.890347958 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.890388966 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.890465021 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.890470028 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.890491009 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.890538931 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.890579939 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.890619040 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.902004957 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.902023077 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:25.902045965 CEST49727443192.168.2.320.190.190.196
                      Oct 6, 2023 21:24:25.902053118 CEST4434972720.190.190.196192.168.2.3
                      Oct 6, 2023 21:24:26.473304033 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:26.473350048 CEST44349728173.222.162.60192.168.2.3
                      Oct 6, 2023 21:24:26.473489046 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:26.476516008 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:26.476538897 CEST44349728173.222.162.60192.168.2.3
                      Oct 6, 2023 21:24:26.935197115 CEST44349728173.222.162.60192.168.2.3
                      Oct 6, 2023 21:24:26.935316086 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:27.025890112 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:27.025916100 CEST44349728173.222.162.60192.168.2.3
                      Oct 6, 2023 21:24:27.026911974 CEST44349728173.222.162.60192.168.2.3
                      Oct 6, 2023 21:24:27.028223991 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:27.033078909 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:27.033153057 CEST44349728173.222.162.60192.168.2.3
                      Oct 6, 2023 21:24:28.245199919 CEST44349728173.222.162.60192.168.2.3
                      Oct 6, 2023 21:24:28.245256901 CEST44349728173.222.162.60192.168.2.3
                      Oct 6, 2023 21:24:28.245358944 CEST44349728173.222.162.60192.168.2.3
                      Oct 6, 2023 21:24:28.245501995 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:28.245502949 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:28.245502949 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:28.249171019 CEST49728443192.168.2.3173.222.162.60
                      Oct 6, 2023 21:24:28.249193907 CEST44349728173.222.162.60192.168.2.3
                      Oct 6, 2023 21:24:34.190514088 CEST44349726142.251.40.36192.168.2.3
                      Oct 6, 2023 21:24:34.190643072 CEST44349726142.251.40.36192.168.2.3
                      Oct 6, 2023 21:24:34.190713882 CEST49726443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:24:35.780244112 CEST49726443192.168.2.3142.251.40.36
                      Oct 6, 2023 21:24:35.780275106 CEST44349726142.251.40.36192.168.2.3
                      TimestampSource PortDest PortSource IPDest IP
                      Oct 6, 2023 21:23:19.433588028 CEST6364553192.168.2.31.1.1.1
                      Oct 6, 2023 21:23:19.434293032 CEST5328453192.168.2.31.1.1.1
                      Oct 6, 2023 21:23:19.434911013 CEST6067353192.168.2.31.1.1.1
                      Oct 6, 2023 21:23:19.435169935 CEST6504353192.168.2.31.1.1.1
                      Oct 6, 2023 21:23:19.551280975 CEST53580151.1.1.1192.168.2.3
                      Oct 6, 2023 21:23:19.583621979 CEST53636451.1.1.1192.168.2.3
                      Oct 6, 2023 21:23:19.584485054 CEST53650431.1.1.1192.168.2.3
                      Oct 6, 2023 21:23:19.584510088 CEST53606731.1.1.1192.168.2.3
                      Oct 6, 2023 21:23:20.496704102 CEST53492641.1.1.1192.168.2.3
                      Oct 6, 2023 21:23:20.897891045 CEST5279053192.168.2.31.1.1.1
                      Oct 6, 2023 21:23:20.897994995 CEST6344153192.168.2.31.1.1.1
                      Oct 6, 2023 21:23:21.046583891 CEST53527901.1.1.1192.168.2.3
                      Oct 6, 2023 21:23:21.046658993 CEST53634411.1.1.1192.168.2.3
                      Oct 6, 2023 21:23:23.846729994 CEST6357953192.168.2.31.1.1.1
                      Oct 6, 2023 21:23:23.847313881 CEST5604253192.168.2.31.1.1.1
                      Oct 6, 2023 21:23:23.994040012 CEST53635791.1.1.1192.168.2.3
                      Oct 6, 2023 21:23:23.994349003 CEST53560421.1.1.1192.168.2.3
                      Oct 6, 2023 21:23:37.772605896 CEST53587301.1.1.1192.168.2.3
                      Oct 6, 2023 21:23:56.808465958 CEST53611141.1.1.1192.168.2.3
                      Oct 6, 2023 21:24:17.864080906 CEST138138192.168.2.3192.168.2.255
                      Oct 6, 2023 21:24:19.381766081 CEST53543921.1.1.1192.168.2.3
                      Oct 6, 2023 21:24:19.865436077 CEST53570431.1.1.1192.168.2.3

                      DNS Queries

                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                      Oct 6, 2023 21:23:19.433588028 CEST192.168.2.31.1.1.10xba0bStandard query (0)clients2.google.comA (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:19.434293032 CEST192.168.2.31.1.1.10xdfc8Standard query (0)clients2.google.com65IN (0x0001)false
                      Oct 6, 2023 21:23:19.434911013 CEST192.168.2.31.1.1.10xcbbeStandard query (0)accounts.google.comA (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:19.435169935 CEST192.168.2.31.1.1.10xd13aStandard query (0)accounts.google.com65IN (0x0001)false
                      Oct 6, 2023 21:23:20.897891045 CEST192.168.2.31.1.1.10xb843Standard query (0)live.rezync.comA (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:20.897994995 CEST192.168.2.31.1.1.10xebb1Standard query (0)live.rezync.com65IN (0x0001)false
                      Oct 6, 2023 21:23:23.846729994 CEST192.168.2.31.1.1.10x8940Standard query (0)www.google.comA (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:23.847313881 CEST192.168.2.31.1.1.10xef7dStandard query (0)www.google.com65IN (0x0001)false

                      DNS Answers

                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                      Oct 6, 2023 21:23:19.583621979 CEST1.1.1.1192.168.2.30xba0bNo error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                      Oct 6, 2023 21:23:19.583621979 CEST1.1.1.1192.168.2.30xba0bNo error (0)clients.l.google.com142.250.217.142A (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:19.584510088 CEST1.1.1.1192.168.2.30xcbbeNo error (0)accounts.google.com172.217.14.109A (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:21.046583891 CEST1.1.1.1192.168.2.30xb843No error (0)live.rezync.com13.226.225.23A (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:21.046583891 CEST1.1.1.1192.168.2.30xb843No error (0)live.rezync.com13.226.225.83A (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:21.046583891 CEST1.1.1.1192.168.2.30xb843No error (0)live.rezync.com13.226.225.121A (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:21.046583891 CEST1.1.1.1192.168.2.30xb843No error (0)live.rezync.com13.226.225.102A (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:23.994040012 CEST1.1.1.1192.168.2.30x8940No error (0)www.google.com142.251.40.36A (IP address)IN (0x0001)false
                      Oct 6, 2023 21:23:23.994349003 CEST1.1.1.1192.168.2.30xef7dNo error (0)www.google.com65IN (0x0001)false

                      HTTP Request Dependency Graph

                      • accounts.google.com
                      • clients2.google.com
                      • slscr.update.microsoft.com
                      • login.live.com
                      • www.bing.com
                      • live.rezync.com

                      HTTP Packets

                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      0192.168.2.349712172.217.14.109443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      1192.168.2.349714142.250.217.142443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      2172.217.14.109443192.168.2.349712C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      3142.250.217.142443192.168.2.349714C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      4192.168.2.34972040.127.169.103443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      5192.168.2.34972140.127.169.103443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      6192.168.2.34972720.190.190.196443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      7192.168.2.349728173.222.162.60443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      8192.168.2.34971613.226.225.2380C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData
                      Oct 6, 2023 21:23:21.193842888 CEST81OUTGET / HTTP/1.1
                      Host: live.rezync.com
                      Connection: keep-alive
                      Upgrade-Insecure-Requests: 1
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                      Accept-Encoding: gzip, deflate
                      Accept-Language: en-US,en;q=0.9
                      Oct 6, 2023 21:23:21.430623055 CEST82OUTGET /favicon.ico HTTP/1.1
                      Host: live.rezync.com
                      Connection: keep-alive
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                      Referer: http://live.rezync.com/
                      Accept-Encoding: gzip, deflate
                      Accept-Language: en-US,en;q=0.9
                      Oct 6, 2023 21:24:06.606878996 CEST140OUTData Raw: 00
                      Data Ascii:


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      913.226.225.2380192.168.2.349716C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData
                      Oct 6, 2023 21:23:21.389283895 CEST82INHTTP/1.1 200 OK
                      Content-Type: text/html; charset=utf-8
                      Content-Length: 0
                      Connection: keep-alive
                      Date: Fri, 06 Oct 2023 19:23:21 GMT
                      Vary: Cookie
                      Set-Cookie: sd-session-id=eyJfcGVybWFuZW50Ijp0cnVlfQ.ZSBeqQ.08a-3ftecpk1TbzjZwryfK5giCc; Expires=Wed, 30 Oct 2024 19:23:21 GMT; HttpOnly; Path=/; SameSite=None
                      Accept-Ranges: bytes
                      Server: lighttpd/1.4.69
                      X-Cache: Miss from cloudfront
                      Via: 1.1 81643bff8844b667cc968721a35ef95a.cloudfront.net (CloudFront)
                      X-Amz-Cf-Pop: LAX50-C2
                      X-Amz-Cf-Id: -trtwU8DjJxhQzPNiC6Mv-D-EzFvBkUpcI6ieCjNFar9eh1Ic7fmtQ==
                      Oct 6, 2023 21:23:21.602385998 CEST83INHTTP/1.1 404 Not Found
                      Content-Type: text/html; charset=utf-8
                      Content-Length: 0
                      Connection: keep-alive
                      Date: Fri, 06 Oct 2023 19:23:21 GMT
                      Vary: Cookie
                      Set-Cookie: sd-session-id=eyJfcGVybWFuZW50Ijp0cnVlLCJzZXNzaW9uX2lkIjoiYzVjMTkyNGEtNTdiMi00ZDljLThiZmEtZDk2NzMwOWM3MGMwOjE2OTY2MjAyMDEuNTA2MzM5NiJ9.ZSBeqQ.Ul7mdbsX4kUJNM5NPTuosmUrNPk; Expires=Wed, 30 Oct 2024 19:23:21 GMT; HttpOnly; Path=/; SameSite=None
                      Server: lighttpd/1.4.69
                      X-Cache: Error from cloudfront
                      Via: 1.1 81643bff8844b667cc968721a35ef95a.cloudfront.net (CloudFront)
                      X-Amz-Cf-Pop: LAX50-C2
                      X-Amz-Cf-Id: G3Y1b_E3IrDf3OazQ-QHvfZf0yiXZu1F5bZxx0MfmnkuKWfzNHb_SA==


                      HTTPS Connections

                      TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                      Oct 6, 2023 21:23:37.571758986 CEST104.98.116.138443192.168.2.349709CN=r.bing.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft RSA TLS CA 01, O=Microsoft Corporation, C=USCN=Microsoft RSA TLS CA 01, O=Microsoft Corporation, C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IETue Nov 15 21:16:38 CET 2022 Wed Jul 22 01:00:00 CEST 2020Wed Nov 15 21:16:38 CET 2023 Tue Oct 08 09:00:00 CEST 2024771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,028a2c9bd18a11de089ef85a160da29e4
                      CN=Microsoft RSA TLS CA 01, O=Microsoft Corporation, C=USCN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IEWed Jul 22 01:00:00 CEST 2020Tue Oct 08 09:00:00 CEST 2024

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      0192.168.2.349712172.217.14.109443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData
                      2023-10-06 19:23:19 UTC0OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
                      Host: accounts.google.com
                      Connection: keep-alive
                      Content-Length: 1
                      Origin: https://www.google.com
                      Content-Type: application/x-www-form-urlencoded
                      Sec-Fetch-Site: none
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9
                      Cookie: 1P_JAR=2023-10-05-14; NID=511=OL3WgnA24QwPfMpspsItpZ2c_g7YXAAMilzUqiZdxG8z8Ka1c00AfG24ctRwvhPMrHVqO7oNbKVSwiOA0g2EzuMjPJIvQtOS7zZy99O8OkMoKSMKDFs-L1TjxHc_KVN5KBVb4BTfsPAzvlWsn_iACmkP3ulD50w_qpZ6JVqkr7w
                      2023-10-06 19:23:19 UTC0OUTData Raw: 20
                      Data Ascii:


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      1192.168.2.349714142.250.217.142443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData
                      2023-10-06 19:23:19 UTC0OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
                      Host: clients2.google.com
                      Connection: keep-alive
                      X-Goog-Update-Interactivity: fg
                      X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda
                      X-Goog-Update-Updater: chromecrx-117.0.5938.134
                      Sec-Fetch-Site: none
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                      Accept-Encoding: gzip, deflate, br
                      Accept-Language: en-US,en;q=0.9


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      2172.217.14.109443192.168.2.349712C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData
                      2023-10-06 19:23:20 UTC1INHTTP/1.1 200 OK
                      Content-Type: application/json; charset=utf-8
                      Access-Control-Allow-Origin: https://www.google.com
                      Access-Control-Allow-Credentials: true
                      X-Content-Type-Options: nosniff
                      Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                      Pragma: no-cache
                      Expires: Mon, 01 Jan 1990 00:00:00 GMT
                      Date: Fri, 06 Oct 2023 19:23:20 GMT
                      Strict-Transport-Security: max-age=31536000; includeSubDomains
                      Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                      Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
                      Content-Security-Policy: script-src 'report-sample' 'nonce-URYZFK-0cuirsyU4PyeGiA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
                      Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist
                      Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
                      Cross-Origin-Opener-Policy: same-origin
                      Server: ESF
                      X-XSS-Protection: 0
                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                      Accept-Ranges: none
                      Vary: Accept-Encoding
                      Connection: close
                      Transfer-Encoding: chunked
                      2023-10-06 19:23:20 UTC3INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
                      Data Ascii: 11["gaia.l.a.r",[]]
                      2023-10-06 19:23:20 UTC3INData Raw: 30 0d 0a 0d 0a
                      Data Ascii: 0


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      3142.250.217.142443192.168.2.349714C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData
                      2023-10-06 19:23:20 UTC3INHTTP/1.1 200 OK
                      Content-Security-Policy: script-src 'report-sample' 'nonce-qzgUpRF0SjbGSntyPL4k5A' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                      Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                      Pragma: no-cache
                      Expires: Mon, 01 Jan 1990 00:00:00 GMT
                      Date: Fri, 06 Oct 2023 19:23:20 GMT
                      Content-Type: text/xml; charset=UTF-8
                      X-Daynum: 6122
                      X-Daystart: 44600
                      X-Content-Type-Options: nosniff
                      X-Frame-Options: SAMEORIGIN
                      X-XSS-Protection: 1; mode=block
                      Server: GSE
                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                      Accept-Ranges: none
                      Vary: Accept-Encoding
                      Connection: close
                      Transfer-Encoding: chunked
                      2023-10-06 19:23:20 UTC3INData Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 32 32 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 34 36 30 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22
                      Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6122" elapsed_seconds="44600"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
                      2023-10-06 19:23:20 UTC4INData Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a
                      Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
                      2023-10-06 19:23:20 UTC4INData Raw: 30 0d 0a 0d 0a
                      Data Ascii: 0


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      4192.168.2.34972040.127.169.103443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData
                      2023-10-06 19:23:35 UTC4OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.3448/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.3031&MK=v3hcvP3pTd4SwmM&MD=HRKHuT92 HTTP/1.1
                      Connection: Keep-Alive
                      Accept: */*
                      User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                      Host: slscr.update.microsoft.com
                      2023-10-06 19:23:36 UTC4INHTTP/1.1 200 OK
                      Cache-Control: no-cache
                      Pragma: no-cache
                      Content-Type: application/octet-stream
                      Expires: -1
                      Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                      ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                      MS-CorrelationId: 3e88ba92-1d31-4077-bda4-4ec9612220c0
                      MS-RequestId: 4b0da04a-7be7-4023-8ba3-f8bdcf25e8e1
                      MS-CV: Tn1TMh0/lk65VlhP.0
                      X-Microsoft-SLSClientCache: 2880
                      Content-Disposition: attachment; filename=environment.cab
                      X-Content-Type-Options: nosniff
                      Date: Fri, 06 Oct 2023 19:23:35 GMT
                      Connection: close
                      Content-Length: 24490
                      2023-10-06 19:23:36 UTC5INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                      Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                      2023-10-06 19:23:36 UTC20INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                      Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      5192.168.2.34972140.127.169.103443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData
                      2023-10-06 19:24:13 UTC29OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.3448/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.3031&MK=v3hcvP3pTd4SwmM&MD=HRKHuT92 HTTP/1.1
                      Connection: Keep-Alive
                      Accept: */*
                      User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                      Host: slscr.update.microsoft.com
                      2023-10-06 19:24:14 UTC29INHTTP/1.1 200 OK
                      Cache-Control: no-cache
                      Pragma: no-cache
                      Content-Type: application/octet-stream
                      Expires: -1
                      Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                      ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"
                      MS-CorrelationId: a99caa43-b951-4184-b1a2-4f1291a5f33e
                      MS-RequestId: 47513f82-ea01-4016-a099-d904fb6e58fe
                      MS-CV: GHUyj+bz/ECeEGQO.0
                      X-Microsoft-SLSClientCache: 2160
                      Content-Disposition: attachment; filename=environment.cab
                      X-Content-Type-Options: nosniff
                      Date: Fri, 06 Oct 2023 19:24:14 GMT
                      Connection: close
                      Content-Length: 25457
                      2023-10-06 19:24:14 UTC30INData Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92
                      Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
                      2023-10-06 19:24:14 UTC45INData Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a
                      Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      6192.168.2.34972720.190.190.196443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData
                      2023-10-06 19:24:25 UTC54OUTPOST /RST2.srf HTTP/1.0
                      Connection: Keep-Alive
                      Content-Type: application/soap+xml
                      Accept: */*
                      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})
                      Content-Length: 4784
                      Host: login.live.com
                      2023-10-06 19:24:25 UTC55OUTData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31
                      Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
                      2023-10-06 19:24:25 UTC60INHTTP/1.1 200 OK
                      Cache-Control: no-store, no-cache
                      Pragma: no-cache
                      Content-Type: application/soap+xml; charset=utf-8
                      Expires: Fri, 06 Oct 2023 19:23:25 GMT
                      P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
                      Referrer-Policy: strict-origin-when-cross-origin
                      x-ms-route-info: C107_BAY
                      x-ms-request-id: bd7fcec7-afa3-4aea-bcf4-9bcae4418096
                      PPServer: PPV: 30 H: BY1PPFCC1098292 V: 0
                      X-Content-Type-Options: nosniff
                      Strict-Transport-Security: max-age=31536000
                      X-XSS-Protection: 1; mode=block
                      Date: Fri, 06 Oct 2023 19:24:25 GMT
                      Connection: close
                      Content-Length: 11153
                      2023-10-06 19:24:25 UTC60INData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30
                      Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200


                      Session IDSource IPSource PortDestination IPDestination PortProcess
                      7192.168.2.349728173.222.162.60443C:\Program Files\Google\Chrome\Application\chrome.exe
                      TimestampkBytes transferredDirectionData
                      2023-10-06 19:24:27 UTC71OUTGET /client/config?cc=CH&setlang=en-CH HTTP/1.1
                      X-Search-CortanaAvailableCapabilities: None
                      X-Search-SafeSearch: Moderate
                      Accept-Encoding: gzip, deflate
                      X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}
                      X-UserAgeClass: Unknown
                      X-BM-Market: CH
                      X-BM-DateFormat: dd/MM/yyyy
                      X-Device-OSSKU: 48
                      X-BM-DTZ: 120
                      X-DeviceID: 01000A410900F086
                      X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E
                      X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time
                      X-Device-Manufacturer: hobtxi, Inc.
                      X-BM-Theme: 000000;0078d7
                      X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAUzDFHKHhs0DpMVB1drr0HZS1A2u0ZmwCj9jT%2BEygAsown1HcVeioYFY2kfMMGPMqMbQ8D1VaNc7qU8imqRvBiPFYS7g%2BpeET7imHJiJO0MWfST6Ize0WidvhfGA5SA04KdShhCxvLU8t1H%2BEYUF5pc/3C2XB4T1HVpVWEizupFvDjWDkhF0T%2Bx412WFPyndSRQf2/O5CM8%2BVUmjl%2BGyxrnv%2B6n8ujSLzxLt6M0fKsQvD5lqtYiuU3%2B7uUBWVFALZ1irhpmof3VDLU3r8il21Nf1WwC5bMsVqZcYGTSKkeuEnV4D7EMz93v67h0fLc0ntL6y%2B8mrpvPcFnI/0fHCPyUDZgAACK2kSqzLi2nSqAFq8ZInQYFIrs4jOvTVgEAxEvnWiOisAqMpdc3bOpNTTODJBMXcwOPpTabNJgKOcA%2B4Hnxy1Kcpb13q2IzAMwXTsBYQfheyyb7ZB0gjCbESrGT2XzPfdssdzhhlQ5BDN8SWoUsuy%2BYRQ6AwRGXvm%2BDW8ajh77SPC5ZTpYRgY5AUbLK7oAznqF%2B7ArngbfT6IjpJsPBMq1xRZEK5xk2x46MHNgJW5Gk0yCowwc581z5HG0oRv/5TlziYcxYEMxvp22Dd2spAbLklHRZoGtzgFFRawTMMR61ciEnmnrDREZlTal6iWqU3a41fFw/xpPdj4709VVCsynWJ/dgQcvwKwJl/Ni1A2Hlt5RtbewI2EMxQFwKsd1epssdRb/UDeTvKZLidpacDe/Qe2hjBDZyMdOGv%2BkKKG2HZ4IYQ4xiUHmslHsPmtu5yYfNlU%2BIypqJ3holefdUH%2BV/Cq8xhR52cxHGXNqmSvQjAMKUXG%2BuVdawY4jEAPnnglKCGD/XO1W5kmyeThp7tW6R4d/MXGJCwGXypOsLgC2CrXUfmJNMeLZ7QUouekL4VLM/l2wE%3D%26p%3D
                      X-Agent-DeviceId: 01000A410900F086
                      X-Device-Product: hobtxi20,1
                      X-BM-CBT: 1696620262
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.10.19041; 10.0.0.0.19045.3448) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045
                      X-Device-isOptin: false
                      Accept-language: en-GB, en, en-US
                      X-Device-Touch: false
                      X-Device-ClientSession: 241C37D58E874170803545E59DD3A66B
                      X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI
                      Host: www.bing.com
                      Connection: Keep-Alive
                      Cookie: SRCHUID=V=2&GUID=1DFC5692B3C14AD1B3C2CC78B83DC83F&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231005; SRCHHPGUSR=SRCHLANG=en&IPMH=757efe17&IPMID=1696515430661&LUT=1696515430501&HV=1696515336; CortanaAppUID=693D16295E37B41DFA9B23B1924E43EE; MUID=CC2DC5E356C849EFB6E563149520FA2C; MUIDB=CC2DC5E356C849EFB6E563149520FA2C
                      2023-10-06 19:24:28 UTC74INHTTP/1.1 200 OK
                      Content-Length: 2215
                      Content-Type: application/json; charset=utf-8
                      Cache-Control: private
                      X-EventID: 65205eebb91745a5ade71788c2388695
                      X-AS-SetSessionMarket: de-ch
                      UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
                      X-XSS-Protection: 0
                      P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
                      Date: Fri, 06 Oct 2023 19:24:28 GMT
                      Connection: close
                      Set-Cookie: _EDGE_S=SID=364F6ABF256D693C0078791D2444680E&mkt=de-ch; domain=.bing.com; path=/; HttpOnly
                      Set-Cookie: ANON=A=D242BFFEFF1C886859531746FFFFFFFF; domain=.bing.com; expires=Wed, 30-Oct-2024 19:24:27 GMT; path=/; secure; SameSite=None
                      Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None
                      Set-Cookie: _SS=SID=364F6ABF256D693C0078791D2444680E; domain=.bing.com; path=/; secure; SameSite=None
                      Alt-Svc: h3=":443"; ma=93600
                      X-CDN-TraceID: 0.3ca6dc17.1696620267.1e7220ae
                      2023-10-06 19:24:28 UTC75INData Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65
                      Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value


                      Statistics

                      CPU Usage

                      020406080s020406080100

                      Click to jump to process

                      Memory Usage

                      020406080s0.0050100MB

                      Click to jump to process

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:6
                      Start time:21:23:15
                      Start date:06/10/2023
                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                      Wow64 process (32bit):false
                      Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
                      Imagebase:0x7ff7c89f0000
                      File size:3'242'272 bytes
                      MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:low
                      Has exited:false
                      Show Windows behavior

                      File Activities

                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      Show Windows behavior

                      Process Activities

                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      Show Windows behavior

                      Memory Activities

                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      Show Windows behavior

                      Process Token Activities


                      General

                      Target ID:7
                      Start time:21:23:17
                      Start date:06/10/2023
                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2044,i,5139326226676354790,2101690900924711023,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                      Imagebase:0x7ff7c89f0000
                      File size:3'242'272 bytes
                      MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:low
                      Has exited:false
                      Show Windows behavior

                      File Activities

                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      Show Windows behavior

                      Memory Activities


                      General

                      Target ID:8
                      Start time:21:23:19
                      Start date:06/10/2023
                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                      Wow64 process (32bit):false
                      Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "http://live.rezync.com
                      Imagebase:0x7ff7c89f0000
                      File size:3'242'272 bytes
                      MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:low
                      Has exited:true
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                      Disassembly

                      ⊘No disassembly