Edit tour

Windows Analysis Report
https://www.ojrq.net/

Overview

General Information

Sample URL:	https://www.ojrq.net/
Analysis ID:	1352946
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Creates files inside the system directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.ojrq.net/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2008,i,8897769019717590478,4788855190301408649,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8

Source: unknown	HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49729 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_6524_1840552037

Jump to behavior

Source: classification engine

Classification label: clean1.win@14/6@12/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.ojrq.net/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2008,i,8897769019717590478,4788855190301408649,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2008,i,8897769019717590478,4788855190301408649,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://www.ojrq.net/	0%	Virustotal		Browse
https://www.ojrq.net/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
www.ojrq.net	34.95.127.121	true	false	high
accounts.google.com	142.251.167.84	true	false	high
www.google.com	142.250.31.104	true	false	high
clients.l.google.com	142.251.16.101	true	false	high
clients1.google.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false	high
https://www.ojrq.net/	false	high
https://www.ojrq.net/	false	high
https://www.ojrq.net/favicon.ico	false	high
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000761FC55BDC	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.95.127.121	www.ojrq.net	United States	15169	GOOGLEUS	false
142.251.167.84	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.31.104	www.google.com	United States	15169	GOOGLEUS	false
172.253.122.138	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.16.101	clients.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1352946
Start date and time:	2023-12-04 08:58:21 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.ojrq.net/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@14/6@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.253.122.94, 34.104.35.123, 192.229.211.108, 142.251.16.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 4 06:58:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.99343713545573
Encrypted:	false
SSDEEP:	48:8zd0T4sHHPWidAKZdA1FehwiZUklqehny+3:8iPMUy
MD5:	16420AC2BB1E9CB4942BC1E0B6081A4B
SHA1:	7EF3D389544BE60619348EC87A8B8BBF18E2A508
SHA-256:	62FB7ED576911C7BCE41194BB53B92AAE73622301E8A62D8E0C860FB98ED607B
SHA-512:	7643E509AAD1132A0432FF11E9F12758C6360D70EAD22EBD7A72A0679F9137A2E1642E56993B64D04D236ADC4BE1F86A26F7FFD6F1ED444D702FE00DAC1BF9B8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....z.5..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WQ?....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WY?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WY?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WY?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.WZ?...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 4 06:58:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.007383360046751
Encrypted:	false
SSDEEP:	48:8Hd0T4sHHPWidAKZdA1seh/iZUkAQkqehEy+2:8OPi9QVy
MD5:	318797B7801D231CF52019409EF7E4ED
SHA1:	273A77DEFD7F7CDFD10E1E5BA796AB1DB53FA2BC
SHA-256:	37DCEF88AC26B956060604DD12B18A332DE35D5B285639275C446C4F90CDFE96
SHA-512:	CE22C41C6F64D1294896245BD733497D8106069BBCB81F715A39E7DA1156F8C3E2B139630EAEF242316CB176419C7E2A93E89EC4CF7100D1C0350C287EA2C459
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....n`)..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WQ?....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WY?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WY?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WY?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.WZ?...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.01319157381348
Encrypted:	false
SSDEEP:	48:8Jd0T4sAHPWidAKZdA14meh7sFiZUkmgqeh7sqy+BX:84PDnwy
MD5:	8E5023A92454847ABC14EFDCF47A5E54
SHA1:	05620EECAEEFCC895F06E30AD02D2B8C7933702D
SHA-256:	648BE4AE49F529124EAB63B23A3486590098A2F47CC2B4ACF7723E2E91DE7296
SHA-512:	14A7317DCFD9783E6F0F2570FD625413DA7C7E5978BD62F0616C28FC900645E9658F0D5A33444BF70376B0314C67467E16E050477851CCDF3D4ACE22B0D343DC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WQ?....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WY?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WY?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WY?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 4 06:58:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.006704701982066
Encrypted:	false
SSDEEP:	48:8Ud0T4sHHPWidAKZdA1TehDiZUkwqehIy+R:8bP5iy
MD5:	310F53D3C646F0808E717758EBA0702D
SHA1:	A02D4C1F4AAC057D2AD08C800E00C675E407B24E
SHA-256:	288F3417565DAFCA1C2D62930E7B83E62E121D9A628F19AED8CEFCD08732DF55
SHA-512:	12E64A0CD48E373A2F6BAC384C4CEEF888F869825A8D228B9D362EB19B28B20E9AAE220B9C8998509A0264F3C6A8D2194B6B5C6B2BF588D5C4EFCEE86E650042
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......$..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WQ?....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WY?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WY?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WY?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.WZ?...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 4 06:58:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.996144197180148
Encrypted:	false
SSDEEP:	48:8Pd0T4sHHPWidAKZdA1dehBiZUk1W1qehGy+C:8mPp9my
MD5:	7FED7C4509842BB44DD4CB7A40FA7CD8
SHA1:	BCA78F28E7EF6B97FC4E538AD5728EBB57DD1B1B
SHA-256:	519DC389F5DB085DDFBC49D069401CFE743D3040D132DE2888351886F54C8825
SHA-512:	56B7841C1E84F8EC3242098DF7B0A1286BE4EBDD902276602AD43634FCA79B26930D36D7CF8E95F30962EA281FE56D3BA51F70EA9999678B2D5D9DC9757D8EF7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......0..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WQ?....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WY?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WY?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WY?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.WZ?...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 4 06:58:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.005535221486846
Encrypted:	false
SSDEEP:	48:8kd0T4sHHPWidAKZdA1duTeehOuTbbiZUk5OjqehOuTbwy+yT+:8LPRTfTbxWOvTbwy7T
MD5:	8A7D0F4287F2618ED6552AFE96B6269D
SHA1:	BA923A7A6ABBA7649782456DC9336233F7A3820E
SHA-256:	2C37DF7B65136891652D5501CB606162108F2C5481A0CA00D4144D451264B9F2
SHA-512:	60646DAABF2F5CC18E9E429EAF620F18A03E4982D17DCEABE5A6D1A5EE337DF45B39A6675723AE5228B9E76B2D92C0A772EE080D566AC707980A216C865954B6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WQ?....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WY?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WY?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WY?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.WZ?...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[..v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Total Packets: 149
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2023 08:58:47.472630978 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:58:47.472723007 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:58:49.861629963 CET	49719	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:49.861669064 CET	443	49719	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:49.861732006 CET	49719	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:49.862991095 CET	49719	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:49.863007069 CET	443	49719	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:49.931045055 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:49.931091070 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:49.931158066 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:49.931468010 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:49.931488037 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:49.932353973 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:49.932384014 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:49.932434082 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:49.932717085 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:49.932730913 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:50.129443884 CET	443	49719	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.132703066 CET	49719	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.132709980 CET	443	49719	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.135178089 CET	443	49719	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.135271072 CET	49719	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.138683081 CET	49719	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.138782024 CET	443	49719	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.139547110 CET	49719	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.139554024 CET	443	49719	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.169929981 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:50.170222998 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:50.170267105 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:50.170648098 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:50.170722961 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:50.171267033 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:50.171325922 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:50.172518015 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:50.173299074 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:50.173317909 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:50.173484087 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:50.173564911 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:50.173650980 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:50.173662901 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:50.174808025 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:50.174887896 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:50.175775051 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:50.175869942 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:50.176851034 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:50.176860094 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:50.194950104 CET	49719	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.224113941 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:50.224117041 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:50.312239885 CET	443	49719	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.313788891 CET	443	49719	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.313869953 CET	49719	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.315238953 CET	49719	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.315258026 CET	443	49719	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.336040020 CET	49674	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:58:50.336080074 CET	49673	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:58:50.381376982 CET	49723	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.381421089 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.381541014 CET	49723	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.381916046 CET	49723	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.381927013 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.385538101 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:50.385673046 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:50.385734081 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:50.386466026 CET	49721	443	192.168.2.16	142.251.16.101
Dec 4, 2023 08:58:50.386498928 CET	443	49721	142.251.16.101	192.168.2.16
Dec 4, 2023 08:58:50.396476984 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:50.396590948 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:50.396620035 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:50.396814108 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:50.396867990 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:50.397303104 CET	49722	443	192.168.2.16	142.251.167.84
Dec 4, 2023 08:58:50.397322893 CET	443	49722	142.251.167.84	192.168.2.16
Dec 4, 2023 08:58:50.597681046 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.598012924 CET	49723	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.598026991 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.598706007 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.598994017 CET	49723	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.599080086 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.599123955 CET	49723	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.645251989 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.654093027 CET	49723	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.718096018 CET	49672	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:58:50.802823067 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.802958012 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.803018093 CET	49723	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.803026915 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.803236961 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.803287029 CET	49723	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.804362059 CET	49723	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.804374933 CET	443	49723	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.939346075 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.939418077 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:50.939515114 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.939809084 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:50.939831972 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.156728983 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.157044888 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:51.157077074 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.158576012 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.158655882 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:51.158904076 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:51.158984900 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.159029961 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:51.205260038 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.214063883 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:51.214128971 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.261003971 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:51.360887051 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.361030102 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.361104012 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:51.361125946 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.361390114 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:51.361582994 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:51.362111092 CET	49725	443	192.168.2.16	34.95.127.121
Dec 4, 2023 08:58:51.362128019 CET	443	49725	34.95.127.121	192.168.2.16
Dec 4, 2023 08:58:54.440407991 CET	49726	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:58:54.440438986 CET	443	49726	142.250.31.104	192.168.2.16
Dec 4, 2023 08:58:54.440521002 CET	49726	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:58:54.440890074 CET	49726	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:58:54.440902948 CET	443	49726	142.250.31.104	192.168.2.16
Dec 4, 2023 08:58:54.659605026 CET	443	49726	142.250.31.104	192.168.2.16
Dec 4, 2023 08:58:54.659921885 CET	49726	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:58:54.659959078 CET	443	49726	142.250.31.104	192.168.2.16
Dec 4, 2023 08:58:54.662192106 CET	443	49726	142.250.31.104	192.168.2.16
Dec 4, 2023 08:58:54.662384987 CET	49726	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:58:54.663429976 CET	49726	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:58:54.663532019 CET	443	49726	142.250.31.104	192.168.2.16
Dec 4, 2023 08:58:54.707160950 CET	49726	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:58:54.707179070 CET	443	49726	142.250.31.104	192.168.2.16
Dec 4, 2023 08:58:54.755110979 CET	49726	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:59:01.192650080 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:01.192698002 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:01.192779064 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:01.198411942 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:01.198441982 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:01.369517088 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:01.529107094 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:01.529943943 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:01.529985905 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:01.530040979 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:01.530041933 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:01.530075073 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:01.530078888 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:01.530097008 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:01.530131102 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:01.753360033 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:01.753467083 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:01.755275011 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:01.755302906 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:01.755732059 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:01.809045076 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:01.842833042 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:01.885263920 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:01.887267113 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:02.046808958 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:02.047141075 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:02.047226906 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:02.047991991 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:02.048459053 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:02.048758984 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:02.048804998 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:02.207456112 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:02.207540035 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:02.207556009 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:02.207670927 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:02.207672119 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:02.208061934 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:02.211997986 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:02.253305912 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:02.253340960 CET	443	49703	23.1.237.25	192.168.2.16
Dec 4, 2023 08:59:02.253371000 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:02.253408909 CET	49703	443	192.168.2.16	23.1.237.25
Dec 4, 2023 08:59:02.263413906 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.263470888 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.263489962 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.263508081 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.263546944 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.263565063 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.263652086 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:02.263652086 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:02.263652086 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:02.263652086 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:02.263725042 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.263765097 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.263792038 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:02.263799906 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.263822079 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.263854980 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:02.263879061 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:02.263894081 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.264007092 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.264061928 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:02.280263901 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:02.280303001 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:02.280328989 CET	49727	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:02.280344963 CET	443	49727	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:04.653871059 CET	443	49726	142.250.31.104	192.168.2.16
Dec 4, 2023 08:59:04.653947115 CET	443	49726	142.250.31.104	192.168.2.16
Dec 4, 2023 08:59:04.654011011 CET	49726	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:59:06.069747925 CET	49726	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:59:06.069797993 CET	443	49726	142.250.31.104	192.168.2.16
Dec 4, 2023 08:59:37.118256092 CET	49713	80	192.168.2.16	72.21.81.240
Dec 4, 2023 08:59:37.216332912 CET	80	49713	72.21.81.240	192.168.2.16
Dec 4, 2023 08:59:37.216442108 CET	49713	80	192.168.2.16	72.21.81.240
Dec 4, 2023 08:59:38.687227964 CET	49729	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:38.687309027 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:38.687479973 CET	49729	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:38.688855886 CET	49729	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:38.688891888 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.219835043 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.220185041 CET	49729	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:39.227225065 CET	49729	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:39.227256060 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.227714062 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.229486942 CET	49729	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:39.277260065 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.724406004 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.724436998 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.724459887 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.724572897 CET	49729	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:39.724632025 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.724663019 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.724766970 CET	49729	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:39.729548931 CET	49729	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:39.729582071 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:39.729609013 CET	49729	443	192.168.2.16	40.127.169.103
Dec 4, 2023 08:59:39.729624033 CET	443	49729	40.127.169.103	192.168.2.16
Dec 4, 2023 08:59:54.368629932 CET	49731	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:59:54.368670940 CET	443	49731	142.250.31.104	192.168.2.16
Dec 4, 2023 08:59:54.368946075 CET	49731	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:59:54.369931936 CET	49731	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:59:54.369946003 CET	443	49731	142.250.31.104	192.168.2.16
Dec 4, 2023 08:59:54.574460030 CET	443	49731	142.250.31.104	192.168.2.16
Dec 4, 2023 08:59:54.574820042 CET	49731	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:59:54.574837923 CET	443	49731	142.250.31.104	192.168.2.16
Dec 4, 2023 08:59:54.575295925 CET	443	49731	142.250.31.104	192.168.2.16
Dec 4, 2023 08:59:54.575762987 CET	49731	443	192.168.2.16	142.250.31.104
Dec 4, 2023 08:59:54.575844049 CET	443	49731	142.250.31.104	192.168.2.16
Dec 4, 2023 08:59:54.622029066 CET	49731	443	192.168.2.16	142.250.31.104
Dec 4, 2023 09:00:04.585612059 CET	443	49731	142.250.31.104	192.168.2.16
Dec 4, 2023 09:00:04.585684061 CET	443	49731	142.250.31.104	192.168.2.16
Dec 4, 2023 09:00:04.585742950 CET	49731	443	192.168.2.16	142.250.31.104
Dec 4, 2023 09:00:06.078360081 CET	49731	443	192.168.2.16	142.250.31.104
Dec 4, 2023 09:00:06.078382015 CET	443	49731	142.250.31.104	192.168.2.16
Dec 4, 2023 09:00:19.445983887 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.446067095 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:19.446156025 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.446547031 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.446582079 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:19.652393103 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:19.652733088 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.652759075 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:19.653306961 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:19.653402090 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.654329062 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:19.654392004 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.655467987 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.655549049 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:19.655669928 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.655683994 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:19.708059072 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.944782019 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:19.946028948 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:19.946192980 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.946378946 CET	49733	443	192.168.2.16	172.253.122.138
Dec 4, 2023 09:00:19.946408987 CET	443	49733	172.253.122.138	192.168.2.16
Dec 4, 2023 09:00:29.109397888 CET	49715	443	192.168.2.16	23.221.242.90
Dec 4, 2023 09:00:29.208214998 CET	443	49715	23.221.242.90	192.168.2.16
Dec 4, 2023 09:00:29.208254099 CET	443	49715	23.221.242.90	192.168.2.16
Dec 4, 2023 09:00:29.208369017 CET	49715	443	192.168.2.16	23.221.242.90
Dec 4, 2023 09:00:29.208448887 CET	49715	443	192.168.2.16	23.221.242.90
Dec 4, 2023 09:00:29.684474945 CET	49717	443	192.168.2.16	23.221.242.90
Dec 4, 2023 09:00:29.783098936 CET	443	49717	23.221.242.90	192.168.2.16
Dec 4, 2023 09:00:29.783117056 CET	443	49717	23.221.242.90	192.168.2.16
Dec 4, 2023 09:00:29.783169985 CET	49717	443	192.168.2.16	23.221.242.90
Dec 4, 2023 09:00:29.783210039 CET	49717	443	192.168.2.16	23.221.242.90

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2023 08:58:49.672606945 CET	63701	53	192.168.2.16	1.1.1.1
Dec 4, 2023 08:58:49.672725916 CET	62839	53	192.168.2.16	1.1.1.1
Dec 4, 2023 08:58:49.799314022 CET	49706	53	192.168.2.16	1.1.1.1
Dec 4, 2023 08:58:49.800628901 CET	64832	53	192.168.2.16	1.1.1.1
Dec 4, 2023 08:58:49.801189899 CET	54396	53	192.168.2.16	1.1.1.1
Dec 4, 2023 08:58:49.801887989 CET	53	60041	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:49.802472115 CET	58341	53	192.168.2.16	1.1.1.1
Dec 4, 2023 08:58:49.803680897 CET	53	63701	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:49.804807901 CET	53	62839	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:49.929399014 CET	53	49706	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:49.930562019 CET	53	64832	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:49.931287050 CET	53	58341	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:49.931854963 CET	53	54396	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:50.571470976 CET	53	52449	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:50.807645082 CET	51146	53	192.168.2.16	1.1.1.1
Dec 4, 2023 08:58:50.807877064 CET	60586	53	192.168.2.16	1.1.1.1
Dec 4, 2023 08:58:50.937079906 CET	53	51146	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:50.938927889 CET	53	60586	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:54.309078932 CET	57749	53	192.168.2.16	1.1.1.1
Dec 4, 2023 08:58:54.309154987 CET	53139	53	192.168.2.16	1.1.1.1
Dec 4, 2023 08:58:54.439102888 CET	53	57749	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:54.439140081 CET	53	53139	1.1.1.1	192.168.2.16
Dec 4, 2023 08:58:58.334877968 CET	138	138	192.168.2.16	192.168.2.255
Dec 4, 2023 08:59:07.652563095 CET	53	55988	1.1.1.1	192.168.2.16
Dec 4, 2023 08:59:26.511598110 CET	53	58443	1.1.1.1	192.168.2.16
Dec 4, 2023 08:59:48.829946995 CET	53	50768	1.1.1.1	192.168.2.16
Dec 4, 2023 08:59:49.660464048 CET	53	57091	1.1.1.1	192.168.2.16
Dec 4, 2023 09:00:17.298707008 CET	53	52290	1.1.1.1	192.168.2.16
Dec 4, 2023 09:00:19.310580015 CET	62668	53	192.168.2.16	1.1.1.1
Dec 4, 2023 09:00:19.311005116 CET	64342	53	192.168.2.16	1.1.1.1
Dec 4, 2023 09:00:19.439583063 CET	53	62668	1.1.1.1	192.168.2.16
Dec 4, 2023 09:00:19.445502043 CET	53	64342	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 4, 2023 08:58:49.672606945 CET	192.168.2.16	1.1.1.1	0x954d	Standard query (0)	www.ojrq.net	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:49.672725916 CET	192.168.2.16	1.1.1.1	0x41af	Standard query (0)	www.ojrq.net	65	IN (0x0001)	false
Dec 4, 2023 08:58:49.799314022 CET	192.168.2.16	1.1.1.1	0x911c	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:49.800628901 CET	192.168.2.16	1.1.1.1	0x93ad	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Dec 4, 2023 08:58:49.801189899 CET	192.168.2.16	1.1.1.1	0x442d	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:49.802472115 CET	192.168.2.16	1.1.1.1	0x66c0	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Dec 4, 2023 08:58:50.807645082 CET	192.168.2.16	1.1.1.1	0x7f0b	Standard query (0)	www.ojrq.net	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:50.807877064 CET	192.168.2.16	1.1.1.1	0x2c66	Standard query (0)	www.ojrq.net	65	IN (0x0001)	false
Dec 4, 2023 08:58:54.309078932 CET	192.168.2.16	1.1.1.1	0x76ad	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:54.309154987 CET	192.168.2.16	1.1.1.1	0xc24b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 4, 2023 09:00:19.310580015 CET	192.168.2.16	1.1.1.1	0xd926	Standard query (0)	clients1.google.com	A (IP address)	IN (0x0001)	false
Dec 4, 2023 09:00:19.311005116 CET	192.168.2.16	1.1.1.1	0x372d	Standard query (0)	clients1.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 4, 2023 08:58:49.803680897 CET	1.1.1.1	192.168.2.16	0x954d	No error (0)	www.ojrq.net		34.95.127.121	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:49.929399014 CET	1.1.1.1	192.168.2.16	0x911c	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2023 08:58:49.929399014 CET	1.1.1.1	192.168.2.16	0x911c	No error (0)	clients.l.google.com		142.251.16.101	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:49.929399014 CET	1.1.1.1	192.168.2.16	0x911c	No error (0)	clients.l.google.com		142.251.16.138	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:49.929399014 CET	1.1.1.1	192.168.2.16	0x911c	No error (0)	clients.l.google.com		142.251.16.113	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:49.929399014 CET	1.1.1.1	192.168.2.16	0x911c	No error (0)	clients.l.google.com		142.251.16.139	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:49.929399014 CET	1.1.1.1	192.168.2.16	0x911c	No error (0)	clients.l.google.com		142.251.16.102	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:49.929399014 CET	1.1.1.1	192.168.2.16	0x911c	No error (0)	clients.l.google.com		142.251.16.100	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:49.930562019 CET	1.1.1.1	192.168.2.16	0x93ad	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2023 08:58:49.931854963 CET	1.1.1.1	192.168.2.16	0x442d	No error (0)	accounts.google.com		142.251.167.84	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:50.937079906 CET	1.1.1.1	192.168.2.16	0x7f0b	No error (0)	www.ojrq.net		34.95.127.121	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:54.439102888 CET	1.1.1.1	192.168.2.16	0x76ad	No error (0)	www.google.com		142.250.31.104	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:54.439102888 CET	1.1.1.1	192.168.2.16	0x76ad	No error (0)	www.google.com		142.250.31.103	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:54.439102888 CET	1.1.1.1	192.168.2.16	0x76ad	No error (0)	www.google.com		142.250.31.147	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:54.439102888 CET	1.1.1.1	192.168.2.16	0x76ad	No error (0)	www.google.com		142.250.31.106	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:54.439102888 CET	1.1.1.1	192.168.2.16	0x76ad	No error (0)	www.google.com		142.250.31.99	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:54.439102888 CET	1.1.1.1	192.168.2.16	0x76ad	No error (0)	www.google.com		142.250.31.105	A (IP address)	IN (0x0001)	false
Dec 4, 2023 08:58:54.439140081 CET	1.1.1.1	192.168.2.16	0xc24b	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 4, 2023 09:00:19.439583063 CET	1.1.1.1	192.168.2.16	0xd926	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2023 09:00:19.439583063 CET	1.1.1.1	192.168.2.16	0xd926	No error (0)	clients.l.google.com		172.253.122.138	A (IP address)	IN (0x0001)	false
Dec 4, 2023 09:00:19.439583063 CET	1.1.1.1	192.168.2.16	0xd926	No error (0)	clients.l.google.com		172.253.122.101	A (IP address)	IN (0x0001)	false
Dec 4, 2023 09:00:19.439583063 CET	1.1.1.1	192.168.2.16	0xd926	No error (0)	clients.l.google.com		172.253.122.113	A (IP address)	IN (0x0001)	false
Dec 4, 2023 09:00:19.439583063 CET	1.1.1.1	192.168.2.16	0xd926	No error (0)	clients.l.google.com		172.253.122.102	A (IP address)	IN (0x0001)	false
Dec 4, 2023 09:00:19.439583063 CET	1.1.1.1	192.168.2.16	0xd926	No error (0)	clients.l.google.com		172.253.122.139	A (IP address)	IN (0x0001)	false
Dec 4, 2023 09:00:19.439583063 CET	1.1.1.1	192.168.2.16	0xd926	No error (0)	clients.l.google.com		172.253.122.100	A (IP address)	IN (0x0001)	false
Dec 4, 2023 09:00:19.445502043 CET	1.1.1.1	192.168.2.16	0x372d	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

www.ojrq.net

clients2.google.com

accounts.google.com

https:

slscr.update.microsoft.com

clients1.google.com

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Dec 4, 2023 08:59:01.530040979 CET	23.1.237.25	443	192.168.2.16	49703	CN=r.bing.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Oct 18 22:32:40 CEST 2023 Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
Dec 4, 2023 08:59:01.530040979 CET	23.1.237.25	443	192.168.2.16	49703	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		28a2c9bd18a11de089ef85a160da29e4

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49719	34.95.127.121	443	3496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-04 07:58:50 UTC	655	OUT	GET / HTTP/1.1 Host: www.ojrq.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-04 07:58:50 UTC	463	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 70 72 65 2d 63 68 65 63 6b 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 30 34 20 44 65 63 20 32 30 32 33 20 30 37 3a 35 38 3a 35 30 20 47 4d 54 0d 0a 50 33 50 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 41 4c 4c 20 42 55 53 20 4c 45 47 20 44 53 50 20 43 4f 52 20 41 44 4d 20 43 55 52 20 44 45 56 20 50 53 41 20 4f 55 52 20 4e 41 56 20 49 4e 54 22 0d 0a 54 69 6d 69 6e 67 2d 41 6c Data Ascii: HTTP/1.1 404 Not FoundCache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheExpires: Mon, 04 Dec 2023 07:58:50 GMTP3P: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"Timing-Al
2023-12-04 07:58:50 UTC	248	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 44 65 61 64 20 45 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 35 30 30 70 78 3b 22 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 0a 3c 62 72 20 63 6c 65 61 72 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 70 3e 54 68 65 20 6c 69 6e 6b 20 79 6f 75 20 63 6c 69 63 6b 65 64 20 6f 6e 20 69 73 20 6d 61 6c 66 6f 72 6d 65 64 2e 20 20 43 6f 6e 74 61 63 74 20 74 68 65 20 65 64 69 74 6f 72 20 6f 66 20 74 68 65 20 6f 72 69 67 69 6e 61 74 69 6e 67 20 70 61 67 65 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Dead End</title></head><body bgcolor="#ffffff"><div style="width: 500px;" align="center"><br clear="all" /><p>The link you clicked on is malformed. Contact the editor of the originating page.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49721	142.251.16.101	443	3496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-04 07:58:50 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-04 07:58:50 UTC	732	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 34 64 32 70 77 37 50 41 42 53 58 54 6f 6c 4d 41 32 4f 61 4e 58 77 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 63 6c 69 65 6e 74 75 70 64 61 74 65 2d 61 75 73 2f 31 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-4d2pw7PABSXTolMA2OaNXw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control
2023-12-04 07:58:50 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 38 30 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 38 36 33 33 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6180" elapsed_seconds="86330"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-12-04 07:58:50 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-12-04 07:58:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49722	142.251.167.84	443	3496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-04 07:58:50 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-12-04 07:58:50 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-12-04 07:58:50 UTC	1627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8Access-Control-Allow-Origin: https://www.google.comAccess-Control-Allow-Credentials: trueX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePr
2023-12-04 07:58:50 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-12-04 07:58:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49723	34.95.127.121	443	3496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-04 07:58:50 UTC	580	OUT	GET /favicon.ico HTTP/1.1 Host: www.ojrq.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.ojrq.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-04 07:58:50 UTC	512	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 70 72 65 2d 63 68 65 63 6b 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 30 34 20 44 65 63 20 32 30 32 33 20 30 37 3a 35 38 3a 35 30 20 47 4d 54 0d 0a 50 33 50 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 41 4c 4c 20 42 55 53 20 4c 45 47 20 44 53 50 20 43 4f 52 20 41 44 4d 20 43 55 52 20 44 45 56 20 50 53 41 20 4f 55 52 20 4e 41 56 20 49 4e 54 22 0d 0a 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 Data Ascii: HTTP/1.1 200 OKCache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheExpires: Mon, 04 Dec 2023 07:58:50 GMTP3P: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"Timing-Allow-Ori
2023-12-04 07:58:50 UTC	740	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 01 7c 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 28 91 63 60 60 2a 49 2c 28 c8 61 61 60 60 c8 cd 2b 29 0a 72 77 52 88 88 8c 52 60 bf c3 c0 cd c0 c3 20 c4 60 c5 20 9e 98 5c 5c e0 18 10 e0 c3 80 13 7c bb c6 c0 08 a2 2f eb 82 cc 4a f3 fc 79 d3 a6 b5 7c fe 16 36 af 99 72 56 25 3a b8 f5 81 01 77 4a 6a 71 32 03 03 23 07 90 9d 9c 52 9c 9c 0b 64 e7 00 d9 3a c9 05 45 25 40 f6 0c 20 5b b7 bc a4 00 c4 3e 01 64 8b 14 01 1d 08 64 df 01 b1 d3 21 ec 0f 20 76 12 98 cd c4 02 56 13 12 e4 0c 64 4b 00 d9 02 49 10 b6 06 88 9d 0e 61 5b 80 d8 c9 19 89 29 40 b6 07 c8 2e 88 1b c0 80 d3 c3 45 c1 dc c0 52 d7 91 80 bb 49 06 b9 39 a5 30 3b 40 a1 c5 93 9a 17 1a 0c 72 07 10 Data Ascii: PNGIHDR szz\|iCCPICC Profile(c``*I,(aa``+)rwRR` ` \\\|/Jy\|6rV%:wJjq2#Rd:E%@ [>dd! vVdKIa[)@.ERI90;@r
2023-12-04 07:58:50 UTC	1252	IN	Data Raw: 6d 2f 74 69 66 66 2f 31 2e 30 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 3c 65 78 69 66 3a 50 69 78 65 6c 59 44 69 6d 65 6e 73 69 6f 6e 3e 32 38 37 3c 2f 65 78 69 66 3a 50 69 78 65 6c 59 44 69 6d 65 6e 73 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 3c 65 78 69 66 3a 50 69 78 65 6c 58 44 69 6d 65 6e 73 69 6f 6e 3e 32 36 33 3c 2f 65 78 69 66 3a 50 69 78 65 6c 58 44 69 6d 65 6e 73 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 3c 74 69 66 66 3a 4f 72 69 65 6e 74 61 74 69 6f 6e 3e 31 3c 2f 74 69 66 66 3a 4f 72 69 65 6e 74 61 74 69 6f 6e 3e 0a 20 20 20 20 20 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 0a 20 20 20 3c 2f 72 64 66 3a 52 44 46 3e 0a 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 0a f6 90 2d 1c 00 00 04 e7 49 44 41 54 58 09 e5 57 6d 6c 93 55 14 3e ef 47 db Data Ascii: m/tiff/1.0/"> <exif:PixelYDimension>287</exif:PixelYDimension> <exif:PixelXDimension>263</exif:PixelXDimension> <tiff:Orientation>1</tiff:Orientation> </rdf:Description> </rdf:RDF></x:xmpmeta>-IDATXWmlU>G
2023-12-04 07:58:50 UTC	261	IN	Data Raw: 21 b2 96 9b 69 80 f1 c9 99 9a 54 80 c9 f3 d4 04 50 d0 82 ff 81 94 d2 2f f9 f4 89 4a 15 bb 30 60 49 9c 5b 69 4c 4d e0 f1 35 39 57 e6 7d 01 e5 ae 45 49 42 2b 2c ab 25 63 11 1d 51 c3 f3 30 8b 32 8f ad ce b9 b2 bc ba f2 88 9a c0 96 cd cf b5 dd 1c 99 06 01 33 9d 16 81 48 de 27 4e 48 3a 19 1b 04 2d 46 83 04 6e 6f 10 ca 4a 37 b6 ad 0c bb bc 4a 4d a0 ca e1 b8 d7 74 c0 71 e4 6c ff 0d e0 38 16 32 d0 e1 04 4c cd a4 67 1a f4 20 22 89 de 81 5b 70 6c 7f e5 11 87 dd 7e 6f 19 62 e5 51 82 21 57 16 24 ab 78 5a e6 b3 53 1d b5 ed 67 2f b5 7b ee 2f 81 16 89 10 a7 f0 21 f8 06 73 16 bc b9 b7 a2 ae 7e ff be 4e f4 91 f8 fb 94 56 a9 6a 02 a8 91 1d ba 7d bb e3 ce dd 91 d7 66 fe 98 55 00 72 2d 66 c8 cf 5f d7 55 54 58 58 8f 13 92 1a 02 7f 02 62 6b e9 07 ea e2 01 5b 00 00 00 00 49 45 Data Ascii: !iTP/J0`I[iLM59W}EIB+,%cQ023H'NH:-FnoJ7JMtql82Lg "[pl~obQ!W$xZSg/{/!s~NVj}fUr-f_UTXXbk[IE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49725	34.95.127.121	443	3496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-04 07:58:51 UTC	347	OUT	GET /favicon.ico HTTP/1.1 Host: www.ojrq.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-04 07:58:51 UTC	512	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 70 72 65 2d 63 68 65 63 6b 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 30 34 20 44 65 63 20 32 30 32 33 20 30 37 3a 35 38 3a 35 31 20 47 4d 54 0d 0a 50 33 50 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 41 4c 4c 20 42 55 53 20 4c 45 47 20 44 53 50 20 43 4f 52 20 41 44 4d 20 43 55 52 20 44 45 56 20 50 53 41 20 4f 55 52 20 4e 41 56 20 49 4e 54 22 0d 0a 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 Data Ascii: HTTP/1.1 200 OKCache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheExpires: Mon, 04 Dec 2023 07:58:51 GMTP3P: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"Timing-Allow-Ori
2023-12-04 07:58:51 UTC	740	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 01 7c 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 28 91 63 60 60 2a 49 2c 28 c8 61 61 60 60 c8 cd 2b 29 0a 72 77 52 88 88 8c 52 60 bf c3 c0 cd c0 c3 20 c4 60 c5 20 9e 98 5c 5c e0 18 10 e0 c3 80 13 7c bb c6 c0 08 a2 2f eb 82 cc 4a f3 fc 79 d3 a6 b5 7c fe 16 36 af 99 72 56 25 3a b8 f5 81 01 77 4a 6a 71 32 03 03 23 07 90 9d 9c 52 9c 9c 0b 64 e7 00 d9 3a c9 05 45 25 40 f6 0c 20 5b b7 bc a4 00 c4 3e 01 64 8b 14 01 1d 08 64 df 01 b1 d3 21 ec 0f 20 76 12 98 cd c4 02 56 13 12 e4 0c 64 4b 00 d9 02 49 10 b6 06 88 9d 0e 61 5b 80 d8 c9 19 89 29 40 b6 07 c8 2e 88 1b c0 80 d3 c3 45 c1 dc c0 52 d7 91 80 bb 49 06 b9 39 a5 30 3b 40 a1 c5 93 9a 17 1a 0c 72 07 10 Data Ascii: PNGIHDR szz\|iCCPICC Profile(c``*I,(aa``+)rwRR` ` \\\|/Jy\|6rV%:wJjq2#Rd:E%@ [>dd! vVdKIa[)@.ERI90;@r
2023-12-04 07:58:51 UTC	1252	IN	Data Raw: 6d 2f 74 69 66 66 2f 31 2e 30 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 3c 65 78 69 66 3a 50 69 78 65 6c 59 44 69 6d 65 6e 73 69 6f 6e 3e 32 38 37 3c 2f 65 78 69 66 3a 50 69 78 65 6c 59 44 69 6d 65 6e 73 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 3c 65 78 69 66 3a 50 69 78 65 6c 58 44 69 6d 65 6e 73 69 6f 6e 3e 32 36 33 3c 2f 65 78 69 66 3a 50 69 78 65 6c 58 44 69 6d 65 6e 73 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 3c 74 69 66 66 3a 4f 72 69 65 6e 74 61 74 69 6f 6e 3e 31 3c 2f 74 69 66 66 3a 4f 72 69 65 6e 74 61 74 69 6f 6e 3e 0a 20 20 20 20 20 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 0a 20 20 20 3c 2f 72 64 66 3a 52 44 46 3e 0a 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 0a f6 90 2d 1c 00 00 04 e7 49 44 41 54 58 09 e5 57 6d 6c 93 55 14 3e ef 47 db Data Ascii: m/tiff/1.0/"> <exif:PixelYDimension>287</exif:PixelYDimension> <exif:PixelXDimension>263</exif:PixelXDimension> <tiff:Orientation>1</tiff:Orientation> </rdf:Description> </rdf:RDF></x:xmpmeta>-IDATXWmlU>G
2023-12-04 07:58:51 UTC	261	IN	Data Raw: 21 b2 96 9b 69 80 f1 c9 99 9a 54 80 c9 f3 d4 04 50 d0 82 ff 81 94 d2 2f f9 f4 89 4a 15 bb 30 60 49 9c 5b 69 4c 4d e0 f1 35 39 57 e6 7d 01 e5 ae 45 49 42 2b 2c ab 25 63 11 1d 51 c3 f3 30 8b 32 8f ad ce b9 b2 bc ba f2 88 9a c0 96 cd cf b5 dd 1c 99 06 01 33 9d 16 81 48 de 27 4e 48 3a 19 1b 04 2d 46 83 04 6e 6f 10 ca 4a 37 b6 ad 0c bb bc 4a 4d a0 ca e1 b8 d7 74 c0 71 e4 6c ff 0d e0 38 16 32 d0 e1 04 4c cd a4 67 1a f4 20 22 89 de 81 5b 70 6c 7f e5 11 87 dd 7e 6f 19 62 e5 51 82 21 57 16 24 ab 78 5a e6 b3 53 1d b5 ed 67 2f b5 7b ee 2f 81 16 89 10 a7 f0 21 f8 06 73 16 bc b9 b7 a2 ae 7e ff be 4e f4 91 f8 fb 94 56 a9 6a 02 a8 91 1d ba 7d bb e3 ce dd 91 d7 66 fe 98 55 00 72 2d 66 c8 cf 5f d7 55 54 58 58 8f 13 92 1a 02 7f 02 62 6b e9 07 ea e2 01 5b 00 00 00 00 49 45 Data Ascii: !iTP/J0`I[iLM59W}EIB+,%cQ023H'NH:-FnoJ7JMtql82Lg "[pl~obQ!W$xZSg/{/!s~NVj}fUr-f_UTXXbk[IE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49727	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2023-12-04 07:59:01 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Cy2tAEbK9g1Ghn1&MD=54ckcvU2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-04 07:59:02 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 58 41 6f 70 61 7a 56 30 30 58 44 57 6e 4a 43 77 6b 6d 45 57 52 76 36 4a 6b 62 6a 52 41 39 51 53 53 5a 32 2b 65 2f 33 4d 7a 45 6b 3d 5f 32 38 38 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 32 34 63 38 32 30 39 32 2d 38 35 63 32 2d 34 31 35 32 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"MS-CorrelationId: 24c82092-85c2-4152-
2023-12-04 07:59:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-12-04 07:59:02 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49729	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2023-12-04 07:59:39 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Cy2tAEbK9g1Ghn1&MD=54ckcvU2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-04 07:59:39 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 4d 78 31 52 6f 4a 48 2f 71 45 77 70 57 66 4b 6c 6c 78 37 73 62 73 6c 32 38 41 75 45 52 7a 35 49 59 64 63 73 76 74 54 4a 63 67 4d 3d 5f 32 31 36 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 36 65 66 62 31 62 31 35 2d 62 66 35 63 2d 34 64 33 39 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"MS-CorrelationId: 6efb1b15-bf5c-4d39-
2023-12-04 07:59:39 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-12-04 07:59:39 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49733	172.253.122.138	443	3496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-04 08:00:19 UTC	449	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000761FC55BDC HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2023-12-04 08:00:19 UTC	817	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 41 43 50 51 7a 75 30 65 61 69 6f 54 79 77 77 57 39 33 2d 46 79 41 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 64 6f 77 6e 6c 6f 61 64 2d 64 74 2f 31 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-ACPQzu0eaioTywwW93-FyA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1Content-Security-P
2023-12-04 08:00:19 UTC	219	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 32 65 31 35 66 38 39 0a Data Ascii: rlzC1: 1C1ONGR_enUS1087rlzC2: 1C2ONGR_enUS1087rlzC7: 1C7ONGR_enUS1087dcc: set_dcc: C1:1C1ONGR_enUS1087,C2:1C2ONGR_enUS1087,C7:1C7ONGR_enUS1087events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: 2e15f89

Statistics

CPU Usage

• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	0
Start time:	08:58:48
Start date:	04/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.ojrq.net/
Imagebase:	0x7ff71e7f0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:58:48
Start date:	04/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2008,i,8897769019717590478,4788855190301408649,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff71e7f0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.ojrq.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.ojrq.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ojrq.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.ojrq.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Cy2tAEbK9g1Ghn1&MD=54ckcvU2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Cy2tAEbK9g1Ghn1&MD=54ckcvU2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000761FC55BDC HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.ojrq.net/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Connections

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6524, Parent PID: 6896

General

File Activities

File Opened

File Created

File Deleted

File Moved

Other File Operations

Windows Analysis Report
https://www.ojrq.net/