Click to jump to signature section
Source: C:\Windows\SysWOW64\unarchiver.exe | File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll | Jump to behavior |
Source: unknown | HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.3:49722 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.3:49723 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 20.190.151.134:443 -> 192.168.2.3:49724 version: TLS 1.2 |
Source: unknown | HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.3:49725 version: TLS 1.2 |
Source: unknown | Network traffic detected: HTTP traffic on port 49674 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49722 |
Source: unknown | Network traffic detected: HTTP traffic on port 49708 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49721 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49720 |
Source: unknown | Network traffic detected: HTTP traffic on port 49672 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49676 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49725 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49719 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49720 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49722 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49719 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49718 |
Source: unknown | Network traffic detected: HTTP traffic on port 49713 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49715 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49716 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49715 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49714 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49713 |
Source: unknown | Network traffic detected: HTTP traffic on port 49675 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49709 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49707 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49730 |
Source: unknown | Network traffic detected: HTTP traffic on port 49677 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49730 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49671 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49724 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49721 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49723 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49709 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49708 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49707 |
Source: unknown | Network traffic detected: HTTP traffic on port 49716 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49714 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49681 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49718 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49725 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49724 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49723 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.203 |
Source: unknown | TCP traffic detected without corresponding DNS query: 173.222.162.43 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.189.173.5 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.189.173.5 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.189.173.5 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.203 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.189.173.5 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.189.173.5 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 173.222.162.43 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.189.173.5 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 204.79.197.203 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.189.173.5 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.98.116.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.101.135.98 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.45.41.40 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.45.41.40 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.101.135.98 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.45.41.40 |
Source: unknown | TCP traffic detected without corresponding DNS query: 104.101.135.98 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.45.41.40 |
Source: unknown | TCP traffic detected without corresponding DNS query: 23.45.41.40 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 20.114.59.183 |
Source: unknown | HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2023-10-05-14; NID=511=OL3WgnA24QwPfMpspsItpZ2c_g7YXAAMilzUqiZdxG8z8Ka1c00AfG24ctRwvhPMrHVqO7oNbKVSwiOA0g2EzuMjPJIvQtOS7zZy99O8OkMoKSMKDFs-L1TjxHc_KVN5KBVb4BTfsPAzvlWsn_iACmkP3ulD50w_qpZ6JVqkr7w |
Source: unknown | DNS traffic detected: queries for: clients2.google.com |
Source: global traffic | HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.134Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic | HTTP traffic detected: GET /uc?export=download&id=1oNBpYBcbyTNx939h0fNcEpsopl_2U2qO HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIm2yQEIorbJAQipncoBCL/qygEIk6HLAQiLq8wBCIWgzQEI3L3NAQi4yM0BCLnKzQEIitPNAQj1080BCMzWzQEIp9jNAQi22M0BCPnA1BUYuL/NARj1yc0BGLnSzQEYx9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2023-10-05-14; NID=511=OL3WgnA24QwPfMpspsItpZ2c_g7YXAAMilzUqiZdxG8z8Ka1c00AfG24ctRwvhPMrHVqO7oNbKVSwiOA0g2EzuMjPJIvQtOS7zZy99O8OkMoKSMKDFs-L1TjxHc_KVN5KBVb4BTfsPAzvlWsn_iACmkP3ulD50w_qpZ6JVqkr7w |
Source: global traffic | HTTP traffic detected: GET /docs/securesc/343tm05lbit3eqd9l1domsulqh4t9cen/q0khof94bttsppd2n5rqjsq6u2g5qrfl/1696862175000/02427878730458398129/13655960228282191934Z/1oNBpYBcbyTNx939h0fNcEpsopl_2U2qO?e=download&uuid=8cd3bba0-a839-429a-a502-c0d1322393f2 HTTP/1.1Host: doc-00-c4-docs.googleusercontent.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIm2yQEIorbJAQipncoBCL/qygEIk6HLAQiLq8wBCIWgzQEI3L3NAQi4yM0BCLnKzQEIitPNAQj1080BCMzWzQEIp9jNAQi22M0BCPnA1BUYuL/NARj1yc0BGLnSzQEYx9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic | HTTP traffic detected: GET /nonceSigner?nonce=o8974t8ln8gnq&continue=https://doc-00-c4-docs.googleusercontent.com/docs/securesc/343tm05lbit3eqd9l1domsulqh4t9cen/q0khof94bttsppd2n5rqjsq6u2g5qrfl/1696862175000/02427878730458398129/13655960228282191934Z/1oNBpYBcbyTNx939h0fNcEpsopl_2U2qO?e%3Ddownload%26uuid%3D8cd3bba0-a839-429a-a502-c0d1322393f2&hash=stagrf10eooi8odf10em73gi0p71h36e HTTP/1.1Host: drive.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIm2yQEIorbJAQipncoBCL/qygEIk6HLAQiLq8wBCIWgzQEI3L3NAQi4yM0BCLnKzQEIitPNAQj1080BCMzWzQEIp9jNAQi22M0BCPnA1BUYuL/NARj1yc0BGLnSzQEYx9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2023-10-05-14; NID=511=OL3WgnA24QwPfMpspsItpZ2c_g7YXAAMilzUqiZdxG8z8Ka1c00AfG24ctRwvhPMrHVqO7oNbKVSwiOA0g2EzuMjPJIvQtOS7zZy99O8OkMoKSMKDFs-L1TjxHc_KVN5KBVb4BTfsPAzvlWsn_iACmkP3ulD50w_qpZ6JVqkr7w |
Source: global traffic | HTTP traffic detected: GET /docs/securesc/343tm05lbit3eqd9l1domsulqh4t9cen/q0khof94bttsppd2n5rqjsq6u2g5qrfl/1696862175000/02427878730458398129/13655960228282191934Z/1oNBpYBcbyTNx939h0fNcEpsopl_2U2qO?e=download&uuid=8cd3bba0-a839-429a-a502-c0d1322393f2&nonce=o8974t8ln8gnq&user=13655960228282191934Z&hash=q6b3fu5krt5ugpvh3gqfq9t17nieiek5 HTTP/1.1Host: doc-00-c4-docs.googleusercontent.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIm2yQEIorbJAQipncoBCL/qygEIk6HLAQiLq8wBCIWgzQEI3L3NAQi4yM0BCLnKzQEIitPNAQj1080BCMzWzQEIp9jNAQi22M0BCPnA1BUYuL/NARj1yc0BGLnSzQEYx9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AUTH_7a6bcecv233qg3v4clpiu3ootrj9542a_nonce=o8974t8ln8gnq |
Source: global traffic | HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.3448/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.3031&MK=StmyNtv1AKW9mNs&MD=fg5eLp3F HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com |
Source: global traffic | HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.3448/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.3031&MK=StmyNtv1AKW9mNs&MD=fg5eLp3F HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com |
Source: global traffic | HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A410900F086X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-Device-Manufacturer: wouwfg, Inc.X-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAW9dQIwN4RtyFIB7UXp0tjAEpJ16W3xicLR6GOiPnTvSUGgYZeA3xOurbHTiocYJLV1kpjeQRcD9k8et5peHX%2BpXvzIPm45SLJODpmM/mA%2BpNXATK2PzJHHx5qzLMVtYl8/Qy5ScrmPQy18P6tTBGSM%2BaMjrFHvMH/715mSWK5Ksm/qk881%2BUmKyY1RMteEadVdkqQw4NYpuPRHKoTVfMRGxfThpXBO7CUTZBEY7R5GmXxKlvZATA5ysmn67nwNW5V1kZZbDD2lcPVTQMNXXcnBCtxp1p%2BNAArIvOn4xICdVNLrWPmT/wF3jp/qGbC8otpi6NEnkpQ7XsPkDi1dpGzoDZgAACGw7ccP2%2B4XPqAF4/wN/VF89qokqf8fFovnaJq%2BehgXyX4iYywxKbu/Pr6Xr0xEN7mItgKgxA634B/Z2FyhaecDC%2BqIkfoReW4Uy0S1b373IlD1BL9Dws9EvKqL0VENUtYO4fnJdEIcZfn%2BhGhb6Ry1LThKPe6JHNF9HRptTdc2fCy6XZOWW7VoON0AMVxzy/d2ZzGy6X2EPRlzuzohMARXd87St6CX6C52SY%2BGByVXY/NNHUHYKllDU5BhAwFEO%2Bf4dyRSQO4A0pQVLFSdLKPW0KTzBDalhPauz5U3UETyUIvr%2BlfBUsRM2FWwY6I%2Bjip3qYR83VWv9zDQe7cQxtzxbWW8ogkOzaQriwbG2yNaIHtbQsW/MsAW/rttDQSv71utB/Pl0rpF%2BDYiT8sRbcCtsfnnHzzMHkJ38FOT7UGyzB7E1ruXaX6JfJCdSh2iTUPiaZI/Om6I1A32Zlu%2Bk/ol/voUq4d4Qu9EDmNUgjLzCdk%2Bs54CZOj86Sn8tHJXwZkaHur9RlOsbsRpOF4umTsLmsDl/zu49ubkxrmpJahsr2qP8c7%2BDn83S61HaHn2t37jj2gE%3D%26p%3DX-Agent-DeviceId: 01000A410900F086X-Device-Product: wouwfg20,1X-BM-CBT: 1696862274User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.10.19041; 10.0.0.0.19045.3448) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 5B55B957CCDE4B48BB407231F85D2376X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=1DFC5692B3C14AD1B3C2CC78B83DC83F&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=D |