[@David] could you please explain why my firewall logged over a period of time:
01/10/2026 22:19:53 | 2544 | Microsoft Edge WebView2 | C:\program files (x86)\microsoft\edgewebview\application\154.0.4258.48\msedgewebview2.exe | Block | Out | 192.168.1.83 | 54698 | 192.168.1.254 | 53 | 17 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53702 | 104.18.38.233 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53701 | 172.64.149.23 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53700 | 104.18.38.233 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53699 | 172.64.149.23 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53698 | 104.18.38.233 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53697 | 172.64.149.23 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53696 | 104.18.38.233 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53695 | 172.64.149.23 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53710 | 23.11.41.157 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53709 | 23.11.41.157 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53708 | 23.11.41.157 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53707 | 23.11.41.157 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53706 | 23.11.41.157 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53705 | 162.159.142.9 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53704 | 172.66.2.5 | 80 | 6 |
01/10/2026 22:19:48 | 5304 | afksec-guard.exe | C:\users\”””’\documents\innoextractor files\afksecurity 1_0_3\{app}\afksec-guard.exe | Block | Out | 192.168.1.83 | 53703 | 23.11.41.157 | 80 | 6 |Any idea what those unencrypted HTTP connection attempts from your service are for I note they are not preceded by any port 53 DNS look up? Only one of them has a rDNS but that is a23-11-41-157.deploy.static.akamaitechnologies.com the others have no rDNS
Regarding the journal in my opinion you should cache the journal internally in a memory array and on application shutdown flush it to the file instead of performing fresh writes for each line… that will reduce the SSD erase/write cycles you place on the SSD and just because windows logs many things is no excuse to do the same in an inefficient manner.
Also regarding the writes in odd places in locations within the Documents hierarchy if you really want to detect encryption early you should not place the canary/honeypot files deep in the file structure as they will b enumerated later on than the earlier files in the directories. Relying upon canary files means the mess has already hit the fan… personally I’d monitor the API in the same manner a procmon.exe and place the canary files near or at the start of the Documents folder structure so it will be processed before the important regular documents and check for the canary file being opened with write access requested… don’t wait for the canary files to be encrypted just check for intent to write to the canary files as a bad act and freeze that process before it actually performs any writes.