Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://10.00.56.00&d=DwQFaQ

Overview

General Information

Sample URL:http://10.00.56.00&d=DwQFaQ
Analysis ID:1426761
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 6944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • chrome.exe (PID: 4160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2208,i,7639646435292787510,15926903096463883303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • chrome.exe (PID: 6688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://10.00.56.00&d=DwQFaQ" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownHTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49727 version: TLS 1.0
Source: unknownHTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49727 version: TLS 1.0
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: unknownDNS traffic detected: queries for: google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownHTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: classification engineClassification label: clean0.win@20/0@4/5
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2208,i,7639646435292787510,15926903096463883303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://10.00.56.00&d=DwQFaQ"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2208,i,7639646435292787510,15926903096463883303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1426761 URL: http://10.00.56.00&d=DwQFaQ Startdate: 16/04/2024 Architecture: WINDOWS Score: 0 5 chrome.exe 1 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.17 unknown unknown 5->13 15 192.168.2.18 unknown unknown 5->15 17 2 other IPs or domains 5->17 10 chrome.exe 5->10         started        process4 dnsIp5 19 www.google.com 142.250.105.99, 443, 49718, 49733 GOOGLEUS United States 10->19 21 google.com 10->21

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.214.172
truefalse
    		unknown
    google.com
    		142.250.217.174
    		truefalse
      		high
      www.google.com
      		142.250.105.99
      		truefalse
        		high
        fp2e7a.wpc.phicdn.net
        		192.229.211.108
        		truefalse
          		unknown

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          239.255.255.250
          		unknownReserved
          		unknownunknownfalse
          142.250.105.99
          		www.google.comUnited States
          		15169GOOGLEUSfalse

          Private

          IP
          192.168.2.17
          192.168.2.18
          192.168.2.6

          General Information

          Joe Sandbox version:40.0.0 Tourmaline
          Analysis ID:1426761
          Start date and time:2024-04-16 15:31:53 +02:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:0h 3m 22s
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:browseurl.jbs
          Sample URL:http://10.00.56.00&d=DwQFaQ
          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
          Number of analysed new started processes analysed:12
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Detection:CLEAN
          Classification:clean0.win@20/0@4/5
          EGA Information:Failed
          HCA Information:
          • Successful, ratio: 100%
          • Number of executed functions: 0
          • Number of non-executed functions: 0

          Warnings

          • Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
          • Excluded IPs from analysis (whitelisted): 74.125.138.94, 172.253.124.113, 172.253.124.139, 172.253.124.102, 172.253.124.100, 172.253.124.101, 172.253.124.138, 64.233.176.84, 34.104.35.123, 40.127.169.103, 192.229.211.108, 23.40.205.34, 23.40.205.73, 23.40.205.8, 23.40.205.49, 23.40.205.26, 23.40.205.35, 23.40.205.65, 23.40.205.48, 20.242.39.171, 23.76.32.107, 108.177.122.94, 199.232.214.172
          • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, e15275.g.akamaiedge.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, wildcard.weather.microsoft.com.edgekey.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
          • Not all processes where analyzed, report is missing behavior information
          • Report size getting too big, too many NtSetInformationFile calls found.

          Simulations

          Behavior and APIs

          ⊘No simulations

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          ⊘No context

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          ⊘No static file info

          Network Behavior

          Network Port Distribution

          TCP Packets

          TimestampSource PortDest PortSource IPDest IP
          Apr 16, 2024 15:32:42.725600958 CEST49673443192.168.2.6173.222.162.64
          Apr 16, 2024 15:32:42.727906942 CEST49674443192.168.2.6173.222.162.64
          Apr 16, 2024 15:32:42.928749084 CEST49672443192.168.2.6173.222.162.64
          Apr 16, 2024 15:32:50.555548906 CEST49718443192.168.2.6142.250.105.99
          Apr 16, 2024 15:32:50.555592060 CEST44349718142.250.105.99192.168.2.6
          Apr 16, 2024 15:32:50.555676937 CEST49718443192.168.2.6142.250.105.99
          Apr 16, 2024 15:32:50.555903912 CEST49718443192.168.2.6142.250.105.99
          Apr 16, 2024 15:32:50.555915117 CEST44349718142.250.105.99192.168.2.6
          Apr 16, 2024 15:32:50.778702974 CEST44349718142.250.105.99192.168.2.6
          Apr 16, 2024 15:32:50.779036999 CEST49718443192.168.2.6142.250.105.99
          Apr 16, 2024 15:32:50.779061079 CEST44349718142.250.105.99192.168.2.6
          Apr 16, 2024 15:32:50.780750036 CEST44349718142.250.105.99192.168.2.6
          Apr 16, 2024 15:32:50.780848026 CEST49718443192.168.2.6142.250.105.99
          Apr 16, 2024 15:32:50.782428980 CEST49718443192.168.2.6142.250.105.99
          Apr 16, 2024 15:32:50.782546997 CEST44349718142.250.105.99192.168.2.6
          Apr 16, 2024 15:32:50.833369017 CEST49718443192.168.2.6142.250.105.99
          Apr 16, 2024 15:32:50.833396912 CEST44349718142.250.105.99192.168.2.6
          Apr 16, 2024 15:32:50.880218983 CEST49718443192.168.2.6142.250.105.99
          Apr 16, 2024 15:32:50.985450983 CEST49719443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:50.985485077 CEST4434971952.159.127.243192.168.2.6
          Apr 16, 2024 15:32:50.985562086 CEST49719443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:50.986285925 CEST49719443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:50.986294985 CEST4434971952.159.127.243192.168.2.6
          Apr 16, 2024 15:32:51.375796080 CEST4434971952.159.127.243192.168.2.6
          Apr 16, 2024 15:32:51.375869036 CEST49719443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:51.391983032 CEST49719443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:51.392007113 CEST4434971952.159.127.243192.168.2.6
          Apr 16, 2024 15:32:51.392513990 CEST4434971952.159.127.243192.168.2.6
          Apr 16, 2024 15:32:51.400713921 CEST49719443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:51.400870085 CEST49719443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:51.400875092 CEST4434971952.159.127.243192.168.2.6
          Apr 16, 2024 15:32:51.401283026 CEST49719443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:51.448107004 CEST4434971952.159.127.243192.168.2.6
          Apr 16, 2024 15:32:51.534488916 CEST4434971952.159.127.243192.168.2.6
          Apr 16, 2024 15:32:51.534593105 CEST4434971952.159.127.243192.168.2.6
          Apr 16, 2024 15:32:51.534643888 CEST49719443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:51.535120964 CEST49719443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:51.535131931 CEST4434971952.159.127.243192.168.2.6
          Apr 16, 2024 15:32:52.333394051 CEST49674443192.168.2.6173.222.162.64
          Apr 16, 2024 15:32:52.333398104 CEST49673443192.168.2.6173.222.162.64
          Apr 16, 2024 15:32:52.536542892 CEST49672443192.168.2.6173.222.162.64
          Apr 16, 2024 15:32:52.677647114 CEST49720443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:52.677697897 CEST4434972023.36.68.63192.168.2.6
          Apr 16, 2024 15:32:52.677812099 CEST49720443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:52.680392027 CEST49720443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:52.680413008 CEST4434972023.36.68.63192.168.2.6
          Apr 16, 2024 15:32:52.905744076 CEST4434972023.36.68.63192.168.2.6
          Apr 16, 2024 15:32:52.906236887 CEST49720443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:52.910140991 CEST49720443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:52.910181046 CEST4434972023.36.68.63192.168.2.6
          Apr 16, 2024 15:32:52.910516024 CEST4434972023.36.68.63192.168.2.6
          Apr 16, 2024 15:32:52.958403111 CEST49720443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:52.972932100 CEST49720443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.020109892 CEST4434972023.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.108139992 CEST4434972023.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.108223915 CEST4434972023.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.108669043 CEST49720443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.108901024 CEST49720443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.108901024 CEST49720443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.108922005 CEST4434972023.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.108931065 CEST4434972023.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.160293102 CEST49721443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.160337925 CEST4434972123.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.161647081 CEST49721443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.161647081 CEST49721443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.161679983 CEST4434972123.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.375550032 CEST4434972123.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.375663042 CEST49721443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.377521992 CEST49721443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.377537966 CEST4434972123.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.377937078 CEST4434972123.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.379730940 CEST49721443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.420119047 CEST4434972123.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.587662935 CEST4434972123.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.587801933 CEST4434972123.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.587877989 CEST49721443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.588618040 CEST49721443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.588644981 CEST4434972123.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.588671923 CEST49721443192.168.2.623.36.68.63
          Apr 16, 2024 15:32:53.588685989 CEST4434972123.36.68.63192.168.2.6
          Apr 16, 2024 15:32:53.901824951 CEST44349707173.222.162.64192.168.2.6
          Apr 16, 2024 15:32:53.901909113 CEST49707443192.168.2.6173.222.162.64
          Apr 16, 2024 15:32:58.259123087 CEST49722443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:58.259180069 CEST4434972252.159.127.243192.168.2.6
          Apr 16, 2024 15:32:58.259242058 CEST49722443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:58.260267973 CEST49722443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:58.260305882 CEST4434972252.159.127.243192.168.2.6
          Apr 16, 2024 15:32:58.636605978 CEST4434972252.159.127.243192.168.2.6
          Apr 16, 2024 15:32:58.636753082 CEST49722443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:59.043509960 CEST49722443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:59.043543100 CEST4434972252.159.127.243192.168.2.6
          Apr 16, 2024 15:32:59.043899059 CEST4434972252.159.127.243192.168.2.6
          Apr 16, 2024 15:32:59.080957890 CEST49722443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:59.081150055 CEST49722443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:59.081156969 CEST4434972252.159.127.243192.168.2.6
          Apr 16, 2024 15:32:59.081362963 CEST49722443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:59.124131918 CEST4434972252.159.127.243192.168.2.6
          Apr 16, 2024 15:32:59.204180956 CEST4434972252.159.127.243192.168.2.6
          Apr 16, 2024 15:32:59.204283953 CEST4434972252.159.127.243192.168.2.6
          Apr 16, 2024 15:32:59.204348087 CEST49722443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:59.474241972 CEST49722443192.168.2.652.159.127.243
          Apr 16, 2024 15:32:59.474289894 CEST4434972252.159.127.243192.168.2.6
          Apr 16, 2024 15:33:00.797748089 CEST44349718142.250.105.99192.168.2.6
          Apr 16, 2024 15:33:00.797820091 CEST44349718142.250.105.99192.168.2.6
          Apr 16, 2024 15:33:00.797903061 CEST49718443192.168.2.6142.250.105.99
          Apr 16, 2024 15:33:01.901599884 CEST49718443192.168.2.6142.250.105.99
          Apr 16, 2024 15:33:01.901638031 CEST44349718142.250.105.99192.168.2.6
          Apr 16, 2024 15:33:05.489048004 CEST49707443192.168.2.6173.222.162.64
          Apr 16, 2024 15:33:05.489146948 CEST49707443192.168.2.6173.222.162.64
          Apr 16, 2024 15:33:05.489542007 CEST49727443192.168.2.6173.222.162.64
          Apr 16, 2024 15:33:05.489594936 CEST44349727173.222.162.64192.168.2.6
          Apr 16, 2024 15:33:05.489666939 CEST49727443192.168.2.6173.222.162.64
          Apr 16, 2024 15:33:05.489950895 CEST49727443192.168.2.6173.222.162.64
          Apr 16, 2024 15:33:05.489970922 CEST44349727173.222.162.64192.168.2.6
          Apr 16, 2024 15:33:05.641035080 CEST44349707173.222.162.64192.168.2.6
          Apr 16, 2024 15:33:05.641047955 CEST44349707173.222.162.64192.168.2.6
          Apr 16, 2024 15:33:05.804349899 CEST44349727173.222.162.64192.168.2.6
          Apr 16, 2024 15:33:05.804501057 CEST49727443192.168.2.6173.222.162.64
          Apr 16, 2024 15:33:11.104720116 CEST49728443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:11.104760885 CEST4434972852.159.127.243192.168.2.6
          Apr 16, 2024 15:33:11.104937077 CEST49728443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:11.106311083 CEST49728443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:11.106343031 CEST4434972852.159.127.243192.168.2.6
          Apr 16, 2024 15:33:11.480025053 CEST4434972852.159.127.243192.168.2.6
          Apr 16, 2024 15:33:11.480096102 CEST49728443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:11.491877079 CEST49728443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:11.491894960 CEST4434972852.159.127.243192.168.2.6
          Apr 16, 2024 15:33:11.492150068 CEST4434972852.159.127.243192.168.2.6
          Apr 16, 2024 15:33:11.506519079 CEST49728443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:11.506742001 CEST49728443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:11.506747007 CEST4434972852.159.127.243192.168.2.6
          Apr 16, 2024 15:33:11.507040024 CEST49728443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:11.552108049 CEST4434972852.159.127.243192.168.2.6
          Apr 16, 2024 15:33:11.629043102 CEST4434972852.159.127.243192.168.2.6
          Apr 16, 2024 15:33:11.629264116 CEST4434972852.159.127.243192.168.2.6
          Apr 16, 2024 15:33:11.629328012 CEST49728443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:11.629565001 CEST49728443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:11.629587889 CEST4434972852.159.127.243192.168.2.6
          Apr 16, 2024 15:33:24.950647116 CEST44349727173.222.162.64192.168.2.6
          Apr 16, 2024 15:33:24.950711966 CEST49727443192.168.2.6173.222.162.64
          Apr 16, 2024 15:33:28.999030113 CEST49730443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:28.999088049 CEST4434973052.159.127.243192.168.2.6
          Apr 16, 2024 15:33:28.999154091 CEST49730443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:29.000646114 CEST49730443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:29.000660896 CEST4434973052.159.127.243192.168.2.6
          Apr 16, 2024 15:33:29.385711908 CEST4434973052.159.127.243192.168.2.6
          Apr 16, 2024 15:33:29.385802031 CEST49730443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:29.388191938 CEST49730443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:29.388205051 CEST4434973052.159.127.243192.168.2.6
          Apr 16, 2024 15:33:29.388987064 CEST4434973052.159.127.243192.168.2.6
          Apr 16, 2024 15:33:29.391242027 CEST49730443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:29.391324043 CEST49730443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:29.391330957 CEST4434973052.159.127.243192.168.2.6
          Apr 16, 2024 15:33:29.391613007 CEST49730443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:29.432126999 CEST4434973052.159.127.243192.168.2.6
          Apr 16, 2024 15:33:29.530603886 CEST4434973052.159.127.243192.168.2.6
          Apr 16, 2024 15:33:29.530822992 CEST4434973052.159.127.243192.168.2.6
          Apr 16, 2024 15:33:29.530989885 CEST49730443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:29.531110048 CEST49730443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:29.531131029 CEST4434973052.159.127.243192.168.2.6
          Apr 16, 2024 15:33:50.506439924 CEST49733443192.168.2.6142.250.105.99
          Apr 16, 2024 15:33:50.506498098 CEST44349733142.250.105.99192.168.2.6
          Apr 16, 2024 15:33:50.506580114 CEST49733443192.168.2.6142.250.105.99
          Apr 16, 2024 15:33:50.507311106 CEST49733443192.168.2.6142.250.105.99
          Apr 16, 2024 15:33:50.507333040 CEST44349733142.250.105.99192.168.2.6
          Apr 16, 2024 15:33:50.721019030 CEST44349733142.250.105.99192.168.2.6
          Apr 16, 2024 15:33:50.721337080 CEST49733443192.168.2.6142.250.105.99
          Apr 16, 2024 15:33:50.721379042 CEST44349733142.250.105.99192.168.2.6
          Apr 16, 2024 15:33:50.721721888 CEST44349733142.250.105.99192.168.2.6
          Apr 16, 2024 15:33:50.722064972 CEST49733443192.168.2.6142.250.105.99
          Apr 16, 2024 15:33:50.722131968 CEST44349733142.250.105.99192.168.2.6
          Apr 16, 2024 15:33:50.764767885 CEST49733443192.168.2.6142.250.105.99
          Apr 16, 2024 15:33:50.982038021 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:50.982100010 CEST4434973452.159.127.243192.168.2.6
          Apr 16, 2024 15:33:50.982198000 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:50.982907057 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:50.982953072 CEST4434973452.159.127.243192.168.2.6
          Apr 16, 2024 15:33:51.354837894 CEST4434973452.159.127.243192.168.2.6
          Apr 16, 2024 15:33:51.354962111 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:51.356751919 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:51.356774092 CEST4434973452.159.127.243192.168.2.6
          Apr 16, 2024 15:33:51.357016087 CEST4434973452.159.127.243192.168.2.6
          Apr 16, 2024 15:33:51.359141111 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:51.359426022 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:51.359426022 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:51.359437943 CEST4434973452.159.127.243192.168.2.6
          Apr 16, 2024 15:33:51.404124975 CEST4434973452.159.127.243192.168.2.6
          Apr 16, 2024 15:33:51.482546091 CEST4434973452.159.127.243192.168.2.6
          Apr 16, 2024 15:33:51.482628107 CEST4434973452.159.127.243192.168.2.6
          Apr 16, 2024 15:33:51.483159065 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:51.483649969 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:33:51.483679056 CEST4434973452.159.127.243192.168.2.6
          Apr 16, 2024 15:33:51.483691931 CEST49734443192.168.2.652.159.127.243
          Apr 16, 2024 15:34:00.722716093 CEST44349733142.250.105.99192.168.2.6
          Apr 16, 2024 15:34:00.722791910 CEST44349733142.250.105.99192.168.2.6
          Apr 16, 2024 15:34:00.722954988 CEST49733443192.168.2.6142.250.105.99
          Apr 16, 2024 15:34:01.902026892 CEST49733443192.168.2.6142.250.105.99
          Apr 16, 2024 15:34:01.902076006 CEST44349733142.250.105.99192.168.2.6

          UDP Packets

          TimestampSource PortDest PortSource IPDest IP
          Apr 16, 2024 15:32:47.834343910 CEST53611631.1.1.1192.168.2.6
          Apr 16, 2024 15:32:47.841298103 CEST53548611.1.1.1192.168.2.6
          Apr 16, 2024 15:32:48.441298962 CEST53559341.1.1.1192.168.2.6
          Apr 16, 2024 15:32:48.816349030 CEST6239253192.168.2.68.8.8.8
          Apr 16, 2024 15:32:48.816608906 CEST5442453192.168.2.61.1.1.1
          Apr 16, 2024 15:32:48.921263933 CEST53623928.8.8.8192.168.2.6
          Apr 16, 2024 15:32:48.921293020 CEST53544241.1.1.1192.168.2.6
          Apr 16, 2024 15:32:50.443941116 CEST6358853192.168.2.61.1.1.1
          Apr 16, 2024 15:32:50.444022894 CEST5766553192.168.2.61.1.1.1
          Apr 16, 2024 15:32:50.554081917 CEST53635881.1.1.1192.168.2.6
          Apr 16, 2024 15:32:50.554552078 CEST53576651.1.1.1192.168.2.6
          Apr 16, 2024 15:33:06.033849955 CEST53534431.1.1.1192.168.2.6
          Apr 16, 2024 15:33:24.877171993 CEST53588321.1.1.1192.168.2.6
          Apr 16, 2024 15:33:46.879272938 CEST53551481.1.1.1192.168.2.6
          Apr 16, 2024 15:33:47.480848074 CEST53540891.1.1.1192.168.2.6

          DNS Queries

          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Apr 16, 2024 15:32:48.816349030 CEST192.168.2.68.8.8.80x2344Standard query (0)google.comA (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:48.816608906 CEST192.168.2.61.1.1.10xa7b6Standard query (0)google.comA (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:50.443941116 CEST192.168.2.61.1.1.10xad27Standard query (0)www.google.comA (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:50.444022894 CEST192.168.2.61.1.1.10xad36Standard query (0)www.google.com65IN (0x0001)false

          DNS Answers

          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Apr 16, 2024 15:32:48.921263933 CEST8.8.8.8192.168.2.60x2344No error (0)google.com142.250.217.174A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:48.921293020 CEST1.1.1.1192.168.2.60xa7b6No error (0)google.com74.125.136.113A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:48.921293020 CEST1.1.1.1192.168.2.60xa7b6No error (0)google.com74.125.136.101A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:48.921293020 CEST1.1.1.1192.168.2.60xa7b6No error (0)google.com74.125.136.102A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:48.921293020 CEST1.1.1.1192.168.2.60xa7b6No error (0)google.com74.125.136.139A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:48.921293020 CEST1.1.1.1192.168.2.60xa7b6No error (0)google.com74.125.136.138A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:48.921293020 CEST1.1.1.1192.168.2.60xa7b6No error (0)google.com74.125.136.100A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:50.554081917 CEST1.1.1.1192.168.2.60xad27No error (0)www.google.com142.250.105.99A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:50.554081917 CEST1.1.1.1192.168.2.60xad27No error (0)www.google.com142.250.105.106A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:50.554081917 CEST1.1.1.1192.168.2.60xad27No error (0)www.google.com142.250.105.104A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:50.554081917 CEST1.1.1.1192.168.2.60xad27No error (0)www.google.com142.250.105.147A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:50.554081917 CEST1.1.1.1192.168.2.60xad27No error (0)www.google.com142.250.105.103A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:50.554081917 CEST1.1.1.1192.168.2.60xad27No error (0)www.google.com142.250.105.105A (IP address)IN (0x0001)false
          Apr 16, 2024 15:32:50.554552078 CEST1.1.1.1192.168.2.60xad36No error (0)www.google.com65IN (0x0001)false
          Apr 16, 2024 15:33:03.598305941 CEST1.1.1.1192.168.2.60xacaaNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
          Apr 16, 2024 15:33:03.598305941 CEST1.1.1.1192.168.2.60xacaaNo error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
          Apr 16, 2024 15:34:04.715873003 CEST1.1.1.1192.168.2.60x52ecNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
          Apr 16, 2024 15:34:04.715873003 CEST1.1.1.1192.168.2.60x52ecNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false

          HTTP Request Dependency Graph

          • fs.microsoft.com

          HTTPS Proxied Packets

          Session IDSource IPSource PortDestination IPDestination Port
          0192.168.2.64971952.159.127.243443
          TimestampBytes transferredDirectionData
          2024-04-16 13:32:51 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 69 4f 41 6d 73 52 70 6a 45 69 51 39 61 47 77 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 36 38 39 38 38 31 38 37 35 62 61 61 31 62 0d 0a 0d 0a
          Data Ascii: CNT 1 CON 305MS-CV: biOAmsRpjEiQ9aGw.1Context: 31689881875baa1b
          2024-04-16 13:32:51 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
          Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
          2024-04-16 13:32:51 UTC1064OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 62 69 4f 41 6d 73 52 70 6a 45 69 51 39 61 47 77 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 36 38 39 38 38 31 38 37 35 62 61 61 31 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 56 53 73 34 57 76 44 52 30 44 73 41 42 5a 41 53 4f 7a 4b 32 2b 4e 55 6e 68 6c 73 54 61 31 47 76 71 4a 61 46 47 31 50 54 34 72 2b 59 39 6e 45 53 77 32 6d 4d 78 7a 4f 4c 45 32 6d 32 57 2f 57 76 70 52 32 61 46 32 4c 61 47 47 6d 34 63 46 7a 54 78 6a 2b 46 75 63 73 76 32 5a 71 51 2f 4c 69 52 70 6f 69 52 37 71 50 67 74 44 42 54
          Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: biOAmsRpjEiQ9aGw.2Context: 31689881875baa1b<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaVSs4WvDR0DsABZASOzK2+NUnhlsTa1GvqJaFG1PT4r+Y9nESw2mMxzOLE2m2W/WvpR2aF2LaGGm4cFzTxj+Fucsv2ZqQ/LiRpoiR7qPgtDBT
          2024-04-16 13:32:51 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 62 69 4f 41 6d 73 52 70 6a 45 69 51 39 61 47 77 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 36 38 39 38 38 31 38 37 35 62 61 61 31 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
          Data Ascii: BND 3 CON\WNS 0 197MS-CV: biOAmsRpjEiQ9aGw.3Context: 31689881875baa1b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
          2024-04-16 13:32:51 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
          Data Ascii: 202 1 CON 58
          2024-04-16 13:32:51 UTC58INData Raw: 4d 53 2d 43 56 3a 20 66 44 34 38 71 71 6c 71 53 6b 36 65 72 35 31 38 52 6e 2b 64 42 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
          Data Ascii: MS-CV: fD48qqlqSk6er518Rn+dBw.0Payload parsing failed.


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          1192.168.2.64972023.36.68.63443
          TimestampBytes transferredDirectionData
          2024-04-16 13:32:52 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          Accept-Encoding: identity
          User-Agent: Microsoft BITS/7.8
          Host: fs.microsoft.com
          2024-04-16 13:32:53 UTC436INHTTP/1.1 200 OK
          ApiVersion: Distribute 1.1
          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
          Content-Type: application/octet-stream
          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
          Server: ECAcc (dcd/7D15)
          X-CID: 11
          Cache-Control: public, max-age=149374
          Date: Tue, 16 Apr 2024 13:32:53 GMT
          Connection: close
          X-CID: 2


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          2192.168.2.64972123.36.68.63443
          TimestampBytes transferredDirectionData
          2024-04-16 13:32:53 UTC239OUTGET /fs/windows/config.json HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          Accept-Encoding: identity
          If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
          Range: bytes=0-2147483646
          User-Agent: Microsoft BITS/7.8
          Host: fs.microsoft.com
          2024-04-16 13:32:53 UTC456INHTTP/1.1 200 OK
          ApiVersion: Distribute 1.1
          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
          Content-Type: application/octet-stream
          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
          Server: ECAcc (dcd/7D15)
          X-CID: 11
          Cache-Control: public, max-age=149374
          Date: Tue, 16 Apr 2024 13:32:53 GMT
          Content-Length: 55
          Connection: close
          X-CID: 2
          2024-04-16 13:32:53 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
          Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


          Session IDSource IPSource PortDestination IPDestination Port
          3192.168.2.64972252.159.127.243443
          TimestampBytes transferredDirectionData
          2024-04-16 13:32:59 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 69 6e 52 32 47 32 47 34 57 45 36 58 4e 62 44 79 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 33 63 30 37 64 36 35 35 65 62 36 32 32 30 38 0d 0a 0d 0a
          Data Ascii: CNT 1 CON 305MS-CV: inR2G2G4WE6XNbDy.1Context: 53c07d655eb62208
          2024-04-16 13:32:59 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
          Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
          2024-04-16 13:32:59 UTC1064OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 69 6e 52 32 47 32 47 34 57 45 36 58 4e 62 44 79 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 33 63 30 37 64 36 35 35 65 62 36 32 32 30 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 56 53 73 34 57 76 44 52 30 44 73 41 42 5a 41 53 4f 7a 4b 32 2b 4e 55 6e 68 6c 73 54 61 31 47 76 71 4a 61 46 47 31 50 54 34 72 2b 59 39 6e 45 53 77 32 6d 4d 78 7a 4f 4c 45 32 6d 32 57 2f 57 76 70 52 32 61 46 32 4c 61 47 47 6d 34 63 46 7a 54 78 6a 2b 46 75 63 73 76 32 5a 71 51 2f 4c 69 52 70 6f 69 52 37 71 50 67 74 44 42 54
          Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: inR2G2G4WE6XNbDy.2Context: 53c07d655eb62208<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaVSs4WvDR0DsABZASOzK2+NUnhlsTa1GvqJaFG1PT4r+Y9nESw2mMxzOLE2m2W/WvpR2aF2LaGGm4cFzTxj+Fucsv2ZqQ/LiRpoiR7qPgtDBT
          2024-04-16 13:32:59 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 69 6e 52 32 47 32 47 34 57 45 36 58 4e 62 44 79 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 33 63 30 37 64 36 35 35 65 62 36 32 32 30 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
          Data Ascii: BND 3 CON\WNS 0 197MS-CV: inR2G2G4WE6XNbDy.3Context: 53c07d655eb62208<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
          2024-04-16 13:32:59 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
          Data Ascii: 202 1 CON 58
          2024-04-16 13:32:59 UTC58INData Raw: 4d 53 2d 43 56 3a 20 52 6d 35 69 4e 6f 50 46 2b 45 61 38 6b 4c 63 30 7a 50 65 69 46 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
          Data Ascii: MS-CV: Rm5iNoPF+Ea8kLc0zPeiFw.0Payload parsing failed.


          Session IDSource IPSource PortDestination IPDestination Port
          4192.168.2.64972852.159.127.243443
          TimestampBytes transferredDirectionData
          2024-04-16 13:33:11 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 41 37 6d 35 2b 62 6d 6a 30 36 54 52 4e 62 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 36 34 64 39 32 62 35 62 33 34 36 35 34 36 65 0d 0a 0d 0a
          Data Ascii: CNT 1 CON 305MS-CV: 6A7m5+bmj06TRNbE.1Context: 364d92b5b346546e
          2024-04-16 13:33:11 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
          Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
          2024-04-16 13:33:11 UTC1064OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 36 41 37 6d 35 2b 62 6d 6a 30 36 54 52 4e 62 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 36 34 64 39 32 62 35 62 33 34 36 35 34 36 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 56 53 73 34 57 76 44 52 30 44 73 41 42 5a 41 53 4f 7a 4b 32 2b 4e 55 6e 68 6c 73 54 61 31 47 76 71 4a 61 46 47 31 50 54 34 72 2b 59 39 6e 45 53 77 32 6d 4d 78 7a 4f 4c 45 32 6d 32 57 2f 57 76 70 52 32 61 46 32 4c 61 47 47 6d 34 63 46 7a 54 78 6a 2b 46 75 63 73 76 32 5a 71 51 2f 4c 69 52 70 6f 69 52 37 71 50 67 74 44 42 54
          Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 6A7m5+bmj06TRNbE.2Context: 364d92b5b346546e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaVSs4WvDR0DsABZASOzK2+NUnhlsTa1GvqJaFG1PT4r+Y9nESw2mMxzOLE2m2W/WvpR2aF2LaGGm4cFzTxj+Fucsv2ZqQ/LiRpoiR7qPgtDBT
          2024-04-16 13:33:11 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 36 41 37 6d 35 2b 62 6d 6a 30 36 54 52 4e 62 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 36 34 64 39 32 62 35 62 33 34 36 35 34 36 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
          Data Ascii: BND 3 CON\WNS 0 197MS-CV: 6A7m5+bmj06TRNbE.3Context: 364d92b5b346546e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
          2024-04-16 13:33:11 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
          Data Ascii: 202 1 CON 58
          2024-04-16 13:33:11 UTC58INData Raw: 4d 53 2d 43 56 3a 20 39 6a 75 56 5a 52 4c 6c 72 45 4f 2f 46 43 6d 6a 4f 33 31 70 69 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
          Data Ascii: MS-CV: 9juVZRLlrEO/FCmjO31piA.0Payload parsing failed.


          Session IDSource IPSource PortDestination IPDestination Port
          5192.168.2.64973052.159.127.243443
          TimestampBytes transferredDirectionData
          2024-04-16 13:33:29 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 57 58 68 41 6c 63 58 66 46 45 43 51 47 53 45 48 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 37 31 31 64 38 32 62 33 65 30 33 62 32 36 64 0d 0a 0d 0a
          Data Ascii: CNT 1 CON 305MS-CV: WXhAlcXfFECQGSEH.1Context: 1711d82b3e03b26d
          2024-04-16 13:33:29 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
          Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
          2024-04-16 13:33:29 UTC1064OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 57 58 68 41 6c 63 58 66 46 45 43 51 47 53 45 48 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 37 31 31 64 38 32 62 33 65 30 33 62 32 36 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 56 53 73 34 57 76 44 52 30 44 73 41 42 5a 41 53 4f 7a 4b 32 2b 4e 55 6e 68 6c 73 54 61 31 47 76 71 4a 61 46 47 31 50 54 34 72 2b 59 39 6e 45 53 77 32 6d 4d 78 7a 4f 4c 45 32 6d 32 57 2f 57 76 70 52 32 61 46 32 4c 61 47 47 6d 34 63 46 7a 54 78 6a 2b 46 75 63 73 76 32 5a 71 51 2f 4c 69 52 70 6f 69 52 37 71 50 67 74 44 42 54
          Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: WXhAlcXfFECQGSEH.2Context: 1711d82b3e03b26d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaVSs4WvDR0DsABZASOzK2+NUnhlsTa1GvqJaFG1PT4r+Y9nESw2mMxzOLE2m2W/WvpR2aF2LaGGm4cFzTxj+Fucsv2ZqQ/LiRpoiR7qPgtDBT
          2024-04-16 13:33:29 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 57 58 68 41 6c 63 58 66 46 45 43 51 47 53 45 48 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 37 31 31 64 38 32 62 33 65 30 33 62 32 36 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
          Data Ascii: BND 3 CON\WNS 0 197MS-CV: WXhAlcXfFECQGSEH.3Context: 1711d82b3e03b26d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
          2024-04-16 13:33:29 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
          Data Ascii: 202 1 CON 58
          2024-04-16 13:33:29 UTC58INData Raw: 4d 53 2d 43 56 3a 20 70 4c 63 65 79 48 52 52 4a 45 53 52 75 6f 6b 59 57 32 64 71 7a 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
          Data Ascii: MS-CV: pLceyHRRJESRuokYW2dqzg.0Payload parsing failed.


          Session IDSource IPSource PortDestination IPDestination Port
          6192.168.2.64973452.159.127.243443
          TimestampBytes transferredDirectionData
          2024-04-16 13:33:51 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4b 72 34 6a 2b 6f 6b 78 59 6b 57 34 31 4f 49 6a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 61 32 32 30 33 39 35 65 32 63 39 65 65 39 35 0d 0a 0d 0a
          Data Ascii: CNT 1 CON 305MS-CV: Kr4j+okxYkW41OIj.1Context: ca220395e2c9ee95
          2024-04-16 13:33:51 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
          Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
          2024-04-16 13:33:51 UTC1064OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 4b 72 34 6a 2b 6f 6b 78 59 6b 57 34 31 4f 49 6a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 61 32 32 30 33 39 35 65 32 63 39 65 65 39 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 56 53 73 34 57 76 44 52 30 44 73 41 42 5a 41 53 4f 7a 4b 32 2b 4e 55 6e 68 6c 73 54 61 31 47 76 71 4a 61 46 47 31 50 54 34 72 2b 59 39 6e 45 53 77 32 6d 4d 78 7a 4f 4c 45 32 6d 32 57 2f 57 76 70 52 32 61 46 32 4c 61 47 47 6d 34 63 46 7a 54 78 6a 2b 46 75 63 73 76 32 5a 71 51 2f 4c 69 52 70 6f 69 52 37 71 50 67 74 44 42 54
          Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: Kr4j+okxYkW41OIj.2Context: ca220395e2c9ee95<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaVSs4WvDR0DsABZASOzK2+NUnhlsTa1GvqJaFG1PT4r+Y9nESw2mMxzOLE2m2W/WvpR2aF2LaGGm4cFzTxj+Fucsv2ZqQ/LiRpoiR7qPgtDBT
          2024-04-16 13:33:51 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4b 72 34 6a 2b 6f 6b 78 59 6b 57 34 31 4f 49 6a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 61 32 32 30 33 39 35 65 32 63 39 65 65 39 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
          Data Ascii: BND 3 CON\WNS 0 197MS-CV: Kr4j+okxYkW41OIj.3Context: ca220395e2c9ee95<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
          2024-04-16 13:33:51 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
          Data Ascii: 202 1 CON 58
          2024-04-16 13:33:51 UTC58INData Raw: 4d 53 2d 43 56 3a 20 36 52 46 43 7a 55 62 36 45 6b 53 6b 58 45 57 44 73 68 6c 34 41 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
          Data Ascii: MS-CV: 6RFCzUb6EkSkXEWDshl4AQ.0Payload parsing failed.


          Statistics

          CPU Usage

          Click to jump to process

          Memory Usage

          Click to jump to process

          Behavior

          Click to jump to process

          System Behavior

          General

          Target ID:0
          Start time:15:32:42
          Start date:16/04/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
          Imagebase:0x7ff684c40000
          File size:3'242'272 bytes
          MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:false

          General

          Target ID:2
          Start time:15:32:45
          Start date:16/04/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2208,i,7639646435292787510,15926903096463883303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
          Imagebase:0x7ff684c40000
          File size:3'242'272 bytes
          MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:false

          General

          Target ID:3
          Start time:15:32:48
          Start date:16/04/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://10.00.56.00&d=DwQFaQ"
          Imagebase:0x7ff684c40000
          File size:3'242'272 bytes
          MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:true

          Disassembly

          ⊘No disassembly