Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://ds5l29de4j.virtualbotz.com/dyvacwws/Ridgelineintl/YWJ1c2VAcmlkZ2VsaW5laW50bC5jb20=

Overview

General Information

Sample URL:https://ds5l29de4j.virtualbotz.com/dyvacwws/Ridgelineintl/YWJ1c2VAcmlkZ2VsaW5laW50bC5jb20=
Analysis ID:1432332
Infos:
Errors
  • URL not reachable

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

No high impact signatures.

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 6768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2044,i,17354197381780509115,3202688687647469358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • chrome.exe (PID: 4304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ds5l29de4j.virtualbotz.com/dyvacwws/Ridgelineintl/YWJ1c2VAcmlkZ2VsaW5laW50bC5jb20=" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownHTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknownTCP traffic detected without corresponding DNS query: 52.159.126.152
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficDNS traffic detected: DNS query: ds5l29de4j.virtualbotz.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownHTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: classification engineClassification label: unknown0.win@18/0@4/4
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2044,i,17354197381780509115,3202688687647469358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ds5l29de4j.virtualbotz.com/dyvacwws/Ridgelineintl/YWJ1c2VAcmlkZ2VsaW5laW50bC5jb20="
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2044,i,17354197381780509115,3202688687647469358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://ds5l29de4j.virtualbotz.com/dyvacwws/Ridgelineintl/YWJ1c2VAcmlkZ2VsaW5laW50bC5jb20=0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.214.172
truefalse
    		unknown
    ds5l29de4j.virtualbotz.com
    		192.185.148.151
    		truefalse
      		unknown
      www.google.com
      		142.251.35.228
      		truefalse
        		high
        fp2e7a.wpc.phicdn.net
        		192.229.211.108
        		truefalse
          		unknown

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          239.255.255.250
          		unknownReserved
          		unknownunknownfalse
          192.185.148.151
          		ds5l29de4j.virtualbotz.comUnited States
          		46606UNIFIEDLAYER-AS-1USfalse
          142.251.35.228
          		www.google.comUnited States
          		15169GOOGLEUSfalse

          Private

          IP
          192.168.2.6

          General Information

          Joe Sandbox version:40.0.0 Tourmaline
          Analysis ID:1432332
          Start date and time:2024-04-26 21:34:10 +02:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:0h 2m 43s
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:browseurl.jbs
          Sample URL:https://ds5l29de4j.virtualbotz.com/dyvacwws/Ridgelineintl/YWJ1c2VAcmlkZ2VsaW5laW50bC5jb20=
          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
          Number of analysed new started processes analysed:8
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Detection:UNKNOWN
          Classification:unknown0.win@18/0@4/4
          EGA Information:Failed
          HCA Information:
          • Successful, ratio: 100%
          • Number of executed functions: 0
          • Number of non-executed functions: 0
          Cookbook Comments:
          • URL browsing timeout or error

          Errors

          • URL not reachable

          Warnings

          • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
          • Excluded IPs from analysis (whitelisted): 142.250.217.195, 142.251.162.84, 142.250.217.174, 34.104.35.123, 40.127.169.103, 192.229.211.108, 199.232.214.172, 20.3.187.198, 23.45.182.73, 23.45.182.70, 23.45.182.107, 23.45.182.104, 23.45.182.100, 20.242.39.171, 172.217.3.67
          • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, clients.l.google.com, www.gstatic.com, glb.sls.prod.dcat.dsp.trafficmanager.net
          • Not all processes where analyzed, report is missing behavior information
          • Report size getting too big, too many NtSetInformationFile calls found.
          • VT rate limit hit for: https://ds5l29de4j.virtualbotz.com/dyvacwws/Ridgelineintl/YWJ1c2VAcmlkZ2VsaW5laW50bC5jb20=

          Simulations

          Behavior and APIs

          ⊘No simulations

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          ⊘No context

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          ⊘No static file info

          Network Behavior

          Network Port Distribution

          TCP Packets

          TimestampSource PortDest PortSource IPDest IP
          Apr 26, 2024 21:35:06.357242107 CEST49673443192.168.2.6173.222.162.64
          Apr 26, 2024 21:35:06.357594013 CEST49674443192.168.2.6173.222.162.64
          Apr 26, 2024 21:35:06.669760942 CEST49672443192.168.2.6173.222.162.64
          Apr 26, 2024 21:35:13.076131105 CEST49710443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:13.076179028 CEST4434971052.159.126.152192.168.2.6
          Apr 26, 2024 21:35:13.076246977 CEST49710443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:13.076908112 CEST49710443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:13.076924086 CEST4434971052.159.126.152192.168.2.6
          Apr 26, 2024 21:35:13.558399916 CEST4434971052.159.126.152192.168.2.6
          Apr 26, 2024 21:35:13.558516026 CEST49710443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:13.609961033 CEST49710443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:13.609987020 CEST4434971052.159.126.152192.168.2.6
          Apr 26, 2024 21:35:13.610377073 CEST4434971052.159.126.152192.168.2.6
          Apr 26, 2024 21:35:13.680293083 CEST49710443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:13.680355072 CEST49710443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:13.680365086 CEST4434971052.159.126.152192.168.2.6
          Apr 26, 2024 21:35:13.680480003 CEST49710443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:13.724131107 CEST4434971052.159.126.152192.168.2.6
          Apr 26, 2024 21:35:13.838454962 CEST4434971052.159.126.152192.168.2.6
          Apr 26, 2024 21:35:13.838547945 CEST4434971052.159.126.152192.168.2.6
          Apr 26, 2024 21:35:13.838601112 CEST49710443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:13.838912010 CEST49710443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:13.838932037 CEST4434971052.159.126.152192.168.2.6
          Apr 26, 2024 21:35:15.964546919 CEST49673443192.168.2.6173.222.162.64
          Apr 26, 2024 21:35:16.042668104 CEST49674443192.168.2.6173.222.162.64
          Apr 26, 2024 21:35:16.339569092 CEST49672443192.168.2.6173.222.162.64
          Apr 26, 2024 21:35:16.791692019 CEST49717443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:16.791728973 CEST44349717192.185.148.151192.168.2.6
          Apr 26, 2024 21:35:16.791773081 CEST49718443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:16.791831970 CEST49717443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:16.791841030 CEST44349718192.185.148.151192.168.2.6
          Apr 26, 2024 21:35:16.791893005 CEST49718443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:16.792118073 CEST49717443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:16.792135000 CEST44349717192.185.148.151192.168.2.6
          Apr 26, 2024 21:35:16.792313099 CEST49718443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:16.792326927 CEST44349718192.185.148.151192.168.2.6
          Apr 26, 2024 21:35:17.917591095 CEST44349705173.222.162.64192.168.2.6
          Apr 26, 2024 21:35:17.917695045 CEST49705443192.168.2.6173.222.162.64
          Apr 26, 2024 21:35:18.173456907 CEST49720443192.168.2.6142.251.35.228
          Apr 26, 2024 21:35:18.173516035 CEST44349720142.251.35.228192.168.2.6
          Apr 26, 2024 21:35:18.173578978 CEST49720443192.168.2.6142.251.35.228
          Apr 26, 2024 21:35:18.173881054 CEST49720443192.168.2.6142.251.35.228
          Apr 26, 2024 21:35:18.173901081 CEST44349720142.251.35.228192.168.2.6
          Apr 26, 2024 21:35:18.571075916 CEST44349720142.251.35.228192.168.2.6
          Apr 26, 2024 21:35:18.571563959 CEST49720443192.168.2.6142.251.35.228
          Apr 26, 2024 21:35:18.571594954 CEST44349720142.251.35.228192.168.2.6
          Apr 26, 2024 21:35:18.574531078 CEST44349720142.251.35.228192.168.2.6
          Apr 26, 2024 21:35:18.574592113 CEST49720443192.168.2.6142.251.35.228
          Apr 26, 2024 21:35:18.613918066 CEST49721443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:18.613955021 CEST4434972123.204.76.112192.168.2.6
          Apr 26, 2024 21:35:18.614036083 CEST49721443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:18.615966082 CEST49721443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:18.615979910 CEST4434972123.204.76.112192.168.2.6
          Apr 26, 2024 21:35:18.692852974 CEST49720443192.168.2.6142.251.35.228
          Apr 26, 2024 21:35:18.693062067 CEST44349720142.251.35.228192.168.2.6
          Apr 26, 2024 21:35:18.737968922 CEST49720443192.168.2.6142.251.35.228
          Apr 26, 2024 21:35:18.738018990 CEST44349720142.251.35.228192.168.2.6
          Apr 26, 2024 21:35:18.778948069 CEST49720443192.168.2.6142.251.35.228
          Apr 26, 2024 21:35:18.875863075 CEST4434972123.204.76.112192.168.2.6
          Apr 26, 2024 21:35:18.876121998 CEST49721443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:20.759994030 CEST49721443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:20.760023117 CEST4434972123.204.76.112192.168.2.6
          Apr 26, 2024 21:35:20.760427952 CEST4434972123.204.76.112192.168.2.6
          Apr 26, 2024 21:35:20.827028990 CEST49721443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:21.118879080 CEST49721443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:21.160161018 CEST4434972123.204.76.112192.168.2.6
          Apr 26, 2024 21:35:21.244271040 CEST4434972123.204.76.112192.168.2.6
          Apr 26, 2024 21:35:21.244380951 CEST4434972123.204.76.112192.168.2.6
          Apr 26, 2024 21:35:21.244426012 CEST49721443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:21.244589090 CEST49721443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:21.244615078 CEST4434972123.204.76.112192.168.2.6
          Apr 26, 2024 21:35:21.344988108 CEST49722443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:21.345020056 CEST4434972223.204.76.112192.168.2.6
          Apr 26, 2024 21:35:21.345086098 CEST49722443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:21.346036911 CEST49722443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:21.346050024 CEST4434972223.204.76.112192.168.2.6
          Apr 26, 2024 21:35:21.600879908 CEST4434972223.204.76.112192.168.2.6
          Apr 26, 2024 21:35:21.600946903 CEST49722443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:22.150612116 CEST49722443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:22.150625944 CEST4434972223.204.76.112192.168.2.6
          Apr 26, 2024 21:35:22.150988102 CEST4434972223.204.76.112192.168.2.6
          Apr 26, 2024 21:35:22.160270929 CEST49722443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:22.208121061 CEST4434972223.204.76.112192.168.2.6
          Apr 26, 2024 21:35:22.288005114 CEST4434972223.204.76.112192.168.2.6
          Apr 26, 2024 21:35:22.288392067 CEST4434972223.204.76.112192.168.2.6
          Apr 26, 2024 21:35:22.288544893 CEST49722443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:22.302710056 CEST49722443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:22.302710056 CEST49722443192.168.2.623.204.76.112
          Apr 26, 2024 21:35:22.302722931 CEST4434972223.204.76.112192.168.2.6
          Apr 26, 2024 21:35:22.302731037 CEST4434972223.204.76.112192.168.2.6
          Apr 26, 2024 21:35:24.025234938 CEST49723443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:24.025288105 CEST4434972352.159.126.152192.168.2.6
          Apr 26, 2024 21:35:24.025341988 CEST49723443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:24.026351929 CEST49723443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:24.026364088 CEST4434972352.159.126.152192.168.2.6
          Apr 26, 2024 21:35:24.514329910 CEST4434972352.159.126.152192.168.2.6
          Apr 26, 2024 21:35:24.514410019 CEST49723443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:24.522600889 CEST49723443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:24.522629023 CEST4434972352.159.126.152192.168.2.6
          Apr 26, 2024 21:35:24.522931099 CEST4434972352.159.126.152192.168.2.6
          Apr 26, 2024 21:35:24.527817965 CEST49723443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:24.528179884 CEST49723443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:24.528191090 CEST4434972352.159.126.152192.168.2.6
          Apr 26, 2024 21:35:24.532635927 CEST49723443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:24.580131054 CEST4434972352.159.126.152192.168.2.6
          Apr 26, 2024 21:35:24.688404083 CEST4434972352.159.126.152192.168.2.6
          Apr 26, 2024 21:35:24.688498974 CEST4434972352.159.126.152192.168.2.6
          Apr 26, 2024 21:35:24.688576937 CEST49723443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:24.710515022 CEST49723443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:24.710536957 CEST4434972352.159.126.152192.168.2.6
          Apr 26, 2024 21:35:28.555267096 CEST44349720142.251.35.228192.168.2.6
          Apr 26, 2024 21:35:28.555347919 CEST44349720142.251.35.228192.168.2.6
          Apr 26, 2024 21:35:28.555469990 CEST49720443192.168.2.6142.251.35.228
          Apr 26, 2024 21:35:30.037832975 CEST49720443192.168.2.6142.251.35.228
          Apr 26, 2024 21:35:30.037897110 CEST44349720142.251.35.228192.168.2.6
          Apr 26, 2024 21:35:34.460680962 CEST49728443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:34.460704088 CEST4434972852.159.126.152192.168.2.6
          Apr 26, 2024 21:35:34.460855961 CEST49728443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:34.461654902 CEST49728443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:34.461668015 CEST4434972852.159.126.152192.168.2.6
          Apr 26, 2024 21:35:34.938802004 CEST4434972852.159.126.152192.168.2.6
          Apr 26, 2024 21:35:34.938919067 CEST49728443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:34.954721928 CEST49728443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:34.954744101 CEST4434972852.159.126.152192.168.2.6
          Apr 26, 2024 21:35:34.955097914 CEST4434972852.159.126.152192.168.2.6
          Apr 26, 2024 21:35:34.958194017 CEST49728443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:34.958259106 CEST49728443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:34.958266020 CEST4434972852.159.126.152192.168.2.6
          Apr 26, 2024 21:35:34.958600998 CEST49728443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:35.000119925 CEST4434972852.159.126.152192.168.2.6
          Apr 26, 2024 21:35:35.114981890 CEST4434972852.159.126.152192.168.2.6
          Apr 26, 2024 21:35:35.115089893 CEST4434972852.159.126.152192.168.2.6
          Apr 26, 2024 21:35:35.115530014 CEST49728443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:35.198522091 CEST49728443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:35.198546886 CEST4434972852.159.126.152192.168.2.6
          Apr 26, 2024 21:35:45.444315910 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:45.444354057 CEST4434972952.159.126.152192.168.2.6
          Apr 26, 2024 21:35:45.444436073 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:45.445008039 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:45.445024014 CEST4434972952.159.126.152192.168.2.6
          Apr 26, 2024 21:35:45.934009075 CEST4434972952.159.126.152192.168.2.6
          Apr 26, 2024 21:35:45.934123039 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:45.935976982 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:45.936011076 CEST4434972952.159.126.152192.168.2.6
          Apr 26, 2024 21:35:45.936441898 CEST4434972952.159.126.152192.168.2.6
          Apr 26, 2024 21:35:45.938380003 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:45.938456059 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:45.938484907 CEST4434972952.159.126.152192.168.2.6
          Apr 26, 2024 21:35:45.938565016 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:45.980125904 CEST4434972952.159.126.152192.168.2.6
          Apr 26, 2024 21:35:46.096690893 CEST4434972952.159.126.152192.168.2.6
          Apr 26, 2024 21:35:46.096916914 CEST4434972952.159.126.152192.168.2.6
          Apr 26, 2024 21:35:46.096995115 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:46.097788095 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:46.097809076 CEST4434972952.159.126.152192.168.2.6
          Apr 26, 2024 21:35:46.097835064 CEST49729443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:46.795325994 CEST49717443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:46.795427084 CEST49718443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:46.836160898 CEST44349718192.185.148.151192.168.2.6
          Apr 26, 2024 21:35:46.840116978 CEST44349717192.185.148.151192.168.2.6
          Apr 26, 2024 21:35:49.179286957 CEST49732443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:49.179389954 CEST44349732192.185.148.151192.168.2.6
          Apr 26, 2024 21:35:49.179428101 CEST49733443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:49.179456949 CEST44349733192.185.148.151192.168.2.6
          Apr 26, 2024 21:35:49.179541111 CEST49732443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:49.179838896 CEST49733443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:49.179847002 CEST49732443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:49.179896116 CEST44349732192.185.148.151192.168.2.6
          Apr 26, 2024 21:35:49.179977894 CEST49733443192.168.2.6192.185.148.151
          Apr 26, 2024 21:35:49.179990053 CEST44349733192.185.148.151192.168.2.6
          Apr 26, 2024 21:35:57.784444094 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:57.784487963 CEST4434973452.159.126.152192.168.2.6
          Apr 26, 2024 21:35:57.784626961 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:57.785301924 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:57.785331964 CEST4434973452.159.126.152192.168.2.6
          Apr 26, 2024 21:35:58.277425051 CEST4434973452.159.126.152192.168.2.6
          Apr 26, 2024 21:35:58.277581930 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:58.280040026 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:58.280061007 CEST4434973452.159.126.152192.168.2.6
          Apr 26, 2024 21:35:58.280970097 CEST4434973452.159.126.152192.168.2.6
          Apr 26, 2024 21:35:58.282911062 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:58.283027887 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:58.283036947 CEST4434973452.159.126.152192.168.2.6
          Apr 26, 2024 21:35:58.283261061 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:58.324167967 CEST4434973452.159.126.152192.168.2.6
          Apr 26, 2024 21:35:58.439016104 CEST4434973452.159.126.152192.168.2.6
          Apr 26, 2024 21:35:58.439233065 CEST4434973452.159.126.152192.168.2.6
          Apr 26, 2024 21:35:58.439462900 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:58.439552069 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:58.439552069 CEST49734443192.168.2.652.159.126.152
          Apr 26, 2024 21:35:58.439574957 CEST4434973452.159.126.152192.168.2.6

          UDP Packets

          TimestampSource PortDest PortSource IPDest IP
          Apr 26, 2024 21:35:13.907968044 CEST53501351.1.1.1192.168.2.6
          Apr 26, 2024 21:35:13.913742065 CEST53588451.1.1.1192.168.2.6
          Apr 26, 2024 21:35:14.769165039 CEST53600471.1.1.1192.168.2.6
          Apr 26, 2024 21:35:16.489001036 CEST4993253192.168.2.61.1.1.1
          Apr 26, 2024 21:35:16.489399910 CEST5054653192.168.2.61.1.1.1
          Apr 26, 2024 21:35:16.647531033 CEST53499321.1.1.1192.168.2.6
          Apr 26, 2024 21:35:16.715435028 CEST53505461.1.1.1192.168.2.6
          Apr 26, 2024 21:35:18.041666985 CEST6283853192.168.2.61.1.1.1
          Apr 26, 2024 21:35:18.042464972 CEST5207453192.168.2.61.1.1.1
          Apr 26, 2024 21:35:18.168520927 CEST53628381.1.1.1192.168.2.6
          Apr 26, 2024 21:35:18.169027090 CEST53520741.1.1.1192.168.2.6
          Apr 26, 2024 21:35:34.311410904 CEST53540391.1.1.1192.168.2.6
          Apr 26, 2024 21:35:46.560415030 CEST53540221.1.1.1192.168.2.6
          Apr 26, 2024 21:35:53.457274914 CEST53621251.1.1.1192.168.2.6

          DNS Queries

          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Apr 26, 2024 21:35:16.489001036 CEST192.168.2.61.1.1.10x8df2Standard query (0)ds5l29de4j.virtualbotz.comA (IP address)IN (0x0001)false
          Apr 26, 2024 21:35:16.489399910 CEST192.168.2.61.1.1.10x3b5dStandard query (0)ds5l29de4j.virtualbotz.com65IN (0x0001)false
          Apr 26, 2024 21:35:18.041666985 CEST192.168.2.61.1.1.10xd48cStandard query (0)www.google.comA (IP address)IN (0x0001)false
          Apr 26, 2024 21:35:18.042464972 CEST192.168.2.61.1.1.10x230cStandard query (0)www.google.com65IN (0x0001)false

          DNS Answers

          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Apr 26, 2024 21:35:16.647531033 CEST1.1.1.1192.168.2.60x8df2No error (0)ds5l29de4j.virtualbotz.com192.185.148.151A (IP address)IN (0x0001)false
          Apr 26, 2024 21:35:18.168520927 CEST1.1.1.1192.168.2.60xd48cNo error (0)www.google.com142.251.35.228A (IP address)IN (0x0001)false
          Apr 26, 2024 21:35:18.169027090 CEST1.1.1.1192.168.2.60x230cNo error (0)www.google.com65IN (0x0001)false
          Apr 26, 2024 21:35:27.162821054 CEST1.1.1.1192.168.2.60xd0b2No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
          Apr 26, 2024 21:35:27.162821054 CEST1.1.1.1192.168.2.60xd0b2No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
          Apr 26, 2024 21:35:28.133021116 CEST1.1.1.1192.168.2.60x2c1dNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
          Apr 26, 2024 21:35:28.133021116 CEST1.1.1.1192.168.2.60x2c1dNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false

          HTTP Request Dependency Graph

          • fs.microsoft.com

          HTTPS Proxied Packets

          Session IDSource IPSource PortDestination IPDestination Port
          0192.168.2.64971052.159.126.152443
          TimestampBytes transferredDirectionData
          2024-04-26 19:35:13 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 46 4a 2b 31 74 71 65 73 4a 55 43 41 34 42 73 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 35 38 62 35 62 39 66 38 38 31 34 66 66 36 0d 0a 0d 0a
          Data Ascii: CNT 1 CON 305MS-CV: FJ+1tqesJUCA4BsJ.1Context: 3158b5b9f8814ff6
          2024-04-26 19:35:13 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
          Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
          2024-04-26 19:35:13 UTC1076OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 46 4a 2b 31 74 71 65 73 4a 55 43 41 34 42 73 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 35 38 62 35 62 39 66 38 38 31 34 66 66 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 64 46 56 62 59 77 58 67 74 42 56 46 63 61 46 30 79 41 50 2b 69 62 4c 78 34 51 78 34 69 47 63 6e 59 33 5a 6f 66 4c 4f 65 75 69 49 2b 4c 75 6a 39 72 4c 72 36 63 2f 36 73 48 5a 6c 4b 49 70 6a 38 4c 48 74 54 50 51 67 56 59 41 75 72 6f 5a 57 46 7a 4f 76 41 6a 68 69 72 61 46 6d 42 5a 4f 47 59 49 65 5a 39 6c 44 6f 44 55 73 33
          Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: FJ+1tqesJUCA4BsJ.2Context: 3158b5b9f8814ff6<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8dFVbYwXgtBVFcaF0yAP+ibLx4Qx4iGcnY3ZofLOeuiI+Luj9rLr6c/6sHZlKIpj8LHtTPQgVYAuroZWFzOvAjhiraFmBZOGYIeZ9lDoDUs3
          2024-04-26 19:35:13 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 46 4a 2b 31 74 71 65 73 4a 55 43 41 34 42 73 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 35 38 62 35 62 39 66 38 38 31 34 66 66 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
          Data Ascii: BND 3 CON\WNS 0 197MS-CV: FJ+1tqesJUCA4BsJ.3Context: 3158b5b9f8814ff6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
          2024-04-26 19:35:13 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
          Data Ascii: 202 1 CON 58
          2024-04-26 19:35:13 UTC58INData Raw: 4d 53 2d 43 56 3a 20 71 6b 50 74 5a 48 65 75 4a 30 75 79 51 6f 35 6d 47 67 63 41 44 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
          Data Ascii: MS-CV: qkPtZHeuJ0uyQo5mGgcADg.0Payload parsing failed.


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          1192.168.2.64972123.204.76.112443
          TimestampBytes transferredDirectionData
          2024-04-26 19:35:21 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          Accept-Encoding: identity
          User-Agent: Microsoft BITS/7.8
          Host: fs.microsoft.com
          2024-04-26 19:35:21 UTC466INHTTP/1.1 200 OK
          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
          Content-Type: application/octet-stream
          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
          Server: ECAcc (chd/0758)
          X-CID: 11
          X-Ms-ApiVersion: Distribute 1.2
          X-Ms-Region: prod-eus-z1
          Cache-Control: public, max-age=41304
          Date: Fri, 26 Apr 2024 19:35:21 GMT
          Connection: close
          X-CID: 2


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          2192.168.2.64972223.204.76.112443
          TimestampBytes transferredDirectionData
          2024-04-26 19:35:22 UTC239OUTGET /fs/windows/config.json HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          Accept-Encoding: identity
          If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
          Range: bytes=0-2147483646
          User-Agent: Microsoft BITS/7.8
          Host: fs.microsoft.com
          2024-04-26 19:35:22 UTC530INHTTP/1.1 200 OK
          Content-Type: application/octet-stream
          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
          ApiVersion: Distribute 1.1
          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
          X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm
          Cache-Control: public, max-age=41297
          Date: Fri, 26 Apr 2024 19:35:22 GMT
          Content-Length: 55
          Connection: close
          X-CID: 2
          2024-04-26 19:35:22 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
          Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


          Session IDSource IPSource PortDestination IPDestination Port
          3192.168.2.64972352.159.126.152443
          TimestampBytes transferredDirectionData
          2024-04-26 19:35:24 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 75 71 4e 57 49 33 51 6d 30 36 71 62 55 31 4c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 37 63 32 61 38 39 30 63 35 31 66 38 62 35 0d 0a 0d 0a
          Data Ascii: CNT 1 CON 305MS-CV: 6uqNWI3Qm06qbU1L.1Context: 6a7c2a890c51f8b5
          2024-04-26 19:35:24 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
          Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
          2024-04-26 19:35:24 UTC1076OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 36 75 71 4e 57 49 33 51 6d 30 36 71 62 55 31 4c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 37 63 32 61 38 39 30 63 35 31 66 38 62 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 64 46 56 62 59 77 58 67 74 42 56 46 63 61 46 30 79 41 50 2b 69 62 4c 78 34 51 78 34 69 47 63 6e 59 33 5a 6f 66 4c 4f 65 75 69 49 2b 4c 75 6a 39 72 4c 72 36 63 2f 36 73 48 5a 6c 4b 49 70 6a 38 4c 48 74 54 50 51 67 56 59 41 75 72 6f 5a 57 46 7a 4f 76 41 6a 68 69 72 61 46 6d 42 5a 4f 47 59 49 65 5a 39 6c 44 6f 44 55 73 33
          Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: 6uqNWI3Qm06qbU1L.2Context: 6a7c2a890c51f8b5<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8dFVbYwXgtBVFcaF0yAP+ibLx4Qx4iGcnY3ZofLOeuiI+Luj9rLr6c/6sHZlKIpj8LHtTPQgVYAuroZWFzOvAjhiraFmBZOGYIeZ9lDoDUs3
          2024-04-26 19:35:24 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 36 75 71 4e 57 49 33 51 6d 30 36 71 62 55 31 4c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 37 63 32 61 38 39 30 63 35 31 66 38 62 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
          Data Ascii: BND 3 CON\WNS 0 197MS-CV: 6uqNWI3Qm06qbU1L.3Context: 6a7c2a890c51f8b5<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
          2024-04-26 19:35:24 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
          Data Ascii: 202 1 CON 58
          2024-04-26 19:35:24 UTC58INData Raw: 4d 53 2d 43 56 3a 20 4b 2b 41 36 72 77 79 59 43 6b 2b 70 65 55 56 5a 57 59 36 50 43 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
          Data Ascii: MS-CV: K+A6rwyYCk+peUVZWY6PCA.0Payload parsing failed.


          Session IDSource IPSource PortDestination IPDestination Port
          4192.168.2.64972852.159.126.152443
          TimestampBytes transferredDirectionData
          2024-04-26 19:35:34 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 32 4c 51 77 61 59 6d 65 50 45 32 42 73 54 69 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 62 31 61 37 62 66 64 61 37 63 30 32 34 38 38 0d 0a 0d 0a
          Data Ascii: CNT 1 CON 305MS-CV: 2LQwaYmePE2BsTiA.1Context: 3b1a7bfda7c02488
          2024-04-26 19:35:34 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
          Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
          2024-04-26 19:35:34 UTC1076OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 32 4c 51 77 61 59 6d 65 50 45 32 42 73 54 69 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 62 31 61 37 62 66 64 61 37 63 30 32 34 38 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 64 46 56 62 59 77 58 67 74 42 56 46 63 61 46 30 79 41 50 2b 69 62 4c 78 34 51 78 34 69 47 63 6e 59 33 5a 6f 66 4c 4f 65 75 69 49 2b 4c 75 6a 39 72 4c 72 36 63 2f 36 73 48 5a 6c 4b 49 70 6a 38 4c 48 74 54 50 51 67 56 59 41 75 72 6f 5a 57 46 7a 4f 76 41 6a 68 69 72 61 46 6d 42 5a 4f 47 59 49 65 5a 39 6c 44 6f 44 55 73 33
          Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: 2LQwaYmePE2BsTiA.2Context: 3b1a7bfda7c02488<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8dFVbYwXgtBVFcaF0yAP+ibLx4Qx4iGcnY3ZofLOeuiI+Luj9rLr6c/6sHZlKIpj8LHtTPQgVYAuroZWFzOvAjhiraFmBZOGYIeZ9lDoDUs3
          2024-04-26 19:35:34 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 32 4c 51 77 61 59 6d 65 50 45 32 42 73 54 69 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 62 31 61 37 62 66 64 61 37 63 30 32 34 38 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
          Data Ascii: BND 3 CON\WNS 0 197MS-CV: 2LQwaYmePE2BsTiA.3Context: 3b1a7bfda7c02488<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
          2024-04-26 19:35:35 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
          Data Ascii: 202 1 CON 58
          2024-04-26 19:35:35 UTC58INData Raw: 4d 53 2d 43 56 3a 20 32 61 48 73 5a 79 70 6e 39 6b 53 4b 6e 48 37 2b 6e 54 4d 4d 42 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
          Data Ascii: MS-CV: 2aHsZypn9kSKnH7+nTMMBQ.0Payload parsing failed.


          Session IDSource IPSource PortDestination IPDestination Port
          5192.168.2.64972952.159.126.152443
          TimestampBytes transferredDirectionData
          2024-04-26 19:35:45 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 63 64 50 54 2b 70 42 79 41 6b 43 4c 74 46 7a 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 66 62 65 34 62 61 34 31 30 63 66 35 34 36 0d 0a 0d 0a
          Data Ascii: CNT 1 CON 305MS-CV: cdPT+pByAkCLtFzA.1Context: 7ffbe4ba410cf546
          2024-04-26 19:35:45 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
          Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
          2024-04-26 19:35:45 UTC1076OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 63 64 50 54 2b 70 42 79 41 6b 43 4c 74 46 7a 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 66 62 65 34 62 61 34 31 30 63 66 35 34 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 64 46 56 62 59 77 58 67 74 42 56 46 63 61 46 30 79 41 50 2b 69 62 4c 78 34 51 78 34 69 47 63 6e 59 33 5a 6f 66 4c 4f 65 75 69 49 2b 4c 75 6a 39 72 4c 72 36 63 2f 36 73 48 5a 6c 4b 49 70 6a 38 4c 48 74 54 50 51 67 56 59 41 75 72 6f 5a 57 46 7a 4f 76 41 6a 68 69 72 61 46 6d 42 5a 4f 47 59 49 65 5a 39 6c 44 6f 44 55 73 33
          Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: cdPT+pByAkCLtFzA.2Context: 7ffbe4ba410cf546<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8dFVbYwXgtBVFcaF0yAP+ibLx4Qx4iGcnY3ZofLOeuiI+Luj9rLr6c/6sHZlKIpj8LHtTPQgVYAuroZWFzOvAjhiraFmBZOGYIeZ9lDoDUs3
          2024-04-26 19:35:45 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 63 64 50 54 2b 70 42 79 41 6b 43 4c 74 46 7a 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 66 62 65 34 62 61 34 31 30 63 66 35 34 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
          Data Ascii: BND 3 CON\WNS 0 197MS-CV: cdPT+pByAkCLtFzA.3Context: 7ffbe4ba410cf546<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
          2024-04-26 19:35:46 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
          Data Ascii: 202 1 CON 58
          2024-04-26 19:35:46 UTC58INData Raw: 4d 53 2d 43 56 3a 20 31 71 63 66 52 62 5a 49 61 55 2b 79 58 77 4e 58 54 72 66 41 77 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
          Data Ascii: MS-CV: 1qcfRbZIaU+yXwNXTrfAww.0Payload parsing failed.


          Session IDSource IPSource PortDestination IPDestination Port
          6192.168.2.64973452.159.126.152443
          TimestampBytes transferredDirectionData
          2024-04-26 19:35:58 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 33 49 30 67 71 74 6f 71 6b 65 35 59 32 2f 47 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 66 66 37 32 34 32 34 30 30 38 30 31 38 39 0d 0a 0d 0a
          Data Ascii: CNT 1 CON 305MS-CV: t3I0gqtoqke5Y2/G.1Context: 65ff724240080189
          2024-04-26 19:35:58 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
          Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
          2024-04-26 19:35:58 UTC1076OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 74 33 49 30 67 71 74 6f 71 6b 65 35 59 32 2f 47 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 66 66 37 32 34 32 34 30 30 38 30 31 38 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 64 46 56 62 59 77 58 67 74 42 56 46 63 61 46 30 79 41 50 2b 69 62 4c 78 34 51 78 34 69 47 63 6e 59 33 5a 6f 66 4c 4f 65 75 69 49 2b 4c 75 6a 39 72 4c 72 36 63 2f 36 73 48 5a 6c 4b 49 70 6a 38 4c 48 74 54 50 51 67 56 59 41 75 72 6f 5a 57 46 7a 4f 76 41 6a 68 69 72 61 46 6d 42 5a 4f 47 59 49 65 5a 39 6c 44 6f 44 55 73 33
          Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: t3I0gqtoqke5Y2/G.2Context: 65ff724240080189<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8dFVbYwXgtBVFcaF0yAP+ibLx4Qx4iGcnY3ZofLOeuiI+Luj9rLr6c/6sHZlKIpj8LHtTPQgVYAuroZWFzOvAjhiraFmBZOGYIeZ9lDoDUs3
          2024-04-26 19:35:58 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 74 33 49 30 67 71 74 6f 71 6b 65 35 59 32 2f 47 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 66 66 37 32 34 32 34 30 30 38 30 31 38 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
          Data Ascii: BND 3 CON\WNS 0 197MS-CV: t3I0gqtoqke5Y2/G.3Context: 65ff724240080189<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
          2024-04-26 19:35:58 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
          Data Ascii: 202 1 CON 58
          2024-04-26 19:35:58 UTC58INData Raw: 4d 53 2d 43 56 3a 20 6d 44 78 6e 57 65 7a 73 35 30 6d 30 42 54 30 71 4c 51 6f 33 34 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
          Data Ascii: MS-CV: mDxnWezs50m0BT0qLQo34Q.0Payload parsing failed.


          Statistics

          CPU Usage

          Click to jump to process

          Memory Usage

          Click to jump to process

          Behavior

          Click to jump to process

          System Behavior

          General

          Target ID:0
          Start time:21:35:06
          Start date:26/04/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
          Imagebase:0x7ff684c40000
          File size:3'242'272 bytes
          MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:false

          General

          Target ID:2
          Start time:21:35:11
          Start date:26/04/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2044,i,17354197381780509115,3202688687647469358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
          Imagebase:0x7ff684c40000
          File size:3'242'272 bytes
          MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:false

          General

          Target ID:3
          Start time:21:35:14
          Start date:26/04/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ds5l29de4j.virtualbotz.com/dyvacwws/Ridgelineintl/YWJ1c2VAcmlkZ2VsaW5laW50bC5jb20="
          Imagebase:0x7ff684c40000
          File size:3'242'272 bytes
          MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:true

          Disassembly

          ⊘No disassembly