Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ref#298409_bill_attached_.htm

Overview

General Information

Sample Name:ref#298409_bill_attached_.htm
Analysis ID:854623
MD5:81a2ef8b6871250d3c35aa694eef684e
SHA1:3a3b177e92e7c8802619125e96c341ed4f084466
SHA256:8c05086b1d23c33390b51616b738aaa3153143cbbb3a63deafd6724167b1ab77
Infos:

Detection

Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for domain / URL
Antivirus detection for URL or domain
HTML page contains hidden URLs or javascript code
HTML document with suspicious title
HTML document with suspicious name
JA3 SSL client fingerprint seen in connection with other malware
IP address seen in connection with other malware
HTML page is missing a favicon
Internet Provider seen in connection with other malware

Classification

Process Tree

  • System is w10x64native
  • chrome.exe (PID: 7708 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ref#298409_bill_attached_.htm MD5: 464953824E644F10FFDC9E093FD18F94)
    • chrome.exe (PID: 8252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1696,1683236938277017309,9799927179460367727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8 MD5: 464953824E644F10FFDC9E093FD18F94)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for domain / URL
Source: lmsconline.comVirustotal: Detection: 7%Perma Link
Antivirus detection for URL or domain
Source: https://lmsconline.com/fishh/host[18]/admin/js/mp.php?ar=d29yZA==&b64e=WtZpQrRj&b64u=OcZtJBKoL&conf=CeTlZV&call=fwLrYhmAvira URL Cloud: Label: phishing

Phishing

barindex
HTML page contains hidden URLs or javascript code
Source: ref#298409_bill_attached_.htmHTTP Parser: Base64 decoded: https://lmsconline.com/fishh/host[18]/b3bd5db.php
HTML document with suspicious title
Source: file:///C:/Users/user/Desktop/ref%23298409_bill_attached_.htmTab title: ref%23298409_bill_attached_.htm
Source: ref#298409_bill_attached_.htmHTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/ref%23298409_bill_attached_.htmHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:49787 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:49618 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:60553 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:50015 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:63304 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:50028 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.19.229.151:443 -> 192.168.11.20:52802 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.19.229.151:443 -> 192.168.11.20:52803 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:61770 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:56953 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:53793 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:55005 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:57327 version: TLS 1.2
Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox ViewASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: unknownDNS traffic detected: queries for: clients2.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49618 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50015
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 56953
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 57327
Source: unknownNetwork traffic detected: HTTP traffic on port 55005 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 52803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49618
Source: unknownNetwork traffic detected: HTTP traffic on port 64478 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50028
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49698
Source: unknownNetwork traffic detected: HTTP traffic on port 56468 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 57024
Source: unknownNetwork traffic detected: HTTP traffic on port 53793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 51368 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 50015 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55005
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51368
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52532
Source: unknownNetwork traffic detected: HTTP traffic on port 52532 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60553
Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58043
Source: unknownNetwork traffic detected: HTTP traffic on port 61770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 64478
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63304
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 58043 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49698 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 60553 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 56953 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53793
Source: unknownNetwork traffic detected: HTTP traffic on port 57327 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 56468
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 56872
Source: unknownNetwork traffic detected: HTTP traffic on port 57024 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 52802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63304 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61770
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 56872 -> 443
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknownTCP traffic detected without corresponding DNS query: 40.113.103.199
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19042.1165/0?CH=685&L=en-US;en-GB&P=&PT=0x30&WUA=10.0.19041.1151&MK=To+Be+Filled+By+O.E.M.&MD=To+Be+Filled+By+O.E.M. HTTP/1.1Connection: Keep-AliveAccept: */*If-None-Match: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440"User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19042.1165/0?CH=685&L=en-US;en-GB&P=&PT=0x30&WUA=10.0.19041.1151&MK=To+Be+Filled+By+O.E.M.&MD=To+Be+Filled+By+O.E.M. HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=94.0.4606.61&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-94.0.4606.61Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /fishh/host[18]/admin/js/mp.php?ar=d29yZA==&b64e=WtZpQrRj&b64u=OcZtJBKoL&conf=CeTlZV&call=fwLrYhm HTTP/1.1Host: lmsconline.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficTCP traffic: 192.168.11.20:57715 -> 239.255.255.250:1900
Source: global trafficTCP traffic: 192.168.11.20:57715 -> 239.255.255.250:1900
Source: global trafficTCP traffic: 192.168.11.20:57715 -> 239.255.255.250:1900
Source: global trafficTCP traffic: 192.168.11.20:57715 -> 239.255.255.250:1900
Source: global trafficTCP traffic: 192.168.11.20:59517 -> 239.255.255.250:1900
Source: global trafficTCP traffic: 192.168.11.20:59517 -> 239.255.255.250:1900
Source: global trafficTCP traffic: 192.168.11.20:59517 -> 239.255.255.250:1900
Source: global trafficTCP traffic: 192.168.11.20:59517 -> 239.255.255.250:1900
Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=YES+srp.gws-20210811-0-RC2.en+FX+979
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:49787 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:49618 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:60553 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:50015 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:63304 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:50028 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.19.229.151:443 -> 192.168.11.20:52802 version: TLS 1.2
Source: unknownHTTPS traffic detected: 2.19.229.151:443 -> 192.168.11.20:52803 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:61770 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:56953 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:53793 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:55005 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.113.103.199:443 -> 192.168.11.20:57327 version: TLS 1.2

System Summary

barindex
HTML document with suspicious name
Source: Name includes: ref#298409_bill_attached_.htmInitial sample: bill
Source: classification engineClassification label: mal68.phis.winHTM@42/0@4/8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ref#298409_bill_attached_.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1696,1683236938277017309,9799927179460367727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1696,1683236938277017309,9799927179460367727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Process Injection		OS Credential Dumping1
Network Service Scanning		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
Non-Application Layer Protocol		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer1
Ingress Tool Transfer		SIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
ref#298409_bill_attached_.htm0%VirustotalBrowse
ref#298409_bill_attached_.htm0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
lmsconline.com8%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://lmsconline.com/fishh/host[18]/admin/js/mp.php?ar=d29yZA==&b64e=WtZpQrRj&b64u=OcZtJBKoL&conf=CeTlZV&call=fwLrYhm100%Avira URL Cloudphishing
https://lmsconline.com/fishh/host[18]/admin/js/mp.php?ar=d29yZA==&b64e=WtZpQrRj&b64u=OcZtJBKoL&conf=CeTlZV&call=fwLrYhm4%VirustotalBrowse

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
accounts.google.com
142.250.185.77
truefalse
    		high
    lmsconline.com
    		198.54.121.168
    		truetrueunknown
    www.google.com
    		142.250.185.228
    		truefalse
      		high
      clients.l.google.com
      		142.250.185.78
      		truefalse
        		high
        clients2.google.com
        		unknown
        		unknownfalse
          		high

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          file:///C:/Users/user/Desktop/ref%23298409_bill_attached_.htmtrue
            		low
            https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
              		high
              https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=94.0.4606.61&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1false
                		high
                https://lmsconline.com/fishh/host[18]/admin/js/mp.php?ar=d29yZA==&b64e=WtZpQrRj&b64u=OcZtJBKoL&conf=CeTlZV&call=fwLrYhmtrue
                • 4%, Virustotal, Browse
                • Avira URL Cloud: phishing
                		unknown

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                142.250.185.77
                		accounts.google.comUnited States
                		15169GOOGLEUSfalse
                142.250.185.78
                		clients.l.google.comUnited States
                		15169GOOGLEUSfalse
                142.250.185.228
                		www.google.comUnited States
                		15169GOOGLEUSfalse
                239.255.255.250
                		unknownReserved
                		unknownunknownfalse
                198.54.121.168
                		lmsconline.comUnited States
                		22612NAMECHEAP-NETUStrue

                Private

                IP
                192.168.11.1
                192.168.11.20
                127.0.0.1

                General Information

                Joe Sandbox Version:37.0.0 Beryl
                Analysis ID:854623
                Start date and time:2023-04-26 17:38:27 +02:00
                Joe Sandbox Product:CloudBasic
                Overall analysis duration:0h 9m 1s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:defaultwindowshtmlcookbook.jbs
                Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                Number of analysed new started processes analysed:12
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • HDC enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Sample file name:ref#298409_bill_attached_.htm
                Detection:MAL
                Classification:mal68.phis.winHTM@42/0@4/8
                EGA Information:Failed
                HDC Information:Failed
                HCA Information:
                • Successful, ratio: 100%
                • Number of executed functions: 0
                • Number of non-executed functions: 0
                Cookbook Comments:
                • Found application associated with file extension: .htm

                Warnings

                • Exclude process from analysis (whitelisted): CompPkgSrv.exe, WMIADAP.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
                • Excluded IPs from analysis (whitelisted): 20.190.159.71, 20.190.159.73, 40.126.31.73, 20.190.159.64, 20.190.159.23, 40.126.31.67, 20.190.159.75, 20.190.159.4, 51.124.57.242, 20.82.207.122, 142.250.185.67, 34.104.35.123, 216.58.212.138, 142.250.185.202, 142.250.185.106, 142.250.186.170, 142.250.184.234, 172.217.18.106, 142.250.185.138, 142.250.185.74, 142.250.186.106, 142.250.185.234, 142.250.186.138, 142.250.74.202, 142.250.186.42, 172.217.16.138, 142.250.181.234, 142.250.185.170, 209.197.3.8, 142.250.186.35, 142.250.186.99, 142.250.181.227
                • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, www.tm.v6.a.prd.aadg.trafficmanager.net, wd-prod-cp-eu-north-2-fe.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, clientservices.googleapis.com, wdcp.microsoft.com, wd-prod-cp.trafficmanager.net, login.msa.msidentity.com, prdv6a.aadg.msidentity.com, wdcpalt.microsoft.com, edgedl.me.gvt1.com, login.live.com, update.googleapis.com, www.gstatic.com, www.tm.lg.prod.aadmsa.trafficmanager.net, wd-prod-cp-eu-west-3-fe.westeurope.cloudapp.azure.com, optimizationguide-pa.googleapis.com
                • Not all processes where analyzed, report is missing behavior information
                • Report size getting too big, too many NtSetInformationFile calls found.
                • Report size getting too big, too many NtWriteVirtualMemory calls found.

                Simulations

                Behavior and APIs

                ⊘No simulations

                Joe Sandbox View / Context

                IPs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                239.255.255.250FAX-8438333.shtmGet hashmaliciousHTMLPhisherBrowse
                  https://zjldkpuzuu642e7e3f8dd17.filedocs.ru/Get hashmaliciousUnknownBrowse
                    sample.htmlGet hashmaliciousHTMLPhisherBrowse
                      https://ncv.microsoft.com/rrIWDdTZMsGet hashmaliciousHTMLPhisherBrowse
                        https://brightideasfortheweb.com/lsi4bGet hashmaliciousNetSupport RAT, PhisherBrowse
                          https://zjldkpuzuu642e7e3f8dd17.filedocs.ru/Get hashmaliciousUnknownBrowse
                            TriMPFPatch56form20230426.exeGet hashmaliciousUnknownBrowse
                              https://bit.ly/3Zuk1jXGet hashmaliciousUnknownBrowse
                                #Ufe0fAch_Receipt#U2022.htmGet hashmaliciousHTMLPhisherBrowse
                                  http://newslettertracker.poweredbyintegra.dk/nyhedsbrev_statstracker.asp?bio=aarhusc&newsletter_ID=555&Code=104&Text=https%3A%2F%2Fwww.paradisbio.dk%2Fmovie_details%2F12051&Url=http%3A%2F%2Fwww.399529.399529.tierramarilla.com/?code=cmt1cmlhbkBhY2Mub3JnGet hashmaliciousUnknownBrowse
                                    https://epiprod.be/Verify/verification/loginGet hashmaliciousUnknownBrowse
                                      http://www.lobbydesires.comGet hashmaliciousUnknownBrowse
                                        Payment_009883467563.htmGet hashmaliciousHTMLPhisherBrowse
                                          https://www.listreports.com/tracking/clicks?redirect=https%3A%2F%2Fswandiwe.biakkab.go.id%2F/%2Femail%2Fverification%2Fiyejts%2F%2F%2F%2FZ3JwLWhsLWJvcEBkZW1lLWdyb3VwLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                            Ref04262370056.htmlGet hashmaliciousUnknownBrowse
                                              http://newslettertracker.poweredbyintegra.dk/nyhedsbrev_statstracker.asp?bio=aarhusc&newsletter_ID=555&Code=104&Text=https%3A%2F%2Fwww.paradisbio.dk%2Fmovie_details%2F12051&Url=http%3A%2F%2Fwww.399529.399529.tierramarilla.com/?code=cmt1cmlhbkBhY2Mub3JnGet hashmaliciousUnknownBrowse
                                                https://app.uptics.io:8443/v1/crm/email/track-email-clicks?email_id=622d45b7298161200c1ea14c&url=https://ecolebiblique.com//onedriverjs/index.phpGet hashmaliciousUnknownBrowse
                                                  http://estetik.com.tr/IT0008626299102gGet hashmaliciousUnknownBrowse
                                                    https://pages.qwilr.com/Sales-Proposal-KaMKPbR1amgxGet hashmaliciousUnknownBrowse
                                                      https://www.listreports.com/tracking/clicks?redirect=https%3A%2F%2Fswandiwe.biakkab.go.id%2F/%2Femail%2Fverification%2Fel880y%2F%2F%2F%2Fam1nQHN0YXJ0Y2FtcHVzLnB0Get hashmaliciousHTMLPhisherBrowse

                                                        Domains

                                                        ⊘No context

                                                        ASNs

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        NAMECHEAP-NETUShttps://www.pure17go.com.tw/link/6387/?edm_redirect_url=///slimsirishpub.com/wp-admin/user/juo/fghg/dfgd/gins/grins/hgsdhsd/sdhjksd/jstarus@heniff.com&c=E,1,KFajQKetKl4KDSljwDfQukPcdkOQqgApwfe3JhZbGBr0W-2n8d_m4mSZuYJ6aZAOkcJ3XYT2GtOkGGpzzz0xgO71cvoAWC4z2ZtkqlXvPmCRdWWUgsV2SA,,&typo=1Get hashmaliciousReCaptcha PhishBrowse
                                                        • 162.213.255.15
                                                        PO_3534272.exeGet hashmaliciousFormBookBrowse
                                                        • 198.54.117.217
                                                        ThridstageFormBook.exeGet hashmaliciousFormBookBrowse
                                                        • 199.192.23.224
                                                        https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwivk5Lq_8b-AhWiV6QEHQnHAiwQFnoECAsQAQ&url=http://elanist.com/&usg=AOvVaw3xU27EPOBqpRf_VXU1mKq-Get hashmaliciousUnknownBrowse
                                                        • 185.61.154.18
                                                        IMG-Scanned_POs#_PSB-17398902,_PSB-18384789.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 162.213.253.35
                                                        ref_CUNA._N#U00b0_4649_M#U00e9xico_RE_Solicitud_de_pedido.exeGet hashmaliciousFormBookBrowse
                                                        • 199.192.30.147
                                                        IMG_6087721402pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 198.54.116.202
                                                        IFuIF5JyoX.exeGet hashmaliciousAgentTesla, zgRATBrowse
                                                        • 198.54.121.225
                                                        IMG_31802_88213pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 198.54.116.202
                                                        GHXCGHXCGJXC.exeGet hashmaliciousFormBookBrowse
                                                        • 199.192.23.224
                                                        order.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 162.0.236.127
                                                        PO.4500129697.exeGet hashmaliciousAgentTesla, zgRATBrowse
                                                        • 198.54.121.225
                                                        bogmAxuVqu.exeGet hashmaliciousFormBookBrowse
                                                        • 198.54.117.216
                                                        https://highstoneglobaluniversityus.com/eraclidesGet hashmaliciousHTMLPhisherBrowse
                                                        • 198.54.116.248
                                                        7lxGoG5dSB.exeGet hashmaliciousFormBookBrowse
                                                        • 198.54.117.211
                                                        z35INV-A66G-B100.exeGet hashmaliciousFormBookBrowse
                                                        • 199.192.22.198
                                                        PURCHASE_ORDER.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 162.213.253.35
                                                        TnXF6ibqRB.dllGet hashmaliciousCobaltStrikeBrowse
                                                        • 162.255.119.38
                                                        PO_383822.docGet hashmaliciousFormBookBrowse
                                                        • 63.250.44.94
                                                        INV736103251059.xllGet hashmaliciousAgentTesla, zgRATBrowse
                                                        • 162.0.235.116

                                                        JA3 Fingerprints

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        28a2c9bd18a11de089ef85a160da29e4https://ncv.microsoft.com/rrIWDdTZMsGet hashmaliciousHTMLPhisherBrowse
                                                        • 2.19.229.151
                                                        cryptor.exeGet hashmaliciousContiBrowse
                                                        • 2.19.229.151
                                                        cryptor.exeGet hashmaliciousContiBrowse
                                                        • 2.19.229.151
                                                        cryptor.exeGet hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        cryptor.exeGet hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        cryptor.exeGet hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        http://67.225.140.4Get hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        90729.002L-billing Cn 2023.04.htmlGet hashmaliciousHTMLPhisherBrowse
                                                        • 2.19.229.151
                                                        Northerntrust-Contract826547826547 #U00e2#U20ac#U00ae#U00e2#U20ac#U00ae#U00e2#U20ac#U00ae3pm.htmGet hashmaliciousHTMLPhisherBrowse
                                                        • 2.19.229.151
                                                        http://78.47.204.80Get hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        https://omnatuor.com/Get hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        https://r20.rs6.net/tn.jsp?f=001kD8Zx_knLaqNhPOIRgaa-pZEs0F9lD9ewcqk9S5Lh34DP2SmhKhhEqVcvS0ZE08tOuooZyKU_EAS69oyrTUHWOQZ6u0Kjfco-CSTyVtX_IYVTBS4eonKlLGP441AyQT5uTuR7KHn9uVJt_v90lxyMQ==&__=?x=cXVhbmctdmluaC5sZUBicmVkLmZyGet hashmaliciousCaptcha PhishBrowse
                                                        • 2.19.229.151
                                                        (84) Wells-Fargo Payoff G-T 13 April, 2023 #40580.htmGet hashmaliciousHTMLPhisherBrowse
                                                        • 2.19.229.151
                                                        http://spo76rt28r.comGet hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        Caller02067646.htmGet hashmaliciousHTMLPhisherBrowse
                                                        • 2.19.229.151
                                                        https://pgazz.pages.dev/Get hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        https://fumefresheners.comGet hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        https://lcfmp.com.au/lane-cove-medical-teamGet hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        https://lderkd.clinicaragaalbacete.com/bnx/Get hashmaliciousHTMLPhisherBrowse
                                                        • 2.19.229.151
                                                        cryptor.exeGet hashmaliciousUnknownBrowse
                                                        • 2.19.229.151
                                                        3b5074b1b5d032e5620f69f9f700ff0ePO_20230525.vbsGet hashmaliciousRemcosBrowse
                                                        • 40.113.103.199
                                                        INVOICE-502.vbsGet hashmaliciousRemcosBrowse
                                                        • 40.113.103.199
                                                        Airwaybill_and_Shipping_Documents.exeGet hashmaliciousSnake Keylogger, StormKittyBrowse
                                                        • 40.113.103.199
                                                        inquiry_details.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        DOC-BVCG6655-76854345679876542345876.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        SOA.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        Products_Quote_439607108.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        ark.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        BL4053821896.xlsx.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        New_Order_pdf.exeGet hashmaliciousAgentTesla, zgRATBrowse
                                                        • 40.113.103.199
                                                        Pedido_2523068.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        DOC-JHhHhHh55-76854345679876542345876.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        00437900113701.exeGet hashmaliciousAgentTesla, zgRATBrowse
                                                        • 40.113.103.199
                                                        TT_copy.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        RFQ#985743-EQUIPMENT.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        CPdeoR7z78.exeGet hashmaliciousMinerDownloader, Laplas Clipper, RedLine, XmrigBrowse
                                                        • 40.113.103.199
                                                        SecuriteInfo.com.Trojan.Inject4.30942.22677.6209.exeGet hashmaliciousRedLine, zgRATBrowse
                                                        • 40.113.103.199
                                                        Zaplata,jpeg.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199
                                                        INQUIRY_0809309072023.exeGet hashmaliciousAveMaria, UACMeBrowse
                                                        • 40.113.103.199
                                                        PO2201235_T2-VEYA-Q000054033-T2.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 40.113.103.199

                                                        Dropped Files

                                                        ⊘No context

                                                        Created / dropped Files

                                                        ⊘No created / dropped files found

                                                        Static File Info

                                                        General

                                                        File type:HTML document, ASCII text, with very long lines (792), with CRLF line terminators
                                                        Entropy (8bit):5.849495247440236
                                                        TrID:
                                                        • HyperText Markup Language (12001/1) 66.65%
                                                        • HyperText Markup Language (6006/1) 33.35%
                                                        File name:ref#298409_bill_attached_.htm
                                                        File size:2372
                                                        MD5:81a2ef8b6871250d3c35aa694eef684e
                                                        SHA1:3a3b177e92e7c8802619125e96c341ed4f084466
                                                        SHA256:8c05086b1d23c33390b51616b738aaa3153143cbbb3a63deafd6724167b1ab77
                                                        SHA512:8c3015e7082e87b3617b6bc8199c89bfe3195e6e475d166345f2e2c4c029c91cb46f94318ecf459694eb4e84621af8780f6332981194e4b0eed3d36826ff9589
                                                        SSDEEP:48:nPiV1z11HOnJXR01Af238kXZEp0vz6OoI1xgcRsYfxcq:kx1un9R0GQZjzh1O+sUxl
                                                        TLSH:E641B8B45E7CEF37A50F0EFBBED08769B2935282D740234A07D4B45B1007AE78638690
                                                        File Content Preview:<html>..<head>..<ol class="QSNUPQz KrrDguWOzN" id="bvmeiEb" title="yMDhFkT" ></ol>..</head>..<body>..<bdo class="dVGsis SKIbHL" id="fMNUDNgX" title="kdDLijodr" ></bdo>....<input class="xAPNwopids" type="hidden" id="OcZtJBKoL" value="aHR0cHM6Ly9sbXNjb25saW

                                                        Network Behavior

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Apr 26, 2023 17:42:04.460486889 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.461064100 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.461141109 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.461410999 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.461462021 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.694639921 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.694822073 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.694925070 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.695050001 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.695116997 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.695149899 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.695149899 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.695282936 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.695326090 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.695538044 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.695585012 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.695616007 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.695753098 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.696429968 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.696429968 CEST49780443192.168.11.2052.165.165.26
                                                        Apr 26, 2023 17:42:04.696481943 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.696501970 CEST4434978052.165.165.26192.168.11.20
                                                        Apr 26, 2023 17:42:04.725509882 CEST4977680192.168.11.2093.184.221.240
                                                        Apr 26, 2023 17:42:08.124861956 CEST8049674192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:42:08.125236034 CEST4967480192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:08.363667011 CEST49787443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:08.363754988 CEST4434978740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:08.363955021 CEST49787443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:08.365210056 CEST49787443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:08.365283012 CEST4434978740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:08.455955982 CEST4434978740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:08.456182957 CEST49787443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:08.459880114 CEST49787443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:08.459892988 CEST4434978740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:08.460192919 CEST4434978740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:08.462925911 CEST49787443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:08.463131905 CEST49787443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:08.463143110 CEST4434978740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:08.463329077 CEST49787443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:08.483043909 CEST4434978740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:08.483141899 CEST4434978740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:08.483380079 CEST49787443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:08.483547926 CEST49787443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:08.483561993 CEST4434978740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:14.167610884 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.167694092 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.167917013 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.168061018 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.168096066 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.168226957 CEST56872443192.168.11.20142.250.185.77
                                                        Apr 26, 2023 17:42:14.168350935 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.168493032 CEST56872443192.168.11.20142.250.185.77
                                                        Apr 26, 2023 17:42:14.168637991 CEST56872443192.168.11.20142.250.185.77
                                                        Apr 26, 2023 17:42:14.168695927 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.241398096 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.247575045 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.247591972 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.248167992 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.248378038 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.248728037 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.248891115 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.257309914 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.257798910 CEST56872443192.168.11.20142.250.185.77
                                                        Apr 26, 2023 17:42:14.257808924 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.259330988 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.259521008 CEST56872443192.168.11.20142.250.185.77
                                                        Apr 26, 2023 17:42:14.268594980 CEST8049701192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:42:14.268837929 CEST4970180192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:14.292699099 CEST56872443192.168.11.20142.250.185.77
                                                        Apr 26, 2023 17:42:14.292699099 CEST56872443192.168.11.20142.250.185.77
                                                        Apr 26, 2023 17:42:14.292728901 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.292756081 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.292756081 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.292783022 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.292839050 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.292859077 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.317600012 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.317756891 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.317852974 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.318020105 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.318656921 CEST64478443192.168.11.20142.250.185.78
                                                        Apr 26, 2023 17:42:14.318669081 CEST44364478142.250.185.78192.168.11.20
                                                        Apr 26, 2023 17:42:14.334467888 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.334703922 CEST56872443192.168.11.20142.250.185.77
                                                        Apr 26, 2023 17:42:14.334733009 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.334753036 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.334934950 CEST56872443192.168.11.20142.250.185.77
                                                        Apr 26, 2023 17:42:14.335844994 CEST56872443192.168.11.20142.250.185.77
                                                        Apr 26, 2023 17:42:14.335875988 CEST44356872142.250.185.77192.168.11.20
                                                        Apr 26, 2023 17:42:14.398478985 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.398525000 CEST4434961840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:14.398730993 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.399108887 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.399139881 CEST4434961840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:14.483674049 CEST4434961840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:14.483928919 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.485094070 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.485115051 CEST4434961840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:14.485630989 CEST4434961840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:14.486762047 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.486792088 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.486807108 CEST4434961840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:14.486931086 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.492846966 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:14.492896080 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:14.493045092 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:14.493240118 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:14.493275881 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:14.507308006 CEST4434961840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:14.507498980 CEST4434961840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:14.507659912 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.508811951 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.508811951 CEST49618443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:14.508850098 CEST4434961840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:14.891060114 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:14.891531944 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:14.891554117 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:14.893729925 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:14.893939018 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:14.895230055 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:14.895323038 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:14.895338058 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:14.895411968 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:14.942538023 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:14.942564011 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:14.990468025 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:15.273087025 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:15.273396969 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:15.273586035 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:15.274291992 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:15.274291992 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:15.274355888 CEST44356468198.54.121.168192.168.11.20
                                                        Apr 26, 2023 17:42:15.274573088 CEST56468443192.168.11.20198.54.121.168
                                                        Apr 26, 2023 17:42:15.603521109 CEST8049718192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:42:15.603723049 CEST4971880192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:18.543601036 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.543664932 CEST4436055340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:18.543977976 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.544378042 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.544416904 CEST4436055340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:18.622989893 CEST4436055340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:18.623229027 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.624507904 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.624537945 CEST4436055340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:18.625202894 CEST4436055340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:18.626607895 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.626609087 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.626656055 CEST4436055340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:18.626674891 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.645963907 CEST4436055340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:18.646167994 CEST4436055340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:18.646303892 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.646353960 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.646354914 CEST60553443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:18.646403074 CEST4436055340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:18.792617083 CEST52532443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.792706013 CEST44352532142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.792742014 CEST51368443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.792779922 CEST44351368142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.792931080 CEST52532443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.792931080 CEST51368443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.793123007 CEST52532443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.793174982 CEST44352532142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.793191910 CEST51368443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.793210030 CEST44351368142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.875330925 CEST44352532142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.875811100 CEST52532443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.875824928 CEST44352532142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.877072096 CEST44352532142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.877245903 CEST52532443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.878624916 CEST52532443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.878707886 CEST44352532142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.881547928 CEST44351368142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.881867886 CEST51368443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.881879091 CEST44351368142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.883160114 CEST44351368142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.883331060 CEST51368443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.884437084 CEST51368443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.884520054 CEST44351368142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.921880960 CEST52532443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.921895027 CEST44352532142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.937623978 CEST51368443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.937643051 CEST44351368142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:18.968842983 CEST52532443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:18.984518051 CEST51368443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:28.861421108 CEST44352532142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:28.861655951 CEST44352532142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:28.861784935 CEST52532443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:28.877963066 CEST44351368142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:28.878165960 CEST44351368142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:28.878393888 CEST51368443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:30.319164038 CEST52532443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:30.319164038 CEST51368443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:42:30.319247007 CEST44352532142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:30.319271088 CEST44351368142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:42:31.574047089 CEST50015443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:31.574110031 CEST4435001540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:31.574405909 CEST50015443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:31.574903011 CEST50015443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:31.574942112 CEST4435001540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:31.663876057 CEST4435001540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:31.664122105 CEST50015443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:31.665363073 CEST50015443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:31.665391922 CEST4435001540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:31.666014910 CEST4435001540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:31.667460918 CEST50015443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:31.667462111 CEST50015443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:31.667496920 CEST4435001540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:31.667510033 CEST50015443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:31.688599110 CEST4435001540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:31.688698053 CEST4435001540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:31.688873053 CEST50015443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:31.689049959 CEST50015443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:31.689078093 CEST4435001540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:38.365844965 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.365936041 CEST4436330440.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:38.366197109 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.366615057 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.366655111 CEST4436330440.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:38.458204031 CEST4436330440.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:38.458523989 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.459978104 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.460055113 CEST4436330440.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:38.461055040 CEST4436330440.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:38.462655067 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.462656021 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.462722063 CEST4436330440.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:38.462742090 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.483978987 CEST4436330440.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:38.484333992 CEST4436330440.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:38.484566927 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.484648943 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.484648943 CEST63304443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:38.484711885 CEST4436330440.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:48.490067959 CEST4975380192.168.11.20104.102.53.110
                                                        Apr 26, 2023 17:42:48.490179062 CEST49751443192.168.11.20104.102.19.44
                                                        Apr 26, 2023 17:42:48.490180016 CEST49752443192.168.11.20104.102.19.44
                                                        Apr 26, 2023 17:42:48.490200043 CEST49754443192.168.11.2035.186.224.25
                                                        Apr 26, 2023 17:42:48.499377012 CEST44349751104.102.19.44192.168.11.20
                                                        Apr 26, 2023 17:42:48.499439001 CEST44349751104.102.19.44192.168.11.20
                                                        Apr 26, 2023 17:42:48.499480963 CEST44349752104.102.19.44192.168.11.20
                                                        Apr 26, 2023 17:42:48.499521971 CEST44349752104.102.19.44192.168.11.20
                                                        Apr 26, 2023 17:42:48.499533892 CEST49751443192.168.11.20104.102.19.44
                                                        Apr 26, 2023 17:42:48.499610901 CEST49751443192.168.11.20104.102.19.44
                                                        Apr 26, 2023 17:42:48.499665022 CEST49752443192.168.11.20104.102.19.44
                                                        Apr 26, 2023 17:42:48.499711990 CEST49752443192.168.11.20104.102.19.44
                                                        Apr 26, 2023 17:42:48.500979900 CEST8049753104.102.53.110192.168.11.20
                                                        Apr 26, 2023 17:42:48.501231909 CEST4975380192.168.11.20104.102.53.110
                                                        Apr 26, 2023 17:42:48.506067038 CEST4434975435.186.224.25192.168.11.20
                                                        Apr 26, 2023 17:42:48.506300926 CEST49754443192.168.11.2035.186.224.25
                                                        Apr 26, 2023 17:42:48.616878033 CEST49757443192.168.11.202.19.228.7
                                                        Apr 26, 2023 17:42:48.616878986 CEST49755443192.168.11.202.19.228.7
                                                        Apr 26, 2023 17:42:48.616949081 CEST49756443192.168.11.202.19.228.7
                                                        Apr 26, 2023 17:42:48.617053986 CEST4975880192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:48.625848055 CEST50028443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:48.625938892 CEST4435002840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:48.626163006 CEST50028443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:48.626462936 CEST50028443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:48.626518011 CEST4435002840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:48.703768015 CEST4435002840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:48.704274893 CEST50028443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:48.705693960 CEST50028443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:48.705714941 CEST4435002840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:48.706182003 CEST4435002840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:48.707576036 CEST50028443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:48.707606077 CEST50028443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:48.707619905 CEST4435002840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:48.707658052 CEST50028443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:48.728260994 CEST4435002840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:48.728389025 CEST4435002840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:48.728602886 CEST50028443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:48.728734016 CEST50028443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:42:48.728761911 CEST4435002840.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:42:49.236299992 CEST8049761192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:42:49.236641884 CEST4976180192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:52.134160995 CEST49765443192.168.11.202.23.209.182
                                                        Apr 26, 2023 17:42:52.134217024 CEST4976680192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:52.319668055 CEST4970180192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:52.319756985 CEST49698443192.168.11.2020.189.173.10
                                                        Apr 26, 2023 17:42:52.326654911 CEST8049701192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:42:52.326963902 CEST4970180192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:52.384192944 CEST8049768192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:42:52.384531975 CEST4976880192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:52.478307009 CEST4434969820.189.173.10192.168.11.20
                                                        Apr 26, 2023 17:42:52.478948116 CEST49698443192.168.11.2020.189.173.10
                                                        Apr 26, 2023 17:42:53.104743004 CEST52802443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.104834080 CEST443528022.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.105109930 CEST52802443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.105918884 CEST52802443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.105983019 CEST443528022.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.160908937 CEST443528022.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.161180019 CEST52802443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.162317991 CEST52802443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.162364960 CEST443528022.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.163177013 CEST443528022.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.178299904 CEST52802443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.189409971 CEST443528022.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.189649105 CEST443528022.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.189666986 CEST52802443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.189666986 CEST52802443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.189754963 CEST443528022.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.189867973 CEST52802443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.189904928 CEST443528022.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.213452101 CEST52803443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.213548899 CEST443528032.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.213833094 CEST52803443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.213969946 CEST52803443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.214019060 CEST443528032.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.264446974 CEST443528032.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.264695883 CEST52803443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.265635014 CEST52803443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.265686035 CEST443528032.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.267566919 CEST443528032.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.268389940 CEST52803443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.275789976 CEST8049770192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:42:53.276124001 CEST4977080192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:53.278950930 CEST443528032.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.279185057 CEST443528032.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.279442072 CEST52803443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.279515028 CEST52803443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.279515028 CEST52803443192.168.11.202.19.229.151
                                                        Apr 26, 2023 17:42:53.279558897 CEST443528032.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:53.279577017 CEST443528032.19.229.151192.168.11.20
                                                        Apr 26, 2023 17:42:54.803536892 CEST4967480192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:54.803565979 CEST4967380192.168.11.2095.101.54.105
                                                        Apr 26, 2023 17:42:54.810657978 CEST8049674192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:42:54.810925007 CEST4967480192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:42:54.812931061 CEST804967395.101.54.105192.168.11.20
                                                        Apr 26, 2023 17:42:54.813261032 CEST4967380192.168.11.2095.101.54.105
                                                        Apr 26, 2023 17:42:55.613744974 CEST44349760204.79.197.203192.168.11.20
                                                        Apr 26, 2023 17:43:05.288734913 CEST4971880192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:43:05.295772076 CEST8049718192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:43:05.296050072 CEST4971880192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:43:08.376272917 CEST61770443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:08.376353025 CEST4436177040.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:08.376518965 CEST61770443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:08.376874924 CEST61770443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:08.376908064 CEST4436177040.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:08.455275059 CEST4436177040.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:08.455610037 CEST61770443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:08.458312988 CEST61770443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:08.458343029 CEST4436177040.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:08.458992958 CEST4436177040.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:08.460325956 CEST61770443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:08.460367918 CEST61770443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:08.460386992 CEST4436177040.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:08.460413933 CEST61770443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:08.498864889 CEST4436177040.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:08.499017954 CEST4436177040.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:08.499155045 CEST61770443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:08.499289989 CEST61770443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:08.499308109 CEST4436177040.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:18.835560083 CEST57024443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.835690022 CEST44357024142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.835786104 CEST58043443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.835860968 CEST44358043142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.835928917 CEST57024443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.836009979 CEST58043443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.836088896 CEST57024443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.836133957 CEST44357024142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.836247921 CEST58043443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.836307049 CEST44358043142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.895870924 CEST44357024142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.896399021 CEST57024443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.896419048 CEST44357024142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.897124052 CEST44357024142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.897619009 CEST57024443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.897797108 CEST44357024142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.901531935 CEST44358043142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.901943922 CEST58043443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.901961088 CEST44358043142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.902695894 CEST44358043142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.903177977 CEST58043443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.903331041 CEST44358043142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:18.940325975 CEST57024443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:18.955931902 CEST58043443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:28.889126062 CEST44357024142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:28.889358997 CEST44357024142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:28.889535904 CEST57024443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:28.896562099 CEST44358043142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:28.896811962 CEST44358043142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:43:28.897033930 CEST58043443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:43:38.379942894 CEST56953443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:38.380069017 CEST4435695340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:38.380292892 CEST56953443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:38.380748987 CEST56953443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:38.380819082 CEST4435695340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:38.474750042 CEST4435695340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:38.475114107 CEST56953443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:38.478059053 CEST56953443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:38.478135109 CEST4435695340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:38.479290009 CEST4435695340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:38.480684042 CEST56953443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:38.480684042 CEST56953443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:38.480756998 CEST4435695340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:38.480773926 CEST56953443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:38.502466917 CEST4435695340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:38.502861023 CEST4435695340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:38.503067017 CEST56953443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:38.503067970 CEST56953443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:43:38.503221989 CEST4435695340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:43:38.666215897 CEST4976180192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:43:38.673316002 CEST8049761192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:43:38.673609972 CEST4976180192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:43:42.103267908 CEST49767443192.168.11.2040.117.96.136
                                                        Apr 26, 2023 17:43:42.196182966 CEST4434976740.117.96.136192.168.11.20
                                                        Apr 26, 2023 17:43:42.196381092 CEST49767443192.168.11.2040.117.96.136
                                                        Apr 26, 2023 17:43:42.322001934 CEST4976880192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:43:42.330389977 CEST8049768192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:43:42.330859900 CEST4976880192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:43:54.711791039 CEST8049770192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:43:54.712018013 CEST4977080192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:43:55.102906942 CEST4434976913.107.5.88192.168.11.20
                                                        Apr 26, 2023 17:43:55.895308971 CEST443497732.23.209.187192.168.11.20
                                                        Apr 26, 2023 17:43:55.895351887 CEST443497732.23.209.187192.168.11.20
                                                        Apr 26, 2023 17:43:55.895464897 CEST49773443192.168.11.202.23.209.187
                                                        Apr 26, 2023 17:43:55.895464897 CEST49773443192.168.11.202.23.209.187
                                                        Apr 26, 2023 17:44:08.400686026 CEST53793443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:08.400747061 CEST4435379340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:08.400903940 CEST53793443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:08.401247025 CEST53793443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:08.401281118 CEST4435379340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:08.491940975 CEST4435379340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:08.492182016 CEST53793443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:08.493551016 CEST53793443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:08.493582964 CEST4435379340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:08.494342089 CEST4435379340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:08.496059895 CEST53793443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:08.496128082 CEST53793443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:08.496151924 CEST4435379340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:08.496325970 CEST53793443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:08.516604900 CEST4435379340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:08.516844988 CEST4435379340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:08.516985893 CEST53793443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:08.517055988 CEST53793443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:08.517076969 CEST4435379340.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:13.901839018 CEST57024443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:44:13.901839972 CEST58043443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:44:13.901942015 CEST44357024142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:44:13.901958942 CEST44358043142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:44:38.394495964 CEST55005443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:38.394581079 CEST4435500540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:38.394916058 CEST55005443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:38.395330906 CEST55005443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:38.395392895 CEST4435500540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:38.471215963 CEST4435500540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:38.471571922 CEST55005443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:38.474277973 CEST55005443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:38.474302053 CEST4435500540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:38.474894047 CEST4435500540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:38.476264954 CEST55005443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:38.476299047 CEST55005443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:38.476315022 CEST4435500540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:38.476397038 CEST55005443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:38.496716976 CEST4435500540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:38.496871948 CEST4435500540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:38.497278929 CEST55005443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:38.497703075 CEST55005443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:44:38.497735023 CEST4435500540.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:44:53.036803961 CEST8049770192.229.221.95192.168.11.20
                                                        Apr 26, 2023 17:44:53.037128925 CEST4977080192.168.11.20192.229.221.95
                                                        Apr 26, 2023 17:44:58.908638000 CEST58043443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:44:58.908662081 CEST57024443192.168.11.20142.250.185.228
                                                        Apr 26, 2023 17:44:58.908710957 CEST44358043142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:44:58.908730030 CEST44357024142.250.185.228192.168.11.20
                                                        Apr 26, 2023 17:45:08.401329994 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.401392937 CEST4435732740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:45:08.401689053 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.402115107 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.402152061 CEST4435732740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:45:08.485384941 CEST4435732740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:45:08.485625029 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.487221956 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.487250090 CEST4435732740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:45:08.487885952 CEST4435732740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:45:08.489336014 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.489379883 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.489398956 CEST4435732740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:45:08.489453077 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.509891033 CEST4435732740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:45:08.510000944 CEST4435732740.113.103.199192.168.11.20
                                                        Apr 26, 2023 17:45:08.510247946 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.510309935 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.510309935 CEST57327443192.168.11.2040.113.103.199
                                                        Apr 26, 2023 17:45:08.510323048 CEST4435732740.113.103.199192.168.11.20

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Apr 26, 2023 17:42:14.157675028 CEST4935753192.168.11.201.1.1.1
                                                        Apr 26, 2023 17:42:14.158210993 CEST5771453192.168.11.201.1.1.1
                                                        Apr 26, 2023 17:42:14.166915894 CEST53493571.1.1.1192.168.11.20
                                                        Apr 26, 2023 17:42:14.167316914 CEST53577141.1.1.1192.168.11.20
                                                        Apr 26, 2023 17:42:14.198158026 CEST577151900192.168.11.20239.255.255.250
                                                        Apr 26, 2023 17:42:14.221925974 CEST5361153192.168.11.201.1.1.1
                                                        Apr 26, 2023 17:42:14.492125988 CEST53536111.1.1.1192.168.11.20
                                                        Apr 26, 2023 17:42:15.198904037 CEST577151900192.168.11.20239.255.255.250
                                                        Apr 26, 2023 17:42:16.204884052 CEST577151900192.168.11.20239.255.255.250
                                                        Apr 26, 2023 17:42:17.209383011 CEST577151900192.168.11.20239.255.255.250
                                                        Apr 26, 2023 17:42:18.782130957 CEST6181053192.168.11.201.1.1.1
                                                        Apr 26, 2023 17:42:18.791389942 CEST53618101.1.1.1192.168.11.20
                                                        Apr 26, 2023 17:43:58.110204935 CEST138138192.168.11.20192.168.11.255
                                                        Apr 26, 2023 17:44:14.169492006 CEST595171900192.168.11.20239.255.255.250
                                                        Apr 26, 2023 17:44:15.182841063 CEST595171900192.168.11.20239.255.255.250
                                                        Apr 26, 2023 17:44:16.198398113 CEST595171900192.168.11.20239.255.255.250
                                                        Apr 26, 2023 17:44:17.201083899 CEST595171900192.168.11.20239.255.255.250

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        Apr 26, 2023 17:42:14.157675028 CEST192.168.11.201.1.1.10x1fdbStandard query (0)clients2.google.comA (IP address)IN (0x0001)false
                                                        Apr 26, 2023 17:42:14.158210993 CEST192.168.11.201.1.1.10xadfeStandard query (0)accounts.google.comA (IP address)IN (0x0001)false
                                                        Apr 26, 2023 17:42:14.221925974 CEST192.168.11.201.1.1.10xbd87Standard query (0)lmsconline.comA (IP address)IN (0x0001)false
                                                        Apr 26, 2023 17:42:18.782130957 CEST192.168.11.201.1.1.10xe495Standard query (0)www.google.comA (IP address)IN (0x0001)false

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        Apr 26, 2023 17:42:14.166915894 CEST1.1.1.1192.168.11.200x1fdbNo error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                        Apr 26, 2023 17:42:14.166915894 CEST1.1.1.1192.168.11.200x1fdbNo error (0)clients.l.google.com142.250.185.78A (IP address)IN (0x0001)false
                                                        Apr 26, 2023 17:42:14.167316914 CEST1.1.1.1192.168.11.200xadfeNo error (0)accounts.google.com142.250.185.77A (IP address)IN (0x0001)false
                                                        Apr 26, 2023 17:42:14.492125988 CEST1.1.1.1192.168.11.200xbd87No error (0)lmsconline.com198.54.121.168A (IP address)IN (0x0001)false
                                                        Apr 26, 2023 17:42:18.791389942 CEST1.1.1.1192.168.11.200xe495No error (0)www.google.com142.250.185.228A (IP address)IN (0x0001)false

                                                        HTTP Request Dependency Graph

                                                        • slscr.update.microsoft.com
                                                        • accounts.google.com
                                                        • clients2.google.com
                                                        • lmsconline.com
                                                        • fs.microsoft.com

                                                        HTTPS Proxied Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        0192.168.11.204977952.165.165.26443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:03 UTC0OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19042.1165/0?CH=685&L=en-US;en-GB&P=&PT=0x30&WUA=10.0.19041.1151&MK=To+Be+Filled+By+O.E.M.&MD=To+Be+Filled+By+O.E.M. HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept: */*
                                                        If-None-Match: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440"
                                                        User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
                                                        Host: slscr.update.microsoft.com
                                                        2023-04-26 15:42:04 UTC0INHTTP/1.1 304 Not Modified
                                                        Cache-Control: no-cache
                                                        Pragma: no-cache
                                                        Content-Type: text/html
                                                        Expires: -1
                                                        Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                        ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440"
                                                        MS-CorrelationId: 3ea9d8eb-3c20-4051-8cc9-78e4586ff606
                                                        MS-RequestId: aaae88fd-21e9-4560-a558-f6714d114736
                                                        MS-CV: Gc/y3Rih4EaUAZ+r.0
                                                        X-Microsoft-SLSClientCache: 1440
                                                        X-Content-Type-Options: nosniff
                                                        Date: Wed, 26 Apr 2023 15:42:03 GMT
                                                        Connection: close


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        1192.168.11.204978052.165.165.26443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:04 UTC0OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19042.1165/0?CH=685&L=en-US;en-GB&P=&PT=0x30&WUA=10.0.19041.1151&MK=To+Be+Filled+By+O.E.M.&MD=To+Be+Filled+By+O.E.M. HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept: */*
                                                        User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
                                                        Host: slscr.update.microsoft.com
                                                        2023-04-26 15:42:04 UTC1INHTTP/1.1 200 OK
                                                        Cache-Control: no-cache
                                                        Pragma: no-cache
                                                        Content-Type: application/octet-stream
                                                        Expires: -1
                                                        Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                        ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440"
                                                        MS-CorrelationId: af235dfb-025b-4c23-97ee-8a533b856ff8
                                                        MS-RequestId: 6efe9abb-fbc3-4a83-b773-0f9743166c6d
                                                        MS-CV: PbAjbdIPIU+2Tgd/.0
                                                        X-Microsoft-SLSClientCache: 1440
                                                        Content-Disposition: attachment; filename=environment.cab
                                                        X-Content-Type-Options: nosniff
                                                        Date: Wed, 26 Apr 2023 15:42:04 GMT
                                                        Connection: close
                                                        Content-Length: 25457
                                                        2023-04-26 15:42:04 UTC1INData Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92
                                                        Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
                                                        2023-04-26 15:42:04 UTC17INData Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a
                                                        Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        10192.168.11.206055340.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:18 UTC35OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 31 4d 58 55 71 7a 41 54 42 6b 57 68 55 33 6a 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 38 30 36 37 63 65 65 61 66 32 37 61 36 32 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: 1MXUqzATBkWhU3ja.1Context: 518067ceeaf27a62
                                                        2023-04-26 15:42:18 UTC35OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:42:18 UTC35OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 31 4d 58 55 71 7a 41 54 42 6b 57 68 55 33 6a 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 38 30 36 37 63 65 65 61 66 32 37 61 36 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: 1MXUqzATBkWhU3ja.2Context: 518067ceeaf27a62<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:42:18 UTC36OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 4d 58 55 71 7a 41 54 42 6b 57 68 55 33 6a 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 38 30 36 37 63 65 65 61 66 32 37 61 36 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: 1MXUqzATBkWhU3ja.3Context: 518067ceeaf27a62<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:42:18 UTC36INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:42:18 UTC36INData Raw: 4d 53 2d 43 56 3a 20 52 57 78 5a 53 33 74 6d 6f 6b 61 64 61 59 69 2b 56 53 2b 59 37 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: RWxZS3tmokadaYi+VS+Y7w.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        11192.168.11.205001540.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:31 UTC36OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 4a 39 51 70 49 71 66 70 34 6b 75 48 6c 52 33 6b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 31 35 61 65 66 62 63 31 66 36 39 61 34 32 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: J9QpIqfp4kuHlR3k.1Context: c115aefbc1f69a42
                                                        2023-04-26 15:42:31 UTC36OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:42:31 UTC37OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 4a 39 51 70 49 71 66 70 34 6b 75 48 6c 52 33 6b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 31 35 61 65 66 62 63 31 66 36 39 61 34 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: J9QpIqfp4kuHlR3k.2Context: c115aefbc1f69a42<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:42:31 UTC38OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4a 39 51 70 49 71 66 70 34 6b 75 48 6c 52 33 6b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 31 35 61 65 66 62 63 31 66 36 39 61 34 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: J9QpIqfp4kuHlR3k.3Context: c115aefbc1f69a42<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:42:31 UTC38INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:42:31 UTC38INData Raw: 4d 53 2d 43 56 3a 20 50 35 55 6e 39 33 6f 56 30 6b 69 55 57 36 47 71 43 33 41 50 55 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: P5Un93oV0kiUW6GqC3APUg.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        12192.168.11.206330440.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:38 UTC38OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 4b 41 39 71 69 43 42 50 4e 30 36 4b 43 66 66 58 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 31 33 62 31 66 63 61 39 37 36 31 32 39 63 61 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: KA9qiCBPN06KCffX.1Context: 213b1fca976129ca
                                                        2023-04-26 15:42:38 UTC38OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:42:38 UTC38OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 4b 41 39 71 69 43 42 50 4e 30 36 4b 43 66 66 58 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 31 33 62 31 66 63 61 39 37 36 31 32 39 63 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: KA9qiCBPN06KCffX.2Context: 213b1fca976129ca<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:42:38 UTC39OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4b 41 39 71 69 43 42 50 4e 30 36 4b 43 66 66 58 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 31 33 62 31 66 63 61 39 37 36 31 32 39 63 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: KA9qiCBPN06KCffX.3Context: 213b1fca976129ca<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:42:38 UTC40INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:42:38 UTC40INData Raw: 4d 53 2d 43 56 3a 20 55 74 50 69 6a 56 77 41 65 45 65 78 45 54 4b 64 46 57 77 6c 42 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: UtPijVwAeEexETKdFWwlBw.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        13192.168.11.205002840.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:48 UTC40OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 75 31 73 69 35 70 54 56 71 30 2b 7a 2f 4b 52 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 66 64 66 30 36 66 66 33 61 38 63 65 66 61 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: u1si5pTVq0+z/KRb.1Context: e1fdf06ff3a8cefa
                                                        2023-04-26 15:42:48 UTC40OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:42:48 UTC40OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 75 31 73 69 35 70 54 56 71 30 2b 7a 2f 4b 52 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 66 64 66 30 36 66 66 33 61 38 63 65 66 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: u1si5pTVq0+z/KRb.2Context: e1fdf06ff3a8cefa<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:42:48 UTC41OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 75 31 73 69 35 70 54 56 71 30 2b 7a 2f 4b 52 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 66 64 66 30 36 66 66 33 61 38 63 65 66 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: u1si5pTVq0+z/KRb.3Context: e1fdf06ff3a8cefa<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:42:48 UTC41INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:42:48 UTC41INData Raw: 4d 53 2d 43 56 3a 20 65 69 2b 4b 76 59 43 48 78 55 6d 67 4f 67 77 35 76 4b 41 41 5a 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: ei+KvYCHxUmgOgw5vKAAZg.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        14192.168.11.20528022.19.229.151443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:53 UTC41OUTHEAD /fs/windows/config.json HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept: */*
                                                        Accept-Encoding: identity
                                                        User-Agent: Microsoft BITS/7.8
                                                        Host: fs.microsoft.com
                                                        2023-04-26 15:42:53 UTC41INHTTP/1.1 200 OK
                                                        Content-Type: application/octet-stream
                                                        Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                        ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                        ApiVersion: Distribute 1.1
                                                        Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                        X-MSEdge-Ref: Ref A: 65032144BB954983ABA770DA8C321B97 Ref B: LON04EDGE1010 Ref C: 2023-04-24T07:05:30Z
                                                        Cache-Control: public, max-age=55396
                                                        Date: Wed, 26 Apr 2023 15:42:53 GMT
                                                        Connection: close
                                                        X-CID: 2


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        15192.168.11.20528032.19.229.151443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:53 UTC42OUTGET /fs/windows/config.json HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept: */*
                                                        Accept-Encoding: identity
                                                        If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                                        Range: bytes=0-2147483646
                                                        User-Agent: Microsoft BITS/7.8
                                                        Host: fs.microsoft.com
                                                        2023-04-26 15:42:53 UTC42INHTTP/1.1 200 OK
                                                        Content-Type: application/octet-stream
                                                        Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                        ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                        ApiVersion: Distribute 1.1
                                                        Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                        X-Azure-Ref: 0WjMqYwAAAABjF7l0wOIgQK+R1dOMvnGMTE9OMjFFREdFMTgxNABjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y=
                                                        Cache-Control: public, max-age=205762
                                                        Date: Wed, 26 Apr 2023 15:42:53 GMT
                                                        Content-Length: 55
                                                        Connection: close
                                                        X-CID: 2
                                                        2023-04-26 15:42:53 UTC43INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                                        Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        16192.168.11.206177040.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:43:08 UTC43OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 38 58 41 53 74 48 78 4f 71 55 71 79 45 51 35 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 63 62 34 32 39 35 39 66 35 63 37 66 66 33 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: 8XAStHxOqUqyEQ5i.1Context: adcb42959f5c7ff3
                                                        2023-04-26 15:43:08 UTC43OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:43:08 UTC43OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 38 58 41 53 74 48 78 4f 71 55 71 79 45 51 35 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 63 62 34 32 39 35 39 66 35 63 37 66 66 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: 8XAStHxOqUqyEQ5i.2Context: adcb42959f5c7ff3<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:43:08 UTC44OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 58 41 53 74 48 78 4f 71 55 71 79 45 51 35 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 63 62 34 32 39 35 39 66 35 63 37 66 66 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: 8XAStHxOqUqyEQ5i.3Context: adcb42959f5c7ff3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:43:08 UTC44INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:43:08 UTC44INData Raw: 4d 53 2d 43 56 3a 20 66 44 78 51 6b 42 2f 4e 50 6b 2b 31 58 31 4c 78 51 34 56 51 47 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: fDxQkB/NPk+1X1LxQ4VQGQ.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        17192.168.11.205695340.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:43:38 UTC44OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 79 52 6b 4d 6e 4c 62 34 69 6b 53 71 2b 49 50 47 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 31 30 65 37 63 63 39 34 30 31 33 37 34 66 64 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: yRkMnLb4ikSq+IPG.1Context: a10e7cc9401374fd
                                                        2023-04-26 15:43:38 UTC45OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:43:38 UTC45OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 79 52 6b 4d 6e 4c 62 34 69 6b 53 71 2b 49 50 47 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 31 30 65 37 63 63 39 34 30 31 33 37 34 66 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: yRkMnLb4ikSq+IPG.2Context: a10e7cc9401374fd<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:43:38 UTC46OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 79 52 6b 4d 6e 4c 62 34 69 6b 53 71 2b 49 50 47 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 31 30 65 37 63 63 39 34 30 31 33 37 34 66 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: yRkMnLb4ikSq+IPG.3Context: a10e7cc9401374fd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:43:38 UTC46INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:43:38 UTC46INData Raw: 4d 53 2d 43 56 3a 20 4e 56 4f 64 6e 31 57 55 34 45 4b 65 67 7a 50 67 64 7a 65 35 2b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: NVOdn1WU4EKegzPgdze5+g.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        18192.168.11.205379340.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:44:08 UTC46OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 74 61 37 68 76 37 71 55 34 30 6d 62 41 62 42 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 61 35 34 36 37 62 64 35 62 30 61 65 37 63 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: ta7hv7qU40mbAbBT.1Context: 65a5467bd5b0ae7c
                                                        2023-04-26 15:44:08 UTC46OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:44:08 UTC46OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 74 61 37 68 76 37 71 55 34 30 6d 62 41 62 42 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 61 35 34 36 37 62 64 35 62 30 61 65 37 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: ta7hv7qU40mbAbBT.2Context: 65a5467bd5b0ae7c<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:44:08 UTC47OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 74 61 37 68 76 37 71 55 34 30 6d 62 41 62 42 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 61 35 34 36 37 62 64 35 62 30 61 65 37 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: ta7hv7qU40mbAbBT.3Context: 65a5467bd5b0ae7c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:44:08 UTC48INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:44:08 UTC48INData Raw: 4d 53 2d 43 56 3a 20 39 42 78 77 38 44 41 76 70 45 4f 4b 6f 6d 6e 79 4b 4a 52 4c 6a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: 9Bxw8DAvpEOKomnyKJRLjw.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        19192.168.11.205500540.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:44:38 UTC48OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 79 37 4a 2f 4a 67 55 68 69 45 65 6f 76 36 45 52 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 35 61 30 38 38 65 39 35 35 30 39 37 66 63 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: y7J/JgUhiEeov6ER.1Context: a65a088e955097fc
                                                        2023-04-26 15:44:38 UTC48OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:44:38 UTC48OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 79 37 4a 2f 4a 67 55 68 69 45 65 6f 76 36 45 52 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 35 61 30 38 38 65 39 35 35 30 39 37 66 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: y7J/JgUhiEeov6ER.2Context: a65a088e955097fc<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:44:38 UTC49OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 79 37 4a 2f 4a 67 55 68 69 45 65 6f 76 36 45 52 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 35 61 30 38 38 65 39 35 35 30 39 37 66 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: y7J/JgUhiEeov6ER.3Context: a65a088e955097fc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:44:38 UTC49INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:44:38 UTC49INData Raw: 4d 53 2d 43 56 3a 20 47 57 55 73 77 4c 57 78 71 45 65 6c 71 37 76 33 7a 6d 32 6d 47 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: GWUswLWxqEelq7v3zm2mGA.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        2192.168.11.204978740.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:08 UTC26OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 2f 4b 32 32 74 38 6a 6b 6e 55 71 78 79 41 72 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 35 64 36 32 38 32 66 63 66 61 37 62 61 66 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: /K22t8jknUqxyArN.1Context: 315d6282fcfa7baf
                                                        2023-04-26 15:42:08 UTC26OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:42:08 UTC26OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 2f 4b 32 32 74 38 6a 6b 6e 55 71 78 79 41 72 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 35 64 36 32 38 32 66 63 66 61 37 62 61 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: /K22t8jknUqxyArN.2Context: 315d6282fcfa7baf<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:42:08 UTC27OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2f 4b 32 32 74 38 6a 6b 6e 55 71 78 79 41 72 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 35 64 36 32 38 32 66 63 66 61 37 62 61 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: /K22t8jknUqxyArN.3Context: 315d6282fcfa7baf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:42:08 UTC28INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:42:08 UTC28INData Raw: 4d 53 2d 43 56 3a 20 75 58 5a 65 47 52 46 53 7a 6b 32 77 68 56 54 6b 79 62 61 57 74 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: uXZeGRFSzk2whVTkybaWtA.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        20192.168.11.205732740.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:45:08 UTC49OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 77 62 37 65 4d 62 4d 77 4d 30 2b 77 63 73 2b 63 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 39 63 37 35 36 36 65 64 36 34 64 30 66 35 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: wb7eMbMwM0+wcs+c.1Context: 409c7566ed64d0f5
                                                        2023-04-26 15:45:08 UTC50OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:45:08 UTC50OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 77 62 37 65 4d 62 4d 77 4d 30 2b 77 63 73 2b 63 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 39 63 37 35 36 36 65 64 36 34 64 30 66 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: wb7eMbMwM0+wcs+c.2Context: 409c7566ed64d0f5<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:45:08 UTC51OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 77 62 37 65 4d 62 4d 77 4d 30 2b 77 63 73 2b 63 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 39 63 37 35 36 36 65 64 36 34 64 30 66 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: wb7eMbMwM0+wcs+c.3Context: 409c7566ed64d0f5<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:45:08 UTC51INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:45:08 UTC51INData Raw: 4d 53 2d 43 56 3a 20 71 36 51 37 4d 47 58 73 44 55 53 62 4c 52 38 42 6a 2f 31 4e 77 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: q6Q7MGXsDUSbLR8Bj/1NwQ.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        3192.168.11.2056872142.250.185.77443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:14 UTC28OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
                                                        Host: accounts.google.com
                                                        Connection: keep-alive
                                                        Content-Length: 1
                                                        Origin: https://www.google.com
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Sec-Fetch-Site: none
                                                        Sec-Fetch-Mode: no-cors
                                                        Sec-Fetch-Dest: empty
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Cookie: CONSENT=YES+srp.gws-20210811-0-RC2.en+FX+979
                                                        2023-04-26 15:42:14 UTC29OUTData Raw: 20
                                                        Data Ascii:


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        4192.168.11.2064478142.250.185.78443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:14 UTC28OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=94.0.4606.61&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
                                                        Host: clients2.google.com
                                                        Connection: keep-alive
                                                        X-Goog-Update-Interactivity: fg
                                                        X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda
                                                        X-Goog-Update-Updater: chromecrx-94.0.4606.61
                                                        Sec-Fetch-Site: none
                                                        Sec-Fetch-Mode: no-cors
                                                        Sec-Fetch-Dest: empty
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        5142.250.185.78443192.168.11.2064478C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:14 UTC29INHTTP/1.1 200 OK
                                                        Content-Security-Policy: script-src 'report-sample' 'nonce-CLi405ydZPiTIPolAv-G7Q' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                                                        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                        Pragma: no-cache
                                                        Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                        Date: Wed, 26 Apr 2023 15:42:14 GMT
                                                        Content-Type: text/xml; charset=UTF-8
                                                        X-Daynum: 5959
                                                        X-Daystart: 31334
                                                        X-Content-Type-Options: nosniff
                                                        X-Frame-Options: SAMEORIGIN
                                                        X-XSS-Protection: 1; mode=block
                                                        Server: GSE
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2023-04-26 15:42:14 UTC30INData Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 39 35 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 31 33 33 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22
                                                        Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5959" elapsed_seconds="31334"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
                                                        2023-04-26 15:42:14 UTC30INData Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a
                                                        Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
                                                        2023-04-26 15:42:14 UTC30INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        6142.250.185.77443192.168.11.2056872C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:14 UTC30INHTTP/1.1 200 OK
                                                        Content-Type: application/json; charset=utf-8
                                                        Access-Control-Allow-Origin: https://www.google.com
                                                        Access-Control-Allow-Credentials: true
                                                        X-Content-Type-Options: nosniff
                                                        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                        Pragma: no-cache
                                                        Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                        Date: Wed, 26 Apr 2023 15:42:14 GMT
                                                        Strict-Transport-Security: max-age=31536000; includeSubDomains
                                                        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                        Cross-Origin-Opener-Policy: same-origin
                                                        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                        Content-Security-Policy: script-src 'report-sample' 'nonce-wqTEOO8G5QOc3QuuSIOfsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
                                                        Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist
                                                        Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
                                                        Server: ESF
                                                        X-XSS-Protection: 0
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2023-04-26 15:42:14 UTC32INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
                                                        Data Ascii: 11["gaia.l.a.r",[]]
                                                        2023-04-26 15:42:14 UTC32INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        7192.168.11.204961840.113.103.199443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:14 UTC32OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 37 0d 0a 4d 53 2d 43 56 3a 20 77 68 64 31 4e 6f 72 75 36 30 69 54 73 44 76 39 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 62 34 65 31 66 38 61 38 62 66 61 64 34 66 0d 0a 0d 0a
                                                        Data Ascii: CNT 1 CON 317MS-CV: whd1Noru60iTsDv9.1Context: 48b4e1f8a8bfad4f
                                                        2023-04-26 15:42:14 UTC32OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 32 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 33 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 54 6f 20 42 65 20 46 69 6c 6c 65 64 20 42 79 20 4f 2e 45 2e 4d 2e 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f
                                                        Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19042</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>3</deviceType><deviceName>To Be Filled By O.E.M.</deviceName><followRetry>true</followRetry></agent></co
                                                        2023-04-26 15:42:14 UTC32OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 77 68 64 31 4e 6f 72 75 36 30 69 54 73 44 76 39 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 62 34 65 31 66 38 61 38 62 66 61 64 34 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 74 55 51 6a 33 6e 50 41 75 6a 39 6b 5a 32 72 47 6c 72 6f 71 43 75 2f 65 71 44 2b 34 78 37 6d 68 47 46 48 38 49 73 76 44 6a 63 76 6a 41 59 66 33 2b 63 71 6d 62 5a 46 70 65 41 63 76 36 30 57 57 37 77 6e 4e 4b 30 35 72 34 31 66 74 47 56 79 4e 73 77 58 6c 34 79 56 4a 59 55 47 43 35 6b 73 7a 68 64 54 5a 54 53 4e 56 4d 69 46 54
                                                        Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: whd1Noru60iTsDv9.2Context: 48b4e1f8a8bfad4f<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbtUQj3nPAuj9kZ2rGlroqCu/eqD+4x7mhGFH8IsvDjcvjAYf3+cqmbZFpeAcv60WW7wnNK05r41ftGVyNswXl4yVJYUGC5kszhdTZTSNVMiFT
                                                        2023-04-26 15:42:14 UTC33OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 77 68 64 31 4e 6f 72 75 36 30 69 54 73 44 76 39 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 62 34 65 31 66 38 61 38 62 66 61 64 34 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
                                                        Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: whd1Noru60iTsDv9.3Context: 48b4e1f8a8bfad4f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
                                                        2023-04-26 15:42:14 UTC34INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
                                                        Data Ascii: 202 1 CON 58
                                                        2023-04-26 15:42:14 UTC34INData Raw: 4d 53 2d 43 56 3a 20 4d 76 4c 71 2f 73 48 54 6f 6b 36 45 33 31 2f 6d 36 67 68 36 76 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
                                                        Data Ascii: MS-CV: MvLq/sHTok6E31/m6gh6vQ.0Payload parsing failed.


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        8192.168.11.2056468198.54.121.168443C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:14 UTC34OUTGET /fishh/host[18]/admin/js/mp.php?ar=d29yZA==&b64e=WtZpQrRj&b64u=OcZtJBKoL&conf=CeTlZV&call=fwLrYhm HTTP/1.1
                                                        Host: lmsconline.com
                                                        Connection: keep-alive
                                                        sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"
                                                        sec-ch-ua-mobile: ?0
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept: */*
                                                        Sec-Fetch-Site: cross-site
                                                        Sec-Fetch-Mode: no-cors
                                                        Sec-Fetch-Dest: script
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9


                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                        9198.54.121.168443192.168.11.2056468C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampkBytes transferredDirectionData
                                                        2023-04-26 15:42:15 UTC34INHTTP/1.1 200 OK
                                                        keep-alive: timeout=5, max=100
                                                        x-powered-by: PHP/7.4.33
                                                        content-type: text/html; charset=UTF-8
                                                        content-length: 0
                                                        date: Wed, 26 Apr 2023 15:42:15 GMT
                                                        server: LiteSpeed
                                                        x-turbo-charged-by: LiteSpeed
                                                        x-frame-options: SAMEORIGIN
                                                        x-xss-protection: 1; mode=block
                                                        x-content-type-options: nosniff
                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload;
                                                        referrer-policy: no-referrer-when-downgrade
                                                        connection: close


                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:17:42:13
                                                        Start date:26/04/2023
                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ref#298409_bill_attached_.htm
                                                        Imagebase:0x7ff60cad0000
                                                        File size:2509656 bytes
                                                        MD5 hash:464953824E644F10FFDC9E093FD18F94
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:moderate

                                                        General

                                                        Target ID:1
                                                        Start time:17:42:13
                                                        Start date:26/04/2023
                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1696,1683236938277017309,9799927179460367727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8
                                                        Imagebase:0x7ff60cad0000
                                                        File size:2509656 bytes
                                                        MD5 hash:464953824E644F10FFDC9E093FD18F94
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:moderate

                                                        Disassembly

                                                        ⊘No disassembly