Joe Sandbox Cloud Basic Analysis Report
Create Interactive Tour

Windows Analysis Report
https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167

Overview

General Information

Sample URL:https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167
Analysis ID:1332543
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Creates files inside the system directory

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • chrome.exe (PID: 6672 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • chrome.exe (PID: 1292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2112,i,2944723603810662615,16248398350290081726,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • chrome.exe (PID: 6500 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

  • • Phishing
  • • Compliance
  • • Networking
  • • System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167HTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.220.136.112:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.220.136.112:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknownDNS traffic detected: queries for: accounts.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 23.220.136.112
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 20.7.2.167
Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.134Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167 HTTP/1.1Host: braze-images.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: braze-images.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=a7NyMBvF2Ul4N3w&MD=Fz9L9dfg HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=a7NyMBvF2Ul4N3w&MD=Fz9L9dfg HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 26 Oct 2023 08:50:10 GMTContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closex-amz-request-id: 2347PHZX9CNS1HD2x-amz-id-2: XdrvUj7ZZZceGvO8v8Nf7YgoV1ldn10+T8qvugxLxUwYM+D6T6wmDCIMrF97crvOfck516aGblw=CF-Cache-Status: MISSServer: cloudflareCF-RAY: 81c1733f1e9520d5-IAD
Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2023-10-05-06; NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.220.136.112:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.220.136.112:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.7.2.167:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_BITS_6672_129995130Jump to behavior
Source: classification engineClassification label: clean0.win@16/2@8/6
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2112,i,2944723603810662615,16248398350290081726,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2112,i,2944723603810662615,16248398350290081726,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth4
Non-Application Layer Protocol		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration5
Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer3
Ingress Tool Transfer		SIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1332543 URL: https://braze-images.com/ap... Startdate: 26/10/2023 Architecture: WINDOWS Score: 0 5 chrome.exe 1 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.6, 443, 49457, 49703 unknown unknown 5->13 15 239.255.255.250 unknown Reserved 5->15 10 chrome.exe 5->10         started        process4 dnsIp5 17 www.google.com 142.251.16.106, 443, 49725, 49739 GOOGLEUS United States 10->17 19 accounts.google.com 142.251.16.84, 443, 49716 GOOGLEUS United States 10->19 21 3 other IPs or domains 10->21

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?16662181670%Avira URL Cloudsafe
https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?16662181670%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
braze-images.com0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://braze-images.com/favicon.ico0%Avira URL Cloudsafe
https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?16662181670%VirustotalBrowse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
accounts.google.com
142.251.16.84
truefalse
    		high
    braze-images.com
    		104.19.152.69
    		truefalseunknown
    www.google.com
    		142.251.16.106
    		truefalse
      		high
      clients.l.google.com
      		172.253.115.139
      		truefalse
        		high
        clients2.google.com
        		unknown
        		unknownfalse
          		high

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167falseunknown
          https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1false
            		high
            https://braze-images.com/favicon.icofalse
            • Avira URL Cloud: safe
            		unknown
            https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167falseunknown
            https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
              		high

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              172.253.115.139
              		clients.l.google.comUnited States
              		15169GOOGLEUSfalse
              239.255.255.250
              		unknownReserved
              		unknownunknownfalse
              104.19.152.69
              		braze-images.comUnited States
              		13335CLOUDFLARENETUSfalse
              142.251.16.84
              		accounts.google.comUnited States
              		15169GOOGLEUSfalse
              142.251.16.106
              		www.google.comUnited States
              		15169GOOGLEUSfalse

              Private

              IP
              192.168.2.6

              General Information

              Joe Sandbox Version:38.0.0 Ammolite
              Analysis ID:1332543
              Start date and time:2023-10-26 10:49:14 +02:00
              Joe Sandbox Product:CloudBasic
              Overall analysis duration:0h 2m 57s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:browseurl.jbs
              Sample URL:https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167
              Analysis system description:Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:6
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Detection:CLEAN
              Classification:clean0.win@16/2@8/6
              EGA Information:Failed
              HCA Information:
              • Successful, ratio: 100%
              • Number of executed functions: 0
              • Number of non-executed functions: 0
              • Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
              • Excluded IPs from analysis (whitelisted): 142.251.167.94, 34.104.35.123, 192.229.211.108, 142.250.31.94
              • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com
              • Not all processes where analyzed, report is missing behavior information

              Simulations

              Behavior and APIs

              ⊘No simulations

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              ⊘No context

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              Chrome Cache Entry: 46

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:RIFF (little-endian) data, Web/P image
              Category:downloaded
              Size (bytes):1370
              Entropy (8bit):7.783972115300733
              Encrypted:false
              SSDEEP:24:jsKL6JfEG3/99XwkTg6UlCBinXzBfDNBThVnS8gTB0CRY0+kKDl5S:FL0fT3/LXZACBinNNNjZgFd+5Dlg
              MD5:6C8B8AEA7BC5B62214689E23C16AD522
              SHA1:2B58D3773F3E4F631030423A7EA40A64494C1546
              SHA-256:5234ECBAB2FD7742A010266249826382054910A3D573BC251B0A65A8DFE6BB4F
              SHA-512:A8AF838EE28D35C5196C140187BCCADAE6B5D5C31632B0BACAA92A1EEBD602F2B31097A1C2410B19FC370FAC06F518B48AF0227A0621C9DD92161B3DC9E80A97
              Malicious:false
              Reputation:low
              URL:https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167
              Preview:RIFFR...WEBPVP8LE.../.@... .L./....?A.-..^.I.j;.5...y...m+j...I.&.....*.....O.>5,..:......a...x\.L=3`..r..&W.n.*,...70.M...w.k......,....%...b.z..\.;l.&......}.*#...L.+.+l...b...a..7.s......FS0..0.4.[.P/.G.).{....$).?Z3.%.Z..T1.*1s.F....=q..`...;.e...%,.v.S..IP..U....%M...+.-..i..+.&ipz+S.=.E\....u{"......D...6..4....l]W... K2.rJ.....I2.......m.......1S...<JJ..)....%s.(...t..GI.....<J.9...7Iw`.....e.....(.....4..L...).H..&...t.;......K...U.@h...d....2...../.K..\.i..sUG H+. ...$.......L.[.4B.M`.-@....F..aW3.vZ\.O..B{z].L2."..I...*piD`hT.O^*.<tLP.D....~NX2O.a...F.vi.L2.Z..+..I.sp;.!..Iq-<]F]...>..r.T.Z.......{.1.V......=.u..TX2'f.F..F.g.$.@jD 6B..0.4C.z..$...5..Jh8.O.p..."..u\.X...P.b..~.B.[.q9.@V;...B%.......dN.(s....s..+.&.20uD..I.;0I....!..d..:..x..LM.`....lj.pn...~.{...~.....P...g.xH.....$i......Cp.R..ja.}......L.%...D..$.v....$...Z..4......>H.O.[..J..{%G.;d.J...C.Q.H1m......y...d._.t..S.,H..j235.B...<...1FSw.q.z..!.Lu..r.....9?.a.....M...]..+

              Chrome Cache Entry: 47

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:XML 1.0 document, ASCII text
              Category:downloaded
              Size (bytes):243
              Entropy (8bit):5.562270514417369
              Encrypted:false
              SSDEEP:6:TMVBd/ZbZjZvKtWRVzjrHZA00XBmJ0yFfan:TMHd9BZKtWRFZh0XBuTFfa
              MD5:07802926B0F5A9988A6D57A3E22D5420
              SHA1:1F6793805A6B75749283F1E09DEF29A89F10A717
              SHA-256:4F59B9BB8746532A83994F1700CD6F8E8418E924BD0A6C0065FBE74B2D8E1326
              SHA-512:537E22B1E95CE863DAE24E0C4A6FE5EB4AF22DC3E470C761AB40EBE6DD8542867C1AE29CAB22564A5921F470234590134896CA24551EC92B3265AF96C714DCD8
              Malicious:false
              Reputation:low
              URL:https://braze-images.com/favicon.ico
              Preview:<?xml version="1.0" encoding="UTF-8"?>.<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>2347PHZX9CNS1HD2</RequestId><HostId>XdrvUj7ZZZceGvO8v8Nf7YgoV1ldn10+T8qvugxLxUwYM+D6T6wmDCIMrF97crvOfck516aGblw=</HostId></Error>

              Static File Info

              ⊘No static file info

              Network Behavior

              Download Network PCAP: filtered – full

              Network Port Distribution

              • Total Packets: 198
              • • 443 (HTTPS)
              • • 80 (HTTP)
              • • 53 (DNS)
              TimestampSource PortDest PortSource IPDest IP
              Oct 26, 2023 10:50:02.625880003 CEST49673443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:02.625893116 CEST49674443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:02.969669104 CEST49672443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:08.068506002 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:08.068675995 CEST49712443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:08.823404074 CEST49716443192.168.2.6142.251.16.84
              Oct 26, 2023 10:50:08.823432922 CEST44349716142.251.16.84192.168.2.6
              Oct 26, 2023 10:50:08.823513031 CEST49716443192.168.2.6142.251.16.84
              Oct 26, 2023 10:50:08.824136019 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:08.824148893 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:08.824199915 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:08.824973106 CEST49716443192.168.2.6142.251.16.84
              Oct 26, 2023 10:50:08.824990988 CEST44349716142.251.16.84192.168.2.6
              Oct 26, 2023 10:50:08.825139999 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:08.825150013 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:09.071852922 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:09.072237968 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:09.072247028 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:09.072895050 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:09.072956085 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:09.073990107 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:09.074043989 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:09.075706005 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:09.075815916 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:09.076159000 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:09.076165915 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:09.092288971 CEST44349716142.251.16.84192.168.2.6
              Oct 26, 2023 10:50:09.092506886 CEST49716443192.168.2.6142.251.16.84
              Oct 26, 2023 10:50:09.092519045 CEST44349716142.251.16.84192.168.2.6
              Oct 26, 2023 10:50:09.094149113 CEST44349716142.251.16.84192.168.2.6
              Oct 26, 2023 10:50:09.094221115 CEST49716443192.168.2.6142.251.16.84
              Oct 26, 2023 10:50:09.095077991 CEST49716443192.168.2.6142.251.16.84
              Oct 26, 2023 10:50:09.095160007 CEST44349716142.251.16.84192.168.2.6
              Oct 26, 2023 10:50:09.095272064 CEST49716443192.168.2.6142.251.16.84
              Oct 26, 2023 10:50:09.095280886 CEST44349716142.251.16.84192.168.2.6
              Oct 26, 2023 10:50:09.189541101 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:09.296390057 CEST49716443192.168.2.6142.251.16.84
              Oct 26, 2023 10:50:09.297456026 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:09.297900915 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:09.297961950 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:09.298299074 CEST49718443192.168.2.6172.253.115.139
              Oct 26, 2023 10:50:09.298310041 CEST44349718172.253.115.139192.168.2.6
              Oct 26, 2023 10:50:09.377863884 CEST44349716142.251.16.84192.168.2.6
              Oct 26, 2023 10:50:09.378338099 CEST44349716142.251.16.84192.168.2.6
              Oct 26, 2023 10:50:09.378400087 CEST49716443192.168.2.6142.251.16.84
              Oct 26, 2023 10:50:09.378942966 CEST49716443192.168.2.6142.251.16.84
              Oct 26, 2023 10:50:09.378958941 CEST44349716142.251.16.84192.168.2.6
              Oct 26, 2023 10:50:09.886018038 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:09.886053085 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:09.886127949 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:09.887217045 CEST49722443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:09.887262106 CEST44349722104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:09.887317896 CEST49722443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:09.887770891 CEST49722443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:09.887788057 CEST44349722104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:09.888005972 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:09.888022900 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.116655111 CEST44349722104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.117037058 CEST49722443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.117065907 CEST44349722104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.118565083 CEST44349722104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.118644953 CEST49722443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.119694948 CEST49722443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.119808912 CEST44349722104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.119921923 CEST49722443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.119932890 CEST44349722104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.121078968 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.121260881 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.121284008 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.122715950 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.122776985 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.123572111 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.123652935 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.173351049 CEST49722443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.298487902 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.298513889 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.345247030 CEST44349722104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.345607042 CEST44349722104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.345685005 CEST49722443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.346153975 CEST49722443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.346184015 CEST44349722104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.346316099 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.383245945 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.426470041 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.505335093 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.505639076 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:10.505697966 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.506170034 CEST49721443192.168.2.6104.19.152.69
              Oct 26, 2023 10:50:10.506181955 CEST44349721104.19.152.69192.168.2.6
              Oct 26, 2023 10:50:11.095463037 CEST49725443192.168.2.6142.251.16.106
              Oct 26, 2023 10:50:11.095510960 CEST44349725142.251.16.106192.168.2.6
              Oct 26, 2023 10:50:11.095565081 CEST49725443192.168.2.6142.251.16.106
              Oct 26, 2023 10:50:11.096106052 CEST49725443192.168.2.6142.251.16.106
              Oct 26, 2023 10:50:11.096122026 CEST44349725142.251.16.106192.168.2.6
              Oct 26, 2023 10:50:11.323498011 CEST44349725142.251.16.106192.168.2.6
              Oct 26, 2023 10:50:11.323822021 CEST49725443192.168.2.6142.251.16.106
              Oct 26, 2023 10:50:11.323832989 CEST44349725142.251.16.106192.168.2.6
              Oct 26, 2023 10:50:11.325460911 CEST44349725142.251.16.106192.168.2.6
              Oct 26, 2023 10:50:11.325536966 CEST49725443192.168.2.6142.251.16.106
              Oct 26, 2023 10:50:11.326656103 CEST49725443192.168.2.6142.251.16.106
              Oct 26, 2023 10:50:11.326736927 CEST44349725142.251.16.106192.168.2.6
              Oct 26, 2023 10:50:11.374507904 CEST49725443192.168.2.6142.251.16.106
              Oct 26, 2023 10:50:11.374516964 CEST44349725142.251.16.106192.168.2.6
              Oct 26, 2023 10:50:11.421376944 CEST49725443192.168.2.6142.251.16.106
              Oct 26, 2023 10:50:11.743577003 CEST49727443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:11.743612051 CEST4434972720.7.2.167192.168.2.6
              Oct 26, 2023 10:50:11.743670940 CEST49727443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:11.744798899 CEST49727443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:11.744816065 CEST4434972720.7.2.167192.168.2.6
              Oct 26, 2023 10:50:12.064625978 CEST4434972720.7.2.167192.168.2.6
              Oct 26, 2023 10:50:12.064760923 CEST49727443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:12.074167013 CEST49727443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:12.074177980 CEST4434972720.7.2.167192.168.2.6
              Oct 26, 2023 10:50:12.074646950 CEST4434972720.7.2.167192.168.2.6
              Oct 26, 2023 10:50:12.076777935 CEST49727443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:12.076807976 CEST49727443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:12.076817036 CEST4434972720.7.2.167192.168.2.6
              Oct 26, 2023 10:50:12.077029943 CEST49727443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:12.118484974 CEST4434972720.7.2.167192.168.2.6
              Oct 26, 2023 10:50:12.176167011 CEST4434972720.7.2.167192.168.2.6
              Oct 26, 2023 10:50:12.176268101 CEST4434972720.7.2.167192.168.2.6
              Oct 26, 2023 10:50:12.176425934 CEST49727443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:12.176556110 CEST49727443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:12.176573038 CEST4434972720.7.2.167192.168.2.6
              Oct 26, 2023 10:50:12.235516071 CEST49674443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:12.235519886 CEST49673443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:12.579288006 CEST49672443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:13.519758940 CEST49728443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.519802094 CEST4434972823.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.519882917 CEST49728443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.522758961 CEST49728443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.522799015 CEST4434972823.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.732964993 CEST4434972823.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.733102083 CEST49728443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.737323999 CEST49728443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.737338066 CEST4434972823.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.737814903 CEST4434972823.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.780437946 CEST49728443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.829045057 CEST49728443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.870492935 CEST4434972823.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.923784018 CEST4434972823.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.923865080 CEST4434972823.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.923927069 CEST49728443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.924041986 CEST49728443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.924057007 CEST4434972823.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.924068928 CEST49728443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.924074888 CEST4434972823.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.959050894 CEST49729443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.959074974 CEST4434972923.220.136.112192.168.2.6
              Oct 26, 2023 10:50:13.959148884 CEST49729443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.959616899 CEST49729443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:13.959626913 CEST4434972923.220.136.112192.168.2.6
              Oct 26, 2023 10:50:14.151446104 CEST4434972923.220.136.112192.168.2.6
              Oct 26, 2023 10:50:14.151571989 CEST49729443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:14.153023005 CEST49729443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:14.153028011 CEST4434972923.220.136.112192.168.2.6
              Oct 26, 2023 10:50:14.153250933 CEST4434972923.220.136.112192.168.2.6
              Oct 26, 2023 10:50:14.154484987 CEST49729443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:14.202451944 CEST4434972923.220.136.112192.168.2.6
              Oct 26, 2023 10:50:14.340893030 CEST4434972923.220.136.112192.168.2.6
              Oct 26, 2023 10:50:14.340981960 CEST4434972923.220.136.112192.168.2.6
              Oct 26, 2023 10:50:14.341094017 CEST49729443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:14.355581999 CEST49729443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:14.355595112 CEST4434972923.220.136.112192.168.2.6
              Oct 26, 2023 10:50:14.355626106 CEST49729443192.168.2.623.220.136.112
              Oct 26, 2023 10:50:14.355633974 CEST4434972923.220.136.112192.168.2.6
              Oct 26, 2023 10:50:19.805675030 CEST49730443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:19.805766106 CEST4434973020.7.2.167192.168.2.6
              Oct 26, 2023 10:50:19.805880070 CEST49730443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:19.806624889 CEST49730443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:19.806658030 CEST4434973020.7.2.167192.168.2.6
              Oct 26, 2023 10:50:20.108516932 CEST4434973020.7.2.167192.168.2.6
              Oct 26, 2023 10:50:20.108772993 CEST49730443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:20.130861998 CEST49730443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:20.130944967 CEST4434973020.7.2.167192.168.2.6
              Oct 26, 2023 10:50:20.131192923 CEST4434973020.7.2.167192.168.2.6
              Oct 26, 2023 10:50:20.150640011 CEST49730443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:20.150930882 CEST49730443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:20.150984049 CEST4434973020.7.2.167192.168.2.6
              Oct 26, 2023 10:50:20.151071072 CEST49730443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:20.198468924 CEST4434973020.7.2.167192.168.2.6
              Oct 26, 2023 10:50:20.249253988 CEST4434973020.7.2.167192.168.2.6
              Oct 26, 2023 10:50:20.249337912 CEST4434973020.7.2.167192.168.2.6
              Oct 26, 2023 10:50:20.249442101 CEST49730443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:20.255120993 CEST49730443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:20.255188942 CEST4434973020.7.2.167192.168.2.6
              Oct 26, 2023 10:50:21.317214012 CEST44349725142.251.16.106192.168.2.6
              Oct 26, 2023 10:50:21.317349911 CEST44349725142.251.16.106192.168.2.6
              Oct 26, 2023 10:50:21.317425966 CEST49725443192.168.2.6142.251.16.106
              Oct 26, 2023 10:50:21.318888903 CEST49725443192.168.2.6142.251.16.106
              Oct 26, 2023 10:50:21.318912983 CEST44349725142.251.16.106192.168.2.6
              Oct 26, 2023 10:50:22.941797972 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:22.941838980 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:22.941900969 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:22.944643974 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:22.944658995 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:23.302583933 CEST49712443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:23.458647966 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:23.459505081 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:23.459517956 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:23.459537029 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:23.459548950 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:23.459598064 CEST49712443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:23.459619999 CEST49712443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:23.527527094 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:23.527659893 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:23.529069901 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:23.529074907 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:23.529548883 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:23.577392101 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:23.641637087 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:23.682476997 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:23.808073044 CEST49712443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:23.964051008 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:23.964453936 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:23.964525938 CEST49712443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:24.055386066 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:24.055449009 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:24.055470943 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:24.055510044 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:24.055524111 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:24.055541992 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:24.055558920 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:24.055563927 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:24.055578947 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:24.055600882 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:24.055680990 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:24.055742979 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:24.055748940 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:24.055870056 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:24.055919886 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:24.075531006 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:24.075545073 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:24.075563908 CEST49731443192.168.2.640.68.123.157
              Oct 26, 2023 10:50:24.075572014 CEST4434973140.68.123.157192.168.2.6
              Oct 26, 2023 10:50:30.512238026 CEST49733443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:30.512281895 CEST4434973320.7.2.167192.168.2.6
              Oct 26, 2023 10:50:30.512356997 CEST49733443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:30.513510942 CEST49733443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:30.513542891 CEST4434973320.7.2.167192.168.2.6
              Oct 26, 2023 10:50:30.830961943 CEST4434973320.7.2.167192.168.2.6
              Oct 26, 2023 10:50:30.831103086 CEST49733443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:30.832870007 CEST49733443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:30.832884073 CEST4434973320.7.2.167192.168.2.6
              Oct 26, 2023 10:50:30.833909035 CEST4434973320.7.2.167192.168.2.6
              Oct 26, 2023 10:50:30.835694075 CEST49733443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:30.835767031 CEST49733443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:30.835774899 CEST4434973320.7.2.167192.168.2.6
              Oct 26, 2023 10:50:30.835927963 CEST49733443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:30.878458023 CEST4434973320.7.2.167192.168.2.6
              Oct 26, 2023 10:50:30.949414015 CEST4434973320.7.2.167192.168.2.6
              Oct 26, 2023 10:50:30.949625015 CEST4434973320.7.2.167192.168.2.6
              Oct 26, 2023 10:50:30.949748039 CEST49733443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:30.949835062 CEST49733443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:30.949855089 CEST4434973320.7.2.167192.168.2.6
              Oct 26, 2023 10:50:33.963840961 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:33.963965893 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:33.963983059 CEST49712443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:33.964015007 CEST44349712173.222.162.64192.168.2.6
              Oct 26, 2023 10:50:33.964025021 CEST49712443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:33.964067936 CEST49712443192.168.2.6173.222.162.64
              Oct 26, 2023 10:50:41.653870106 CEST49734443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:41.653898001 CEST4434973420.7.2.167192.168.2.6
              Oct 26, 2023 10:50:41.654016972 CEST49734443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:41.654839993 CEST49734443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:41.654851913 CEST4434973420.7.2.167192.168.2.6
              Oct 26, 2023 10:50:41.955849886 CEST4434973420.7.2.167192.168.2.6
              Oct 26, 2023 10:50:41.956111908 CEST49734443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:41.957715034 CEST49734443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:41.957725048 CEST4434973420.7.2.167192.168.2.6
              Oct 26, 2023 10:50:41.957983017 CEST4434973420.7.2.167192.168.2.6
              Oct 26, 2023 10:50:41.959654093 CEST49734443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:41.959742069 CEST49734443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:41.959748030 CEST4434973420.7.2.167192.168.2.6
              Oct 26, 2023 10:50:41.959852934 CEST49734443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:42.006447077 CEST4434973420.7.2.167192.168.2.6
              Oct 26, 2023 10:50:42.059117079 CEST4434973420.7.2.167192.168.2.6
              Oct 26, 2023 10:50:42.059221029 CEST4434973420.7.2.167192.168.2.6
              Oct 26, 2023 10:50:42.059282064 CEST49734443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:42.059561014 CEST49734443192.168.2.620.7.2.167
              Oct 26, 2023 10:50:42.059570074 CEST4434973420.7.2.167192.168.2.6
              Oct 26, 2023 10:50:52.906024933 CEST4970380192.168.2.6104.66.243.145
              Oct 26, 2023 10:50:52.906141996 CEST49704443192.168.2.623.0.21.203
              Oct 26, 2023 10:50:52.999182940 CEST4434970423.0.21.203192.168.2.6
              Oct 26, 2023 10:50:52.999243975 CEST4434970423.0.21.203192.168.2.6
              Oct 26, 2023 10:50:52.999373913 CEST49704443192.168.2.623.0.21.203
              Oct 26, 2023 10:50:52.999404907 CEST49704443192.168.2.623.0.21.203
              Oct 26, 2023 10:50:53.004842997 CEST8049703104.66.243.145192.168.2.6
              Oct 26, 2023 10:50:53.004903078 CEST4970380192.168.2.6104.66.243.145
              Oct 26, 2023 10:50:54.187654018 CEST4971480192.168.2.672.21.81.240
              Oct 26, 2023 10:50:54.280417919 CEST804971472.21.81.240192.168.2.6
              Oct 26, 2023 10:50:54.283739090 CEST4971480192.168.2.672.21.81.240
              Oct 26, 2023 10:50:54.284679890 CEST49713443192.168.2.6204.79.197.200
              Oct 26, 2023 10:51:00.651384115 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:00.651438951 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:00.651535034 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:00.652470112 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:00.652501106 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.197257996 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.197392941 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:01.198710918 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:01.198740005 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.198961020 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.200851917 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:01.242466927 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.720967054 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.720993042 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.721005917 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.721103907 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:01.721164942 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.721191883 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.721225023 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:01.721246004 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.721266031 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.721270084 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:01.721292973 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:01.721311092 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:01.727943897 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:01.727979898 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:01.728005886 CEST49736443192.168.2.640.68.123.157
              Oct 26, 2023 10:51:01.728020906 CEST4434973640.68.123.157192.168.2.6
              Oct 26, 2023 10:51:02.602565050 CEST49737443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:02.602602959 CEST4434973720.7.2.167192.168.2.6
              Oct 26, 2023 10:51:02.602720976 CEST49737443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:02.603702068 CEST49737443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:02.603718042 CEST4434973720.7.2.167192.168.2.6
              Oct 26, 2023 10:51:02.906866074 CEST4434973720.7.2.167192.168.2.6
              Oct 26, 2023 10:51:02.906953096 CEST49737443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:02.909373045 CEST49737443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:02.909379005 CEST4434973720.7.2.167192.168.2.6
              Oct 26, 2023 10:51:02.909579039 CEST4434973720.7.2.167192.168.2.6
              Oct 26, 2023 10:51:02.911428928 CEST49737443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:02.911539078 CEST49737443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:02.911545038 CEST4434973720.7.2.167192.168.2.6
              Oct 26, 2023 10:51:02.911689997 CEST49737443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:02.958455086 CEST4434973720.7.2.167192.168.2.6
              Oct 26, 2023 10:51:03.010200024 CEST4434973720.7.2.167192.168.2.6
              Oct 26, 2023 10:51:03.010268927 CEST4434973720.7.2.167192.168.2.6
              Oct 26, 2023 10:51:03.010443926 CEST49737443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:03.010730028 CEST49737443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:03.010759115 CEST4434973720.7.2.167192.168.2.6
              Oct 26, 2023 10:51:11.063422918 CEST49739443192.168.2.6142.251.16.106
              Oct 26, 2023 10:51:11.063515902 CEST44349739142.251.16.106192.168.2.6
              Oct 26, 2023 10:51:11.063630104 CEST49739443192.168.2.6142.251.16.106
              Oct 26, 2023 10:51:11.064029932 CEST49739443192.168.2.6142.251.16.106
              Oct 26, 2023 10:51:11.064065933 CEST44349739142.251.16.106192.168.2.6
              Oct 26, 2023 10:51:11.287683964 CEST44349739142.251.16.106192.168.2.6
              Oct 26, 2023 10:51:11.288151979 CEST49739443192.168.2.6142.251.16.106
              Oct 26, 2023 10:51:11.288183928 CEST44349739142.251.16.106192.168.2.6
              Oct 26, 2023 10:51:11.288866997 CEST44349739142.251.16.106192.168.2.6
              Oct 26, 2023 10:51:11.289354086 CEST49739443192.168.2.6142.251.16.106
              Oct 26, 2023 10:51:11.289453030 CEST44349739142.251.16.106192.168.2.6
              Oct 26, 2023 10:51:11.343388081 CEST49739443192.168.2.6142.251.16.106
              Oct 26, 2023 10:51:11.764094114 CEST49740443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:11.764158964 CEST4434974020.7.2.167192.168.2.6
              Oct 26, 2023 10:51:11.764260054 CEST49740443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:11.765388966 CEST49740443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:11.765403032 CEST4434974020.7.2.167192.168.2.6
              Oct 26, 2023 10:51:12.068160057 CEST4434974020.7.2.167192.168.2.6
              Oct 26, 2023 10:51:12.068274021 CEST49740443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:12.070533037 CEST49740443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:12.070542097 CEST4434974020.7.2.167192.168.2.6
              Oct 26, 2023 10:51:12.070776939 CEST4434974020.7.2.167192.168.2.6
              Oct 26, 2023 10:51:12.072539091 CEST49740443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:12.072619915 CEST49740443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:12.072627068 CEST4434974020.7.2.167192.168.2.6
              Oct 26, 2023 10:51:12.072804928 CEST49740443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:12.114456892 CEST4434974020.7.2.167192.168.2.6
              Oct 26, 2023 10:51:12.173078060 CEST4434974020.7.2.167192.168.2.6
              Oct 26, 2023 10:51:12.173156977 CEST4434974020.7.2.167192.168.2.6
              Oct 26, 2023 10:51:12.173244953 CEST49740443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:12.173471928 CEST49740443192.168.2.620.7.2.167
              Oct 26, 2023 10:51:12.173500061 CEST4434974020.7.2.167192.168.2.6
              Oct 26, 2023 10:51:21.368719101 CEST44349739142.251.16.106192.168.2.6
              Oct 26, 2023 10:51:21.368855953 CEST44349739142.251.16.106192.168.2.6
              Oct 26, 2023 10:51:21.368921995 CEST49739443192.168.2.6142.251.16.106
              Oct 26, 2023 10:51:22.955367088 CEST49739443192.168.2.6142.251.16.106
              Oct 26, 2023 10:51:22.955394030 CEST44349739142.251.16.106192.168.2.6
              TimestampSource PortDest PortSource IPDest IP
              Oct 26, 2023 10:50:08.727271080 CEST5030753192.168.2.61.1.1.1
              Oct 26, 2023 10:50:08.727515936 CEST5380453192.168.2.61.1.1.1
              Oct 26, 2023 10:50:08.727982998 CEST4945753192.168.2.61.1.1.1
              Oct 26, 2023 10:50:08.728184938 CEST6038153192.168.2.61.1.1.1
              Oct 26, 2023 10:50:08.819892883 CEST53523901.1.1.1192.168.2.6
              Oct 26, 2023 10:50:08.820645094 CEST53503071.1.1.1192.168.2.6
              Oct 26, 2023 10:50:08.820960045 CEST53538041.1.1.1192.168.2.6
              Oct 26, 2023 10:50:08.821372986 CEST53603811.1.1.1192.168.2.6
              Oct 26, 2023 10:50:08.821438074 CEST53494571.1.1.1192.168.2.6
              Oct 26, 2023 10:50:09.434396982 CEST53549691.1.1.1192.168.2.6
              Oct 26, 2023 10:50:09.785914898 CEST5036753192.168.2.61.1.1.1
              Oct 26, 2023 10:50:09.786228895 CEST5533953192.168.2.61.1.1.1
              Oct 26, 2023 10:50:09.879514933 CEST53503671.1.1.1192.168.2.6
              Oct 26, 2023 10:50:09.879740000 CEST53553391.1.1.1192.168.2.6
              Oct 26, 2023 10:50:11.000416994 CEST5529153192.168.2.61.1.1.1
              Oct 26, 2023 10:50:11.000696898 CEST6442553192.168.2.61.1.1.1
              Oct 26, 2023 10:50:11.093863010 CEST53552911.1.1.1192.168.2.6
              Oct 26, 2023 10:50:11.094198942 CEST53644251.1.1.1192.168.2.6
              Oct 26, 2023 10:50:26.452984095 CEST53512891.1.1.1192.168.2.6
              Oct 26, 2023 10:50:45.677813053 CEST53510681.1.1.1192.168.2.6
              Oct 26, 2023 10:51:08.308491945 CEST53614111.1.1.1192.168.2.6
              Oct 26, 2023 10:51:08.428385973 CEST53649051.1.1.1192.168.2.6

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Oct 26, 2023 10:50:08.727271080 CEST192.168.2.61.1.1.10xafa0Standard query (0)accounts.google.comA (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:08.727515936 CEST192.168.2.61.1.1.10x779Standard query (0)accounts.google.com65IN (0x0001)false
              Oct 26, 2023 10:50:08.727982998 CEST192.168.2.61.1.1.10x7b60Standard query (0)clients2.google.comA (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:08.728184938 CEST192.168.2.61.1.1.10xb272Standard query (0)clients2.google.com65IN (0x0001)false
              Oct 26, 2023 10:50:09.785914898 CEST192.168.2.61.1.1.10xbbc4Standard query (0)braze-images.comA (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:09.786228895 CEST192.168.2.61.1.1.10x1997Standard query (0)braze-images.com65IN (0x0001)false
              Oct 26, 2023 10:50:11.000416994 CEST192.168.2.61.1.1.10x3dc8Standard query (0)www.google.comA (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:11.000696898 CEST192.168.2.61.1.1.10xa3d9Standard query (0)www.google.com65IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Oct 26, 2023 10:50:08.820645094 CEST1.1.1.1192.168.2.60xafa0No error (0)accounts.google.com142.251.16.84A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:08.821372986 CEST1.1.1.1192.168.2.60xb272No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
              Oct 26, 2023 10:50:08.821438074 CEST1.1.1.1192.168.2.60x7b60No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
              Oct 26, 2023 10:50:08.821438074 CEST1.1.1.1192.168.2.60x7b60No error (0)clients.l.google.com172.253.115.139A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:08.821438074 CEST1.1.1.1192.168.2.60x7b60No error (0)clients.l.google.com172.253.115.138A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:08.821438074 CEST1.1.1.1192.168.2.60x7b60No error (0)clients.l.google.com172.253.115.113A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:08.821438074 CEST1.1.1.1192.168.2.60x7b60No error (0)clients.l.google.com172.253.115.100A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:08.821438074 CEST1.1.1.1192.168.2.60x7b60No error (0)clients.l.google.com172.253.115.102A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:08.821438074 CEST1.1.1.1192.168.2.60x7b60No error (0)clients.l.google.com172.253.115.101A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:09.879514933 CEST1.1.1.1192.168.2.60xbbc4No error (0)braze-images.com104.19.152.69A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:09.879514933 CEST1.1.1.1192.168.2.60xbbc4No error (0)braze-images.com104.19.153.69A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:11.093863010 CEST1.1.1.1192.168.2.60x3dc8No error (0)www.google.com142.251.16.106A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:11.093863010 CEST1.1.1.1192.168.2.60x3dc8No error (0)www.google.com142.251.16.105A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:11.093863010 CEST1.1.1.1192.168.2.60x3dc8No error (0)www.google.com142.251.16.104A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:11.093863010 CEST1.1.1.1192.168.2.60x3dc8No error (0)www.google.com142.251.16.99A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:11.093863010 CEST1.1.1.1192.168.2.60x3dc8No error (0)www.google.com142.251.16.147A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:11.093863010 CEST1.1.1.1192.168.2.60x3dc8No error (0)www.google.com142.251.16.103A (IP address)IN (0x0001)false
              Oct 26, 2023 10:50:11.094198942 CEST1.1.1.1192.168.2.60xa3d9No error (0)www.google.com65IN (0x0001)false

              HTTP Request Dependency Graph

              • clients2.google.com
              • accounts.google.com
              • braze-images.com
              • https:
              • fs.microsoft.com
              • slscr.update.microsoft.com

              HTTPS Connections

              TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
              Oct 26, 2023 10:50:23.459537029 CEST173.222.162.64443192.168.2.649712CN=r.bing.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=USCN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=USWed Oct 18 22:32:40 CEST 2023 Wed Aug 12 02:00:00 CEST 2020Fri Jun 28 01:59:59 CEST 2024 Fri Jun 28 01:59:59 CEST 2024771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,028a2c9bd18a11de089ef85a160da29e4
              CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=USCN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=USWed Aug 12 02:00:00 CEST 2020Fri Jun 28 01:59:59 CEST 2024

              HTTPS Proxied Packets

              Session IDSource IPSource PortDestination IPDestination PortProcess
              0192.168.2.649718172.253.115.139443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:09 UTC0OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
              Host: clients2.google.com
              Connection: keep-alive
              X-Goog-Update-Interactivity: fg
              X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda
              X-Goog-Update-Updater: chromecrx-117.0.5938.134
              Sec-Fetch-Site: none
              Sec-Fetch-Mode: no-cors
              Sec-Fetch-Dest: empty
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept-Encoding: gzip, deflate, br
              Accept-Language: en-US,en;q=0.9


              Session IDSource IPSource PortDestination IPDestination PortProcess
              1192.168.2.649716142.251.16.84443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:09 UTC0OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
              Host: accounts.google.com
              Connection: keep-alive
              Content-Length: 1
              Origin: https://www.google.com
              Content-Type: application/x-www-form-urlencoded
              Sec-Fetch-Site: none
              Sec-Fetch-Mode: no-cors
              Sec-Fetch-Dest: empty
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept-Encoding: gzip, deflate, br
              Accept-Language: en-US,en;q=0.9
              Cookie: 1P_JAR=2023-10-05-06; NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
              2023-10-26 08:50:09 UTC1OUTData Raw: 20
              Data Ascii:


              Session IDSource IPSource PortDestination IPDestination PortProcess
              10192.168.2.64972923.220.136.112443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:14 UTC10OUTGET /fs/windows/config.json HTTP/1.1
              Connection: Keep-Alive
              Accept: */*
              Accept-Encoding: identity
              If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
              Range: bytes=0-2147483646
              User-Agent: Microsoft BITS/7.8
              Host: fs.microsoft.com
              2023-10-26 08:50:14 UTC10INHTTP/1.1 200 OK
              Content-Type: application/octet-stream
              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
              ApiVersion: Distribute 1.1
              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
              X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm
              Cache-Control: public, max-age=162928
              Date: Thu, 26 Oct 2023 08:50:14 GMT
              Content-Length: 55
              Connection: close
              X-CID: 2
              2023-10-26 08:50:14 UTC11INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
              Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


              Session IDSource IPSource PortDestination IPDestination PortProcess
              11192.168.2.64973020.7.2.167443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:20 UTC11OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 43 63 42 33 43 55 72 62 45 30 57 69 32 53 41 6f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 33 36 30 64 61 34 31 30 31 61 35 62 36 33 0d 0a 0d 0a
              Data Ascii: CNT 1 CON 305MS-CV: CcB3CUrbE0Wi2SAo.1Context: e0360da4101a5b63
              2023-10-26 08:50:20 UTC11OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
              Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
              2023-10-26 08:50:20 UTC11OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 43 63 42 33 43 55 72 62 45 30 57 69 32 53 41 6f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 33 36 30 64 61 34 31 30 31 61 35 62 36 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 5a 4a 75 67 36 74 63 69 61 7a 36 61 37 37 4e 76 6e 6c 68 6d 6b 73 7a 66 77 77 42 49 41 6b 6b 6e 72 77 6f 75 45 43 52 65 7a 65 2b 38 5a 33 61 6b 43 52 6d 4a 43 42 79 77 67 34 53 4a 36 69 33 55 58 59 30 71 79 4a 32 64 59 37 35 4c 4b 43 32 53 34 45 4b 34 75 6d 49 78 45 4a 41 66 38 36 51 73 4f 2b 4e 57 76 42 2f 43 79 30 5a
              Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: CcB3CUrbE0Wi2SAo.2Context: e0360da4101a5b63<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqZJug6tciaz6a77NvnlhmkszfwwBIAkknrwouECReze+8Z3akCRmJCBywg4SJ6i3UXY0qyJ2dY75LKC2S4EK4umIxEJAf86QsO+NWvB/Cy0Z
              2023-10-26 08:50:20 UTC12OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 43 63 42 33 43 55 72 62 45 30 57 69 32 53 41 6f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 33 36 30 64 61 34 31 30 31 61 35 62 36 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
              Data Ascii: BND 3 CON\WNS 0 197MS-CV: CcB3CUrbE0Wi2SAo.3Context: e0360da4101a5b63<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
              2023-10-26 08:50:20 UTC13INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
              Data Ascii: 202 1 CON 58
              2023-10-26 08:50:20 UTC13INData Raw: 4d 53 2d 43 56 3a 20 4a 67 7a 51 66 59 30 41 57 55 43 7a 2f 6c 6b 2f 59 58 64 71 44 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
              Data Ascii: MS-CV: JgzQfY0AWUCz/lk/YXdqDg.0Payload parsing failed.


              Session IDSource IPSource PortDestination IPDestination PortProcess
              12192.168.2.64973140.68.123.157443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:23 UTC13OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=a7NyMBvF2Ul4N3w&MD=Fz9L9dfg HTTP/1.1
              Connection: Keep-Alive
              Accept: */*
              User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
              Host: slscr.update.microsoft.com
              2023-10-26 08:50:24 UTC13INHTTP/1.1 200 OK
              Cache-Control: no-cache
              Pragma: no-cache
              Content-Type: application/octet-stream
              Expires: -1
              Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
              ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
              MS-CorrelationId: 5ed3961c-73b3-4c0d-a2d4-c60432201a72
              MS-RequestId: 4f62eece-1b75-413d-a80a-0bc9188b0079
              MS-CV: ctEOzLKMy0+0KMXc.0
              X-Microsoft-SLSClientCache: 2880
              Content-Disposition: attachment; filename=environment.cab
              X-Content-Type-Options: nosniff
              Date: Thu, 26 Oct 2023 08:50:23 GMT
              Connection: close
              Content-Length: 24490
              2023-10-26 08:50:24 UTC13INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
              Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
              2023-10-26 08:50:24 UTC29INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
              Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


              Session IDSource IPSource PortDestination IPDestination PortProcess
              13192.168.2.64973320.7.2.167443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:30 UTC37OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4b 71 69 6a 79 6a 4c 66 65 45 4b 68 2b 53 50 47 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 34 61 62 61 30 37 61 66 36 30 62 31 65 66 39 0d 0a 0d 0a
              Data Ascii: CNT 1 CON 305MS-CV: KqijyjLfeEKh+SPG.1Context: 64aba07af60b1ef9
              2023-10-26 08:50:30 UTC37OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
              Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
              2023-10-26 08:50:30 UTC38OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 4b 71 69 6a 79 6a 4c 66 65 45 4b 68 2b 53 50 47 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 34 61 62 61 30 37 61 66 36 30 62 31 65 66 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 5a 4a 75 67 36 74 63 69 61 7a 36 61 37 37 4e 76 6e 6c 68 6d 6b 73 7a 66 77 77 42 49 41 6b 6b 6e 72 77 6f 75 45 43 52 65 7a 65 2b 38 5a 33 61 6b 43 52 6d 4a 43 42 79 77 67 34 53 4a 36 69 33 55 58 59 30 71 79 4a 32 64 59 37 35 4c 4b 43 32 53 34 45 4b 34 75 6d 49 78 45 4a 41 66 38 36 51 73 4f 2b 4e 57 76 42 2f 43 79 30 5a
              Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: KqijyjLfeEKh+SPG.2Context: 64aba07af60b1ef9<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqZJug6tciaz6a77NvnlhmkszfwwBIAkknrwouECReze+8Z3akCRmJCBywg4SJ6i3UXY0qyJ2dY75LKC2S4EK4umIxEJAf86QsO+NWvB/Cy0Z
              2023-10-26 08:50:30 UTC39OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4b 71 69 6a 79 6a 4c 66 65 45 4b 68 2b 53 50 47 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 34 61 62 61 30 37 61 66 36 30 62 31 65 66 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
              Data Ascii: BND 3 CON\WNS 0 197MS-CV: KqijyjLfeEKh+SPG.3Context: 64aba07af60b1ef9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
              2023-10-26 08:50:30 UTC39INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
              Data Ascii: 202 1 CON 58
              2023-10-26 08:50:30 UTC39INData Raw: 4d 53 2d 43 56 3a 20 51 41 39 32 51 70 6c 62 61 30 53 47 45 51 70 51 4f 35 78 79 39 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
              Data Ascii: MS-CV: QA92Qplba0SGEQpQO5xy9A.0Payload parsing failed.


              Session IDSource IPSource PortDestination IPDestination PortProcess
              14192.168.2.64973420.7.2.167443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:41 UTC39OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 37 47 6e 6c 50 6e 32 77 79 55 43 78 50 5a 4c 33 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 33 34 34 65 37 64 63 64 62 39 38 65 61 0d 0a 0d 0a
              Data Ascii: CNT 1 CON 304MS-CV: 7GnlPn2wyUCxPZL3.1Context: c4344e7dcdb98ea
              2023-10-26 08:50:41 UTC39OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
              Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
              2023-10-26 08:50:41 UTC39OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 30 0d 0a 4d 53 2d 43 56 3a 20 37 47 6e 6c 50 6e 32 77 79 55 43 78 50 5a 4c 33 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 33 34 34 65 37 64 63 64 62 39 38 65 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 5a 4a 75 67 36 74 63 69 61 7a 36 61 37 37 4e 76 6e 6c 68 6d 6b 73 7a 66 77 77 42 49 41 6b 6b 6e 72 77 6f 75 45 43 52 65 7a 65 2b 38 5a 33 61 6b 43 52 6d 4a 43 42 79 77 67 34 53 4a 36 69 33 55 58 59 30 71 79 4a 32 64 59 37 35 4c 4b 43 32 53 34 45 4b 34 75 6d 49 78 45 4a 41 66 38 36 51 73 4f 2b 4e 57 76 42 2f 43 79 30 5a 76
              Data Ascii: ATH 2 CON\DEVICE 1040MS-CV: 7GnlPn2wyUCxPZL3.2Context: c4344e7dcdb98ea<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqZJug6tciaz6a77NvnlhmkszfwwBIAkknrwouECReze+8Z3akCRmJCBywg4SJ6i3UXY0qyJ2dY75LKC2S4EK4umIxEJAf86QsO+NWvB/Cy0Zv
              2023-10-26 08:50:41 UTC40OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 37 47 6e 6c 50 6e 32 77 79 55 43 78 50 5a 4c 33 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 33 34 34 65 37 64 63 64 62 39 38 65 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
              Data Ascii: BND 3 CON\WNS 0 196MS-CV: 7GnlPn2wyUCxPZL3.3Context: c4344e7dcdb98ea<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
              2023-10-26 08:50:42 UTC41INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
              Data Ascii: 202 1 CON 58
              2023-10-26 08:50:42 UTC41INData Raw: 4d 53 2d 43 56 3a 20 65 37 61 7a 45 77 78 46 77 6b 79 73 43 4d 46 69 56 67 32 67 6f 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
              Data Ascii: MS-CV: e7azEwxFwkysCMFiVg2gog.0Payload parsing failed.


              Session IDSource IPSource PortDestination IPDestination PortProcess
              15192.168.2.64973640.68.123.157443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:51:01 UTC41OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=a7NyMBvF2Ul4N3w&MD=Fz9L9dfg HTTP/1.1
              Connection: Keep-Alive
              Accept: */*
              User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
              Host: slscr.update.microsoft.com
              2023-10-26 08:51:01 UTC41INHTTP/1.1 200 OK
              Cache-Control: no-cache
              Pragma: no-cache
              Content-Type: application/octet-stream
              Expires: -1
              Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
              ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"
              MS-CorrelationId: c30c40e4-3e90-46e8-b173-350b16677056
              MS-RequestId: 911c80df-03d3-4444-86e0-3532060fbc21
              MS-CV: 1N+zkrJvskizAvtN.0
              X-Microsoft-SLSClientCache: 2160
              Content-Disposition: attachment; filename=environment.cab
              X-Content-Type-Options: nosniff
              Date: Thu, 26 Oct 2023 08:51:00 GMT
              Connection: close
              Content-Length: 25457
              2023-10-26 08:51:01 UTC41INData Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92
              Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
              2023-10-26 08:51:01 UTC57INData Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a
              Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq


              Session IDSource IPSource PortDestination IPDestination PortProcess
              16192.168.2.64973720.7.2.167443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:51:02 UTC66OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 55 46 75 71 78 64 45 66 6b 6b 47 54 5a 55 72 78 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 35 65 33 62 30 30 34 33 64 66 64 35 30 35 33 0d 0a 0d 0a
              Data Ascii: CNT 1 CON 305MS-CV: UFuqxdEfkkGTZUrx.1Context: e5e3b0043dfd5053
              2023-10-26 08:51:02 UTC66OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
              Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
              2023-10-26 08:51:02 UTC67OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 55 46 75 71 78 64 45 66 6b 6b 47 54 5a 55 72 78 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 35 65 33 62 30 30 34 33 64 66 64 35 30 35 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 5a 4a 75 67 36 74 63 69 61 7a 36 61 37 37 4e 76 6e 6c 68 6d 6b 73 7a 66 77 77 42 49 41 6b 6b 6e 72 77 6f 75 45 43 52 65 7a 65 2b 38 5a 33 61 6b 43 52 6d 4a 43 42 79 77 67 34 53 4a 36 69 33 55 58 59 30 71 79 4a 32 64 59 37 35 4c 4b 43 32 53 34 45 4b 34 75 6d 49 78 45 4a 41 66 38 36 51 73 4f 2b 4e 57 76 42 2f 43 79 30 5a
              Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: UFuqxdEfkkGTZUrx.2Context: e5e3b0043dfd5053<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqZJug6tciaz6a77NvnlhmkszfwwBIAkknrwouECReze+8Z3akCRmJCBywg4SJ6i3UXY0qyJ2dY75LKC2S4EK4umIxEJAf86QsO+NWvB/Cy0Z
              2023-10-26 08:51:02 UTC68OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 55 46 75 71 78 64 45 66 6b 6b 47 54 5a 55 72 78 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 35 65 33 62 30 30 34 33 64 66 64 35 30 35 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
              Data Ascii: BND 3 CON\WNS 0 197MS-CV: UFuqxdEfkkGTZUrx.3Context: e5e3b0043dfd5053<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
              2023-10-26 08:51:03 UTC68INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
              Data Ascii: 202 1 CON 58
              2023-10-26 08:51:03 UTC68INData Raw: 4d 53 2d 43 56 3a 20 57 35 78 66 61 34 62 67 6a 55 57 53 39 75 50 61 38 77 49 72 75 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
              Data Ascii: MS-CV: W5xfa4bgjUWS9uPa8wIruw.0Payload parsing failed.


              Session IDSource IPSource PortDestination IPDestination PortProcess
              17192.168.2.64974020.7.2.167443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:51:12 UTC68OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 72 47 4c 64 4b 7a 6e 56 55 55 4b 46 54 78 73 4c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 61 63 64 66 36 61 31 63 30 31 34 36 34 37 30 0d 0a 0d 0a
              Data Ascii: CNT 1 CON 305MS-CV: rGLdKznVUUKFTxsL.1Context: 2acdf6a1c0146470
              2023-10-26 08:51:12 UTC68OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
              Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
              2023-10-26 08:51:12 UTC68OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 72 47 4c 64 4b 7a 6e 56 55 55 4b 46 54 78 73 4c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 61 63 64 66 36 61 31 63 30 31 34 36 34 37 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 5a 4a 75 67 36 74 63 69 61 7a 36 61 37 37 4e 76 6e 6c 68 6d 6b 73 7a 66 77 77 42 49 41 6b 6b 6e 72 77 6f 75 45 43 52 65 7a 65 2b 38 5a 33 61 6b 43 52 6d 4a 43 42 79 77 67 34 53 4a 36 69 33 55 58 59 30 71 79 4a 32 64 59 37 35 4c 4b 43 32 53 34 45 4b 34 75 6d 49 78 45 4a 41 66 38 36 51 73 4f 2b 4e 57 76 42 2f 43 79 30 5a
              Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: rGLdKznVUUKFTxsL.2Context: 2acdf6a1c0146470<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqZJug6tciaz6a77NvnlhmkszfwwBIAkknrwouECReze+8Z3akCRmJCBywg4SJ6i3UXY0qyJ2dY75LKC2S4EK4umIxEJAf86QsO+NWvB/Cy0Z
              2023-10-26 08:51:12 UTC69OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 72 47 4c 64 4b 7a 6e 56 55 55 4b 46 54 78 73 4c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 61 63 64 66 36 61 31 63 30 31 34 36 34 37 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
              Data Ascii: BND 3 CON\WNS 0 197MS-CV: rGLdKznVUUKFTxsL.3Context: 2acdf6a1c0146470<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
              2023-10-26 08:51:12 UTC70INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
              Data Ascii: 202 1 CON 58
              2023-10-26 08:51:12 UTC70INData Raw: 4d 53 2d 43 56 3a 20 35 66 62 45 31 57 31 53 42 55 61 66 6b 6e 64 58 34 75 37 6b 75 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
              Data Ascii: MS-CV: 5fbE1W1SBUafkndX4u7kuQ.0Payload parsing failed.


              Session IDSource IPSource PortDestination IPDestination PortProcess
              2172.253.115.139443192.168.2.649718C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:09 UTC1INHTTP/1.1 200 OK
              Content-Security-Policy: script-src 'report-sample' 'nonce-0DID7p6X23Sag50dG0egFw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
              Cache-Control: no-cache, no-store, max-age=0, must-revalidate
              Pragma: no-cache
              Expires: Mon, 01 Jan 1990 00:00:00 GMT
              Date: Thu, 26 Oct 2023 08:50:09 GMT
              Content-Type: text/xml; charset=UTF-8
              X-Daynum: 6142
              X-Daystart: 6609
              X-Content-Type-Options: nosniff
              X-Frame-Options: SAMEORIGIN
              X-XSS-Protection: 1; mode=block
              Server: GSE
              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
              Accept-Ranges: none
              Vary: Accept-Encoding
              Connection: close
              Transfer-Encoding: chunked
              2023-10-26 08:50:09 UTC2INData Raw: 32 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 34 32 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 36 36 30 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20
              Data Ascii: 2c8<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6142" elapsed_seconds="6609"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
              2023-10-26 08:50:09 UTC2INData Raw: 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a
              Data Ascii: 3f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
              2023-10-26 08:50:09 UTC2INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortProcess
              3142.251.16.84443192.168.2.649716C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:09 UTC2INHTTP/1.1 200 OK
              Content-Type: application/json; charset=utf-8
              Access-Control-Allow-Origin: https://www.google.com
              Access-Control-Allow-Credentials: true
              X-Content-Type-Options: nosniff
              Cache-Control: no-cache, no-store, max-age=0, must-revalidate
              Pragma: no-cache
              Expires: Mon, 01 Jan 1990 00:00:00 GMT
              Date: Thu, 26 Oct 2023 08:50:09 GMT
              Strict-Transport-Security: max-age=31536000; includeSubDomains
              Content-Security-Policy: script-src 'report-sample' 'nonce-ulbqo3MiQJ35R2v4BnubdA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
              Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist
              Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
              Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
              Cross-Origin-Opener-Policy: same-origin
              Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
              Server: ESF
              X-XSS-Protection: 0
              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
              Accept-Ranges: none
              Vary: Accept-Encoding
              Connection: close
              Transfer-Encoding: chunked
              2023-10-26 08:50:09 UTC4INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
              Data Ascii: 11["gaia.l.a.r",[]]
              2023-10-26 08:50:09 UTC4INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortProcess
              4192.168.2.649722104.19.152.69443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:10 UTC4OUTGET /appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167 HTTP/1.1
              Host: braze-images.com
              Connection: keep-alive
              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
              sec-ch-ua-mobile: ?0
              sec-ch-ua-platform: "Windows"
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              Sec-Fetch-Site: none
              Sec-Fetch-Mode: navigate
              Sec-Fetch-User: ?1
              Sec-Fetch-Dest: document
              Accept-Encoding: gzip, deflate, br
              Accept-Language: en-US,en;q=0.9


              Session IDSource IPSource PortDestination IPDestination PortProcess
              5104.19.152.69443192.168.2.649722C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:10 UTC5INHTTP/1.1 200 OK
              Date: Thu, 26 Oct 2023 08:50:10 GMT
              Content-Type: image/webp
              Content-Length: 1370
              Connection: close
              Cf-Bgj: imgq:85,h2pri
              Cf-Polished: origFmt=png, origSize=2215
              Content-Disposition: inline; filename="original.webp"
              ETag: "35b5f2f37773bdc20abcf3f88b50e708"
              Last-Modified: Wed, 19 Oct 2022 22:22:48 GMT
              Vary: Accept
              x-amz-id-2: NqtolgogZx7kI1NvQs70ZKl30q7pGfhWEKKa8Uro8GjHWD0wZCwcpC8MouMCvSZcgKYmotQWzy5S9lA6UQSIUB3c//MxQqy9
              x-amz-request-id: K452P2540A2K070Q
              x-amz-server-side-encryption: AES256
              CF-Cache-Status: HIT
              Age: 4312
              Expires: Thu, 26 Oct 2023 12:50:10 GMT
              Cache-Control: public, max-age=14400
              Accept-Ranges: bytes
              Server: cloudflare
              CF-RAY: 81c1733e3adb2036-IAD
              2023-10-26 08:50:10 UTC5INData Raw: 52 49 46 46 52 05 00 00 57 45 42 50 56 50 38 4c 45 05 00 00 2f d4 40 0b 10 bf 20 16 4c e6 2f dd 99 c2 fc cf 3f 41 b6 2d de 09 5e 82 49 9a 6a 3b 06 35 00 c0 b1 79 00 00 c8 b6 6d 2b 6a a5 cd 91 b2 49 88 26 85 87 f5 ff df 2a 10 d3 dd e7 88 fe 4f 80 3e 35 2c f9 bf 3a 83 99 e9 db c7 d5 61 9f 82 be 78 5c 0b 4c 3d 33 60 1f 11 72 ce f6 26 57 ea 6e df 2a 2c 19 a0 d8 37 30 e0 4d ae b4 f3 77 8a 6b a1 ba e9 97 18 90 a3 2c 01 f1 fb 84 25 d3 b6 af 10 62 8c 7a cb 15 5c c7 3b 6c df 26 ae 85 ce ac af f0 be e3 7d 9f 2a 23 e4 af 12 96 4c dd 2b d3 2b 6c 08 af 19 62 0c a7 84 61 8e d6 37 cc 73 0c b5 ce d8 11 e6 94 46 53 30 0b 8d 30 a7 34 da 5b c5 b5 50 2f 1b 47 d7 29 8b 7b b6 b5 00 fb 24 29 bb 3f 5a 33 10 25 d9 5a 00 f2 54 31 c0 2a 31 73 dc a7 46 b8 16 8e 9b 3d 71 87 f5 60 0f
              Data Ascii: RIFFRWEBPVP8LE/@ L/?A-^Ij;5ym+jI&*O>5,:ax\L=3`r&Wn*,70Mwk,%bz\;l&}*#L++lba7sFS004[P/G){$)?Z3%ZT1*1sF=q`
              2023-10-26 08:50:10 UTC6INData Raw: 46 f7 f0 46 ca 90 67 c0 24 a9 40 6a 44 20 36 42 81 d4 30 93 34 43 09 7a f2 0a 24 d5 0d b8 35 ee 95 15 4a 68 38 ac 4f c4 b5 70 e6 aa b0 d3 bd eb 9d 22 e0 90 75 5c a1 58 cd c1 d5 50 86 62 95 e0 7e 95 42 81 5b e3 71 39 cc 40 56 3b 03 d7 ca 42 25 02 b7 da 15 b0 9e b0 64 4e f5 28 73 fa a7 b7 92 73 8c 15 2b e0 26 c9 32 30 75 44 c0 ff 49 8a 3b 30 49 09 b8 9a a4 21 c3 16 64 05 dc 3a 86 02 78 9a 97 4c 4d 0f 60 1b a4 e1 01 6c 6a c7 b5 70 6e 0e 1a 9c 7e d7 7b a5 83 ab 7e 01 d8 f3 0e f0 50 87 12 80 67 07 78 48 0a 0e 90 b3 03 24 69 07 8a d7 b3 a4 99 ee 43 70 80 52 00 dc 6a 61 c9 9c 7d 91 a6 c2 93 db 9b 85 02 4c 0d 25 da f7 d0 a5 44 fb 11 24 c9 9c 76 92 e4 f4 ba 24 99 d7 f2 5a 93 ed 34 b3 e9 18 d7 c2 d9 3e 48 0b 4f db 5b 0c 1d 4a e0 ea b4 7b 25 47 1d 3b 64 f7 4a 9e d4
              Data Ascii: FFg$@jD 6B04Cz$5Jh8Op"u\XPb~B[q9@V;B%dN(ss+&20uDI;0I!d:xLM`ljpn~{~PgxH$iCpRja}L%D$v$Z4>HO[J{%G;dJ


              Session IDSource IPSource PortDestination IPDestination PortProcess
              6192.168.2.649721104.19.152.69443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:10 UTC7OUTGET /favicon.ico HTTP/1.1
              Host: braze-images.com
              Connection: keep-alive
              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
              sec-ch-ua-mobile: ?0
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              sec-ch-ua-platform: "Windows"
              Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
              Sec-Fetch-Site: same-origin
              Sec-Fetch-Mode: no-cors
              Sec-Fetch-Dest: image
              Referer: https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167
              Accept-Encoding: gzip, deflate, br
              Accept-Language: en-US,en;q=0.9


              Session IDSource IPSource PortDestination IPDestination PortProcess
              7104.19.152.69443192.168.2.649721C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:10 UTC7INHTTP/1.1 403 Forbidden
              Date: Thu, 26 Oct 2023 08:50:10 GMT
              Content-Type: application/xml
              Transfer-Encoding: chunked
              Connection: close
              x-amz-request-id: 2347PHZX9CNS1HD2
              x-amz-id-2: XdrvUj7ZZZceGvO8v8Nf7YgoV1ldn10+T8qvugxLxUwYM+D6T6wmDCIMrF97crvOfck516aGblw=
              CF-Cache-Status: MISS
              Server: cloudflare
              CF-RAY: 81c1733f1e9520d5-IAD
              2023-10-26 08:50:10 UTC8INData Raw: 66 33 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 32 33 34 37 50 48 5a 58 39 43 4e 53 31 48 44 32 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 58 64 72 76 55 6a 37 5a 5a 5a 63 65 47 76 4f 38 76 38 4e 66 37 59 67 6f 56 31 6c 64 6e 31 30 2b 54 38 71 76 75 67 78 4c 78 55 77 59 4d 2b 44 36 54 36 77 6d 44 43 49 4d 72 46 39 37 63 72 76 4f 66 63 6b 35 31 36 61 47 62 6c 77 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e 0d 0a
              Data Ascii: f3<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>2347PHZX9CNS1HD2</RequestId><HostId>XdrvUj7ZZZceGvO8v8Nf7YgoV1ldn10+T8qvugxLxUwYM+D6T6wmDCIMrF97crvOfck516aGblw=</HostId></Error>
              2023-10-26 08:50:10 UTC8INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortProcess
              8192.168.2.64972720.7.2.167443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:12 UTC8OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 33 2b 55 69 4c 33 53 49 59 30 53 6d 48 77 55 4f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 33 61 61 32 31 64 39 65 64 37 62 62 63 62 0d 0a 0d 0a
              Data Ascii: CNT 1 CON 305MS-CV: 3+UiL3SIY0SmHwUO.1Context: b83aa21d9ed7bbcb
              2023-10-26 08:50:12 UTC8OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
              Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
              2023-10-26 08:50:12 UTC8OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 33 2b 55 69 4c 33 53 49 59 30 53 6d 48 77 55 4f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 33 61 61 32 31 64 39 65 64 37 62 62 63 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 5a 4a 75 67 36 74 63 69 61 7a 36 61 37 37 4e 76 6e 6c 68 6d 6b 73 7a 66 77 77 42 49 41 6b 6b 6e 72 77 6f 75 45 43 52 65 7a 65 2b 38 5a 33 61 6b 43 52 6d 4a 43 42 79 77 67 34 53 4a 36 69 33 55 58 59 30 71 79 4a 32 64 59 37 35 4c 4b 43 32 53 34 45 4b 34 75 6d 49 78 45 4a 41 66 38 36 51 73 4f 2b 4e 57 76 42 2f 43 79 30 5a
              Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 3+UiL3SIY0SmHwUO.2Context: b83aa21d9ed7bbcb<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqZJug6tciaz6a77NvnlhmkszfwwBIAkknrwouECReze+8Z3akCRmJCBywg4SJ6i3UXY0qyJ2dY75LKC2S4EK4umIxEJAf86QsO+NWvB/Cy0Z
              2023-10-26 08:50:12 UTC9OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 33 2b 55 69 4c 33 53 49 59 30 53 6d 48 77 55 4f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 33 61 61 32 31 64 39 65 64 37 62 62 63 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
              Data Ascii: BND 3 CON\WNS 0 197MS-CV: 3+UiL3SIY0SmHwUO.3Context: b83aa21d9ed7bbcb<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
              2023-10-26 08:50:12 UTC10INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
              Data Ascii: 202 1 CON 58
              2023-10-26 08:50:12 UTC10INData Raw: 4d 53 2d 43 56 3a 20 76 51 32 58 67 5a 7a 6a 72 45 4b 38 46 61 36 78 66 51 41 77 50 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
              Data Ascii: MS-CV: vQ2XgZzjrEK8Fa6xfQAwPw.0Payload parsing failed.


              Session IDSource IPSource PortDestination IPDestination PortProcess
              9192.168.2.64972823.220.136.112443C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampkBytes transferredDirectionData
              2023-10-26 08:50:13 UTC10OUTHEAD /fs/windows/config.json HTTP/1.1
              Connection: Keep-Alive
              Accept: */*
              Accept-Encoding: identity
              User-Agent: Microsoft BITS/7.8
              Host: fs.microsoft.com
              2023-10-26 08:50:13 UTC10INHTTP/1.1 200 OK
              ApiVersion: Distribute 1.1
              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
              Content-Type: application/octet-stream
              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
              Server: Kestrel
              X-CID: 11
              Cache-Control: public, max-age=137012
              Date: Thu, 26 Oct 2023 08:50:13 GMT
              Connection: close
              X-CID: 2


              Statistics

              CPU Usage

              020406080s020406080100

              Click to jump to process

              Memory Usage

              020406080s0.0020406080100MB

              Click to jump to process

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:0
              Start time:10:50:03
              Start date:26/10/2023
              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
              Wow64 process (32bit):false
              Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
              Imagebase:0x7ff684c40000
              File size:3'242'272 bytes
              MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:false
              Show Windows behavior

              File Activities

              There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
              Show Windows behavior

              Process Activities

              There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
              Show Windows behavior

              Memory Activities

              There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
              There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
              Show Windows behavior

              Process Token Activities


              General

              Target ID:2
              Start time:10:50:07
              Start date:26/10/2023
              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2112,i,2944723603810662615,16248398350290081726,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Imagebase:0x7ff684c40000
              File size:3'242'272 bytes
              MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:false
              Show Windows behavior

              File Activities

              There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
              Show Windows behavior

              Memory Activities


              General

              Target ID:3
              Start time:10:50:09
              Start date:26/10/2023
              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
              Wow64 process (32bit):false
              Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "https://braze-images.com/appboy/communication/assets/image_assets/images/635078b75a754e550e24a194/original.png?1666218167
              Imagebase:0x7ff684c40000
              File size:3'242'272 bytes
              MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:true
              There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
              There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

              Disassembly

              ⊘No disassembly