Edit tour

Windows Analysis Report
W53oi1JYy4.exe

Overview

General Information

Sample name:	W53oi1JYy4.exe renamed because original name is a hash value
Original sample name:	bc72d38b806610a77e37d8b57d1d3721.exe
Analysis ID:	1579677
MD5:	bc72d38b806610a77e37d8b57d1d3721
SHA1:	606915c07e8412f31815aa8b259e8bae749fbabb
SHA256:	d46b9f0e27763bcff64c54460f63324ce405602bdde61725ab33c560bc12708d
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Uses Windows timers to delay execution

JA3 SSL client fingerprint seen in connection with other malware

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

W53oi1JYy4.exe (PID: 6872 cmdline: "C:\Users\user\Desktop\W53oi1JYy4.exe" MD5: BC72D38B806610A77E37D8B57D1D3721)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: W53oi1JYy4.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49956 version: TLS 1.2

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.6
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49956 version: TLS 1.2

Source: W53oi1JYy4.exe, 00000000.00000000.2125081010.00000000005E4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename" vs W53oi1JYy4.exe
Source: W53oi1JYy4.exe	Binary or memory string: OriginalFilename" vs W53oi1JYy4.exe

Source: W53oi1JYy4.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: sus22.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\W53oi1JYy4.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\W53oi1JYy4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\W53oi1JYy4.exe

Window found: window name: TButton

Jump to behavior

Source: W53oi1JYy4.exe

Static file information: File size 2764288 > 1048576

Source: W53oi1JYy4.exe

Static PE information: Raw size of CODE is bigger than: 0x100000 < 0x1d8000

Malware Analysis System Evasion

Uses Windows timers to delay execution

Source: C:\Users\user\Desktop\W53oi1JYy4.exe	User Timer Set: Timeout: 100ms	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	User Timer Set: Timeout: 250ms	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	User Timer Set: Timeout: 250ms	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	User Timer Set: Timeout: 250ms	Jump to behavior
Source: C:\Users\user\Desktop\W53oi1JYy4.exe	User Timer Set: Timeout: 250ms	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: W53oi1JYy4.exe, 00000000.00000002.3397846283.00000000041FF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
W53oi1JYy4.exe	8%	ReversingLabs	Win32.Trojan.Generic
W53oi1JYy4.exe	2%	Virustotal		Browse

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579677
Start date and time:	2024-12-23 07:25:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	W53oi1JYy4.exe renamed because original name is a hash value
Original Sample Name:	bc72d38b806610a77e37d8b57d1d3721.exe
Detection:	SUS
Classification:	sus22.evad.winEXE@1/0@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172, 13.107.246.63, 4.245.163.56, 4.175.87.197
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse	20.198.119.84
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	20.198.119.84
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	20.198.119.84
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	20.198.119.84
	Rokadernes.vbs	Get hash	malicious	Remcos, GuLoader	Browse	20.198.119.84
	tg.exe	Get hash	malicious	Babadeda	Browse	20.198.119.84
	tg.exe	Get hash	malicious	Babadeda	Browse	20.198.119.84
	setup.exe	Get hash	malicious	Babadeda	Browse	20.198.119.84
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	20.198.119.84
	medicalanalysispro.exe	Get hash	malicious	RHADAMANTHYS	Browse	20.198.119.84

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.875634441758122
TrID:	Win32 Executable (generic) a (10002005/4) 92.22% Win32 Executable Borland Delphi 7 (665061/41) 6.13% Windows ActiveX control (116523/4) 1.07% Win32 EXE PECompact compressed (generic) (41571/9) 0.38% Win32 Executable Delphi generic (14689/80) 0.14%
File name:	W53oi1JYy4.exe
File size:	2'764'288 bytes
MD5:	bc72d38b806610a77e37d8b57d1d3721
SHA1:	606915c07e8412f31815aa8b259e8bae749fbabb
SHA256:	d46b9f0e27763bcff64c54460f63324ce405602bdde61725ab33c560bc12708d
SHA512:	47406f41816561ad37b3da9a29810213e261e74b0c5f33ba68989469ce0113bc4f8eaee4aba1ec0b89a7724de60982e5369ff899f8b74b0dad466ce81c5e504b
SSDEEP:	49152:5xj6d2mHXpwXX5Eb6vCz5zPDC+HAFjjdjjA/YiY0Y0Y0Y0YI:5xjC2yZspEb6o53C+HAFjjdjjA/YiY0z
TLSH:	E7D55C72B38E8433D5370A749C5B73496877BF151B2892EA3FE0BD8D5E3A191741A2C2
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	8737656535170646

Static PE Info

General

Entrypoint:	0x5d8f68
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	0f7133b6b604bd6fc63d33541d2dcf73

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
mov eax, 005D8948h
call 00007F7AD5126D18h
mov ebx, dword ptr [005DC62Ch]
mov eax, dword ptr [ebx]
call 00007F7AD519581Bh
mov ecx, dword ptr [005DC8ACh]
mov eax, dword ptr [ebx]
mov edx, dword ptr [005D44C0h]
call 00007F7AD5195820h
mov ecx, dword ptr [005DC920h]
mov eax, dword ptr [ebx]
mov edx, dword ptr [005D20B4h]
call 00007F7AD519580Dh
mov ecx, dword ptr [005DC57Ch]
mov eax, dword ptr [ebx]
mov edx, dword ptr [005D1B2Ch]
call 00007F7AD51957FAh
mov ecx, dword ptr [005DC474h]
mov eax, dword ptr [ebx]
mov edx, dword ptr [005D3E80h]
call 00007F7AD51957E7h
mov eax, dword ptr [ebx]
call 00007F7AD5195860h
pop ebx
call 00007F7AD51243CEh
nop
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [ebp+00000040h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor dl, byte ptr [ebx]
mov eax, eax
add al, byte ptr [eax]
mov eax, eax
add byte ptr [ebp-72FFFFC0h], cl
inc eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1df000	0x2b1e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x200000	0xa8c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e4000	0x1b4ac	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1e3000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x1d7fe0	0x1d8000	9a71acc266b99cfe90c10a919e634f43	False	0.4937382067664195	data	6.525145623509275	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x1d9000	0x3a00	0x3a00	f4ca7a1581e47d21ba678a9f368dbde7	False	0.45373114224137934	data	5.017493402763318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x1dd000	0x1359	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1df000	0x2b1e	0x2c00	b98765b9c7244adec02b853a8f6da231	False	0.35511363636363635	data	5.030069526694421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1e2000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1e3000	0x18	0x200	e5e7bd24da449c8b11f552f74fa94932	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "^"	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x1e4000	0x1b4ac	0x1b600	1705651ca83eebd3e8c23e7fa3d66d9f	False	0.4969766695205479	data	6.621589723666736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x200000	0xa8c00	0xa8c00	b07a5c9ad0ae60add4919a08982af255	False	0.14668113425925927	data	6.677927085075923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2023e8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0x20251c	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Russian	Russia	0.29545454545454547
RT_CURSOR	0x202650	0x134	data			0.4805194805194805
RT_CURSOR	0x202784	0x134	data			0.38311688311688313
RT_CURSOR	0x2028b8	0x134	data			0.36038961038961037
RT_CURSOR	0x2029ec	0x134	data			0.4090909090909091
RT_CURSOR	0x202b20	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_CURSOR	0x202c54	0x134	data	Arabic	Saudi Arabia	0.2597402597402597
RT_CURSOR	0x202d88	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Russian	Russia	0.2824675324675325
RT_CURSOR	0x202ebc	0x134	data	Dutch	Netherlands	0.38636363636363635
RT_CURSOR	0x202ff0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Dutch	Netherlands	0.30194805194805197
RT_CURSOR	0x203124	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Dutch	Netherlands	0.275974025974026
RT_CURSOR	0x203258	0x134	data			0.4642857142857143
RT_BITMAP	0x20338c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x20355c	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0x203740	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x203910	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0x203ae0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0x203cb0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0x203e80	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0x204050	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x204220	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0x2043f0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x2045c0	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors			0.5208333333333334
RT_BITMAP	0x204680	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.42857142857142855
RT_BITMAP	0x204760	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.4955357142857143
RT_BITMAP	0x204840	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.391304347826087
RT_BITMAP	0x20489c	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.391304347826087
RT_BITMAP	0x2048f8	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.532608695652174
RT_BITMAP	0x204954	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.532608695652174
RT_BITMAP	0x2049b0	0x94	Device independent bitmap graphic, 6 x 11 x 4, image size 44	Russian	Russia	0.5
RT_BITMAP	0x204a44	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.4782608695652174
RT_BITMAP	0x204aa0	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.4782608695652174
RT_BITMAP	0x204afc	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.5543478260869565
RT_BITMAP	0x204b58	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.5543478260869565
RT_BITMAP	0x204bb4	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.4673913043478261
RT_BITMAP	0x204c10	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.4673913043478261
RT_BITMAP	0x204c6c	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.41025641025641024
RT_BITMAP	0x204da4	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.27564102564102566
RT_BITMAP	0x204edc	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.3685897435897436
RT_BITMAP	0x205014	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.3685897435897436
RT_BITMAP	0x20514c	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.34294871794871795
RT_BITMAP	0x205284	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.3717948717948718
RT_BITMAP	0x2053bc	0x104	Device independent bitmap graphic, 20 x 13 x 4, image size 156			0.5038461538461538
RT_BITMAP	0x2054c0	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.4326923076923077
RT_BITMAP	0x2055f8	0x104	Device independent bitmap graphic, 20 x 13 x 4, image size 156			0.5153846153846153
RT_BITMAP	0x2056fc	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.46474358974358976
RT_BITMAP	0x205834	0xb0	Device independent bitmap graphic, 10 x 9 x 4, image size 72	Russian	Russia	0.5056818181818182
RT_BITMAP	0x2058e4	0xb0	Device independent bitmap graphic, 10 x 9 x 4, image size 72	Russian	Russia	0.4943181818181818
RT_BITMAP	0x205994	0xb0	Device independent bitmap graphic, 10 x 9 x 4, image size 72	Russian	Russia	0.4375
RT_BITMAP	0x205a44	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.38392857142857145
RT_BITMAP	0x205b24	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors			0.4947916666666667
RT_BITMAP	0x205be4	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors			0.484375
RT_BITMAP	0x205ca4	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.42410714285714285
RT_BITMAP	0x205d84	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors			0.5104166666666666
RT_BITMAP	0x205e44	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.5
RT_BITMAP	0x205f24	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_BITMAP	0x20600c	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors			0.4895833333333333
RT_BITMAP	0x2060cc	0xd0	Device independent bitmap graphic, 12 x 13 x 4, image size 104			0.5625
RT_BITMAP	0x20619c	0xd0	Device independent bitmap graphic, 12 x 13 x 4, image size 104			0.4855769230769231
RT_BITMAP	0x20626c	0xd0	Device independent bitmap graphic, 12 x 13 x 4, image size 104			0.4326923076923077
RT_BITMAP	0x20633c	0xd0	Device independent bitmap graphic, 12 x 13 x 4, image size 104			0.5576923076923077
RT_BITMAP	0x20640c	0xd0	Device independent bitmap graphic, 12 x 13 x 4, image size 104			0.4807692307692308
RT_BITMAP	0x2064dc	0xd0	Device independent bitmap graphic, 12 x 13 x 4, image size 104			0.5625
RT_BITMAP	0x2065ac	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	Canada	0.34183673469387754
RT_BITMAP	0x206734	0x88	Device independent bitmap graphic, 16 x 4 x 4, image size 32	English	United States	0.4852941176470588
RT_BITMAP	0x2067bc	0xa8	Device independent bitmap graphic, 4 x 16 x 4, image size 64	English	United States	0.40476190476190477
RT_BITMAP	0x206864	0x450	Device independent bitmap graphic, 5 x 5 x 8, image size 40	Dutch	Netherlands	0.32608695652173914
RT_BITMAP	0x206cb4	0x450	Device independent bitmap graphic, 7 x 5 x 8, image size 40	Dutch	Netherlands	0.322463768115942
RT_BITMAP	0x207104	0x4ac	Device independent bitmap graphic, 11 x 11 x 8, image size 132	Dutch	Netherlands	0.41555183946488294
RT_BITMAP	0x2075b0	0x480	Device independent bitmap graphic, 6 x 11 x 8, image size 88	Dutch	Netherlands	0.3559027777777778
RT_BITMAP	0x207a30	0x4ac	Device independent bitmap graphic, 9 x 11 x 8, image size 132	Dutch	Netherlands	0.41638795986622074
RT_BITMAP	0x207edc	0x4c4	Device independent bitmap graphic, 12 x 13 x 8, image size 156	Dutch	Netherlands	0.4024590163934426
RT_BITMAP	0x2083a0	0x4c4	Device independent bitmap graphic, 12 x 13 x 8, image size 156	Dutch	Netherlands	0.40491803278688526
RT_BITMAP	0x208864	0x4c4	Device independent bitmap graphic, 12 x 13 x 8, image size 156	Dutch	Netherlands	0.40491803278688526
RT_BITMAP	0x208d28	0x448	Device independent bitmap graphic, 7 x 4 x 8, image size 32	Dutch	Netherlands	0.43156934306569344
RT_BITMAP	0x209170	0x444	Device independent bitmap graphic, 4 x 7 x 8, image size 28	Dutch	Netherlands	0.4358974358974359
RT_BITMAP	0x2095b4	0x444	Device independent bitmap graphic, 4 x 7 x 8, image size 28	Dutch	Netherlands	0.43223443223443225
RT_BITMAP	0x2099f8	0x448	Device independent bitmap graphic, 7 x 4 x 8, image size 32	Dutch	Netherlands	0.43156934306569344
RT_BITMAP	0x209e40	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	United States	0.3137755102040816
RT_BITMAP	0x209fc8	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	Dutch	Netherlands	0.413265306122449
RT_BITMAP	0x20a150	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	United States	0.25510204081632654
RT_BITMAP	0x20a2d8	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.3794642857142857
RT_BITMAP	0x20a3b8	0xb0	Device independent bitmap graphic, 64 x 16 x 1, image size 128	English	United States	0.5113636363636364
RT_ICON	0x20a468	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Chinese	China	0.42338709677419356
RT_DIALOG	0x20a750	0x52	data			0.7682926829268293
RT_STRING	0x20a7a4	0x338	data			0.38228155339805825
RT_STRING	0x20aadc	0x428	data			0.37406015037593987
RT_STRING	0x20af04	0x36c	data			0.3904109589041096
RT_STRING	0x20b270	0x3b0	data			0.3252118644067797
RT_STRING	0x20b620	0x2d4	data			0.44613259668508287
RT_STRING	0x20b8f4	0x364	data			0.42972350230414746
RT_STRING	0x20bc58	0x470	data			0.4110915492957746
RT_STRING	0x20c0c8	0x3d8	data			0.36890243902439024
RT_STRING	0x20c4a0	0xac	data			0.7093023255813954
RT_STRING	0x20c54c	0x354	data			0.4706572769953052
RT_STRING	0x20c8a0	0x3a8	data			0.4027777777777778
RT_STRING	0x20cc48	0x35c	data			0.4046511627906977
RT_STRING	0x20cfa4	0x40c	data			0.3996138996138996
RT_STRING	0x20d3b0	0x480	data			0.3385416666666667
RT_STRING	0x20d830	0x4c0	data			0.3363486842105263
RT_STRING	0x20dcf0	0x570	data			0.27011494252873564
RT_STRING	0x20e260	0x3e4	data			0.35240963855421686
RT_STRING	0x20e644	0x2d4	AmigaOS bitmap font "n", fc_YSize 8192, 18688 elements, 2nd "e", 3rd "u"			0.44751381215469616
RT_STRING	0x20e918	0x200	data			0.361328125
RT_STRING	0x20eb18	0xf8	data			0.592741935483871
RT_STRING	0x20ec10	0x374	data			0.4309954751131222
RT_STRING	0x20ef84	0x144	data			0.5339506172839507
RT_STRING	0x20f0c8	0xe8	data			0.5991379310344828
RT_STRING	0x20f1b0	0x2e0	data			0.4116847826086957
RT_STRING	0x20f490	0x268	data			0.4788961038961039
RT_STRING	0x20f6f8	0x410	data			0.3721153846153846
RT_STRING	0x20fb08	0x384	data			0.4111111111111111
RT_STRING	0x20fe8c	0x380	data			0.3314732142857143
RT_STRING	0x21020c	0x454	data			0.3601083032490975
RT_STRING	0x210660	0x1b0	data			0.4675925925925926
RT_STRING	0x210810	0xec	data			0.5508474576271186
RT_STRING	0x2108fc	0x20c	data			0.5
RT_STRING	0x210b08	0x454	data			0.3231046931407942
RT_STRING	0x210f5c	0x3d0	data			0.36168032786885246
RT_STRING	0x21132c	0x2fc	data			0.36649214659685864
RT_STRING	0x211628	0x354	data			0.318075117370892
RT_RCDATA	0x21197c	0x10	data			1.5
RT_RCDATA	0x21198c	0x908	data			0.6007785467128027
RT_RCDATA	0x212294	0x1772	Delphi compiled form 'TCalculatorEh'			0.12812395868043985
RT_RCDATA	0x213a08	0x971	Delphi compiled form 'TDBGridEhFindDlg'			0.4666942490690939
RT_RCDATA	0x21437c	0xf936	Delphi compiled form 'TForm1'			0.5516160381203172
RT_RCDATA	0x223cb4	0x8a42	Delphi compiled form 'TForm2'			0.814855625247217
RT_RCDATA	0x22c6f8	0x7ecf	Delphi compiled form 'TForm3'			0.8668022055879001
RT_RCDATA	0x2345c8	0x226	Delphi compiled form 'TformShowSet'			0.6290909090909091
RT_RCDATA	0x2347f0	0x73660	Delphi compiled form 'TFTemplate'			0.03429862568546476
RT_RCDATA	0x2a7e50	0x494	Delphi compiled form 'TLoginDialog'			0.4931740614334471
RT_RCDATA	0x2a82e4	0x3c4	Delphi compiled form 'TPasswordDialog'			0.4678423236514523
RT_GROUP_CURSOR	0x2a86a8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Russian	Russia	1.25
RT_GROUP_CURSOR	0x2a86bc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Arabic	Saudi Arabia	1.3
RT_GROUP_CURSOR	0x2a86d0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Russian	Russia	1.3
RT_GROUP_CURSOR	0x2a86e4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Dutch	Netherlands	1.3
RT_GROUP_CURSOR	0x2a86f8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Dutch	Netherlands	1.3
RT_GROUP_CURSOR	0x2a870c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Dutch	Netherlands	1.3
RT_GROUP_CURSOR	0x2a8720	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x2a8734	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2a8748	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2a875c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2a8770	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2a8784	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2a8798	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x2a87ac	0x14	data	Chinese	China	1.2
RT_VERSION	0x2a87c0	0x274	data	Chinese	China	0.46496815286624205

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegQueryValueA, RegOpenKeyExA, RegFlushKey, RegCreateKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, ReleaseMutex, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, IsBadReadPtr, InitializeCriticalSection, GlobalUnlock, GlobalSize, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetExitCodeThread, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateMutexA, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWindowExtEx, SetWinMetaFileBits, SetViewportOrgEx, SetViewportExtEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RoundRect, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PolyPolyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, LPtoDP, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetViewportOrgEx, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetOutlineTextMetricsA, GetObjectA, GetNearestColor, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetCurrentObject, GetClipRgn, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutA, ExtSelectClipRgn, ExtCreateRegion, ExtCreatePen, ExcludeClipRect, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePolygonRgn, CreatePenIndirect, CreatePen, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CombineRgn, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, ValidateRect, UpdateWindow, UnregisterClassA, UnionRect, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, ShowCaret, SetWindowRgn, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetKeyboardState, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCaretPos, SetCapture, SetActiveWindow, SendMessageA, ScrollWindowEx, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MoveWindow, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsClipboardFormatAvailable, IsChild, IsCharAlphaNumericA, IsCharAlphaA, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, HideCaret, GetWindowThreadProcessId, GetWindowTextLengthW, GetWindowTextW, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessageTime, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDoubleClickTime, GetDlgItem, GetDlgCtrlID, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCaretPos, GetCapture, GetActiveWindow, FrameRect, FindWindowExA, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumClipboardFormats, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextExA, DrawTextW, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DestroyCaret, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CreateCaret, CopyImage, CloseClipboard, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CoTaskMemFree, StringFromCLSID
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayRedim, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CoCreateInstance, CoGetMalloc, CoUninitialize, CoInitialize, IsEqualGUID
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SafeArrayCopy, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayDestroy, SafeArrayCreate, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_LoadImageA, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
comdlg32.dll	GetSaveFileNameA, GetOpenFileNameA
kernel32.dll	MulDiv
kernel32.dll	MulDiv

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
Arabic	Saudi Arabia
Dutch	Netherlands
English	Canada
English	United States
Chinese	China

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:26:14.818877935 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:26:14.818906069 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:26:14.818922997 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:26:14.819025993 CET	49705	443	192.168.2.6	20.190.147.6
Dec 23, 2024 07:26:14.819117069 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:26:14.819171906 CET	49705	443	192.168.2.6	20.190.147.6
Dec 23, 2024 07:26:14.819180012 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:26:14.819197893 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:26:14.819240093 CET	49705	443	192.168.2.6	20.190.147.6
Dec 23, 2024 07:26:14.827193022 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:26:14.827250957 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:26:14.827353001 CET	49705	443	192.168.2.6	20.190.147.6
Dec 23, 2024 07:26:14.835895061 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:26:14.835923910 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:26:14.836007118 CET	49705	443	192.168.2.6	20.190.147.6
Dec 23, 2024 07:26:15.615134954 CET	49673	443	192.168.2.6	173.222.162.64
Dec 23, 2024 07:26:15.615145922 CET	49674	443	192.168.2.6	173.222.162.64
Dec 23, 2024 07:26:15.943276882 CET	49672	443	192.168.2.6	173.222.162.64
Dec 23, 2024 07:26:15.974714041 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:15.974948883 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:15.979125023 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:15.979156017 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:15.979438066 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:15.980603933 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:15.980664968 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:15.980678082 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:15.980768919 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:16.023344040 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:16.522455931 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:16.522701979 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:16.522849083 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:16.523145914 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:16.523196936 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:23.320451975 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:23.320514917 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:23.320620060 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:23.321335077 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:23.321361065 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:25.224492073 CET	49674	443	192.168.2.6	173.222.162.64
Dec 23, 2024 07:26:25.229804993 CET	49673	443	192.168.2.6	173.222.162.64
Dec 23, 2024 07:26:25.539844036 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:25.539953947 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:25.544523954 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:25.544548035 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:25.545325994 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:25.547848940 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:25.547904015 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:25.547909975 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:25.548676968 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:25.552568913 CET	49672	443	192.168.2.6	173.222.162.64
Dec 23, 2024 07:26:25.595330954 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:25.838689089 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:25.838747978 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:25.838819981 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:25.839610100 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:25.839622021 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:26.090221882 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:26.090302944 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:26.090368032 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:26.090533972 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:26.090563059 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:27.944075108 CET	443	49702	173.222.162.64	192.168.2.6
Dec 23, 2024 07:26:27.944209099 CET	49702	443	192.168.2.6	173.222.162.64
Dec 23, 2024 07:26:28.051392078 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:28.051462889 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:28.054199934 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:28.054203987 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:28.054430962 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:28.056338072 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:28.056382895 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:28.056387901 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:28.056667089 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:28.103332043 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:28.599025965 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:28.599145889 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:28.599199057 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:28.599262953 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:28.599280119 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:34.966873884 CET	49721	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:34.966916084 CET	443	49721	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:34.967039108 CET	49721	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:34.967643023 CET	49721	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:34.967653990 CET	443	49721	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:37.176151037 CET	443	49721	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:37.176244020 CET	49721	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:37.179178953 CET	49721	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:37.179218054 CET	443	49721	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:37.179462910 CET	443	49721	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:37.182084084 CET	49721	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:37.182084084 CET	49721	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:37.182084084 CET	49721	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:37.182105064 CET	443	49721	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:37.227329969 CET	443	49721	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:37.843183041 CET	443	49721	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:37.843308926 CET	443	49721	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:37.843487024 CET	49721	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:37.843714952 CET	49721	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:37.843732119 CET	443	49721	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:38.807661057 CET	49734	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:38.807686090 CET	443	49734	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:38.807765961 CET	49734	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:38.808398008 CET	49734	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:38.808410883 CET	443	49734	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:41.134567022 CET	443	49734	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:41.134805918 CET	49734	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:41.136981964 CET	49734	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:41.136990070 CET	443	49734	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:41.137218952 CET	443	49734	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:41.140163898 CET	49734	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:41.140234947 CET	49734	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:41.140239954 CET	443	49734	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:41.140361071 CET	49734	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:41.183374882 CET	443	49734	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:41.802609921 CET	443	49734	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:41.802916050 CET	443	49734	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:41.803065062 CET	49734	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:41.803601980 CET	49734	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:41.803618908 CET	443	49734	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:46.842108011 CET	49751	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:46.842225075 CET	443	49751	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:46.842345953 CET	49751	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:46.842922926 CET	49751	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:46.842957973 CET	443	49751	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:49.056360960 CET	443	49751	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:49.056456089 CET	49751	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:49.059717894 CET	49751	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:49.059727907 CET	443	49751	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:49.060482979 CET	443	49751	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:49.062479973 CET	49751	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:49.062541008 CET	49751	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:49.062546015 CET	443	49751	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:49.062654018 CET	49751	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:49.107331038 CET	443	49751	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:49.723277092 CET	443	49751	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:49.723386049 CET	443	49751	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:49.723525047 CET	49751	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:49.723649025 CET	49751	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:49.723671913 CET	443	49751	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:55.682406902 CET	49772	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:55.682454109 CET	443	49772	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:55.682538986 CET	49772	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:55.683165073 CET	49772	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:55.683180094 CET	443	49772	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:57.894324064 CET	443	49772	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:57.894525051 CET	49772	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:57.976377964 CET	49772	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:57.976401091 CET	443	49772	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:57.976689100 CET	443	49772	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:58.003110886 CET	49772	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:58.008634090 CET	49772	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:58.008656025 CET	443	49772	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:58.008908987 CET	49772	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:58.051337957 CET	443	49772	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:58.568648100 CET	443	49772	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:58.568734884 CET	443	49772	20.198.119.84	192.168.2.6
Dec 23, 2024 07:26:58.568835974 CET	49772	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:58.569065094 CET	49772	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:26:58.569091082 CET	443	49772	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:00.747575045 CET	49788	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:00.747643948 CET	443	49788	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:00.747726917 CET	49788	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:00.748420000 CET	49788	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:00.748437881 CET	443	49788	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:03.031840086 CET	443	49788	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:03.031953096 CET	49788	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:03.033803940 CET	49788	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:03.033812046 CET	443	49788	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:03.034698963 CET	443	49788	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:03.036655903 CET	49788	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:03.036715984 CET	49788	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:03.036720037 CET	443	49788	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:03.036833048 CET	49788	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:03.083329916 CET	443	49788	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:03.584243059 CET	443	49788	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:03.584440947 CET	443	49788	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:03.584506035 CET	49788	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:03.584620953 CET	49788	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:03.584639072 CET	443	49788	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:13.727741957 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:13.727791071 CET	443	49812	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:13.727900982 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:13.728486061 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:13.728501081 CET	443	49812	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:16.013345003 CET	443	49812	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:16.013417006 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:16.015255928 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:16.015275002 CET	443	49812	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:16.015508890 CET	443	49812	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:16.016773939 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:16.016835928 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:16.016843081 CET	443	49812	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:16.017019033 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:16.059330940 CET	443	49812	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:16.823497057 CET	443	49812	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:16.824332952 CET	443	49812	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:16.824424982 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:16.824673891 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:16.824697018 CET	443	49812	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:16.824707031 CET	49812	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:20.482501984 CET	49833	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:20.482547998 CET	443	49833	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:20.482654095 CET	49833	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:20.483289003 CET	49833	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:20.483299971 CET	443	49833	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:22.717605114 CET	443	49833	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:22.717730045 CET	49833	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:22.719532967 CET	49833	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:22.719548941 CET	443	49833	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:22.719772100 CET	443	49833	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:22.721415997 CET	49833	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:22.721471071 CET	49833	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:22.721478939 CET	443	49833	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:22.721602917 CET	49833	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:22.763339996 CET	443	49833	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:23.384700060 CET	443	49833	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:23.385210991 CET	443	49833	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:23.385281086 CET	49833	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:23.395558119 CET	49833	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:23.395600080 CET	443	49833	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:41.088465929 CET	49878	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:41.088515043 CET	443	49878	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:41.088732004 CET	49878	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:41.089395046 CET	49878	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:41.089405060 CET	443	49878	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:43.310056925 CET	443	49878	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:43.310156107 CET	49878	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:43.312129021 CET	49878	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:43.312143087 CET	443	49878	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:43.313030958 CET	443	49878	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:43.314239025 CET	49878	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:43.314305067 CET	49878	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:43.314312935 CET	443	49878	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:43.314414978 CET	49878	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:43.359337091 CET	443	49878	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:43.890595913 CET	443	49878	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:43.890813112 CET	443	49878	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:43.890974045 CET	49878	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:43.891669989 CET	49878	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:43.891700983 CET	443	49878	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:46.076682091 CET	49891	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:46.076744080 CET	443	49891	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:46.076824903 CET	49891	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:46.077487946 CET	49891	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:46.077511072 CET	443	49891	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:48.339371920 CET	443	49891	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:48.339481115 CET	49891	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:48.358248949 CET	49891	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:48.358284950 CET	443	49891	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:48.359380007 CET	443	49891	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:48.364063025 CET	49891	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:48.364171028 CET	49891	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:48.364178896 CET	443	49891	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:48.364289999 CET	49891	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:48.411338091 CET	443	49891	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:49.043695927 CET	443	49891	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:49.043868065 CET	443	49891	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:49.043967009 CET	49891	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:49.047393084 CET	49891	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:27:49.047416925 CET	443	49891	20.198.119.84	192.168.2.6
Dec 23, 2024 07:27:55.818653107 CET	49701	443	192.168.2.6	20.190.147.6
Dec 23, 2024 07:27:55.938695908 CET	443	49701	20.190.147.6	192.168.2.6
Dec 23, 2024 07:27:55.938781977 CET	49701	443	192.168.2.6	20.190.147.6
Dec 23, 2024 07:28:02.433809042 CET	49705	443	192.168.2.6	20.190.147.6
Dec 23, 2024 07:28:02.553725004 CET	443	49705	20.190.147.6	192.168.2.6
Dec 23, 2024 07:28:02.554239988 CET	49705	443	192.168.2.6	20.190.147.6
Dec 23, 2024 07:28:12.999356985 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:12.999399900 CET	443	49952	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:12.999496937 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:13.000103951 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:13.000113964 CET	443	49952	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:14.328236103 CET	49956	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:14.328298092 CET	443	49956	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:14.328366995 CET	49956	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:14.329030037 CET	49956	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:14.329041958 CET	443	49956	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:15.218300104 CET	443	49952	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:15.218401909 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:15.253712893 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:15.253742933 CET	443	49952	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:15.254055023 CET	443	49952	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:15.302860022 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:15.334192038 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:15.359844923 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:15.359886885 CET	443	49952	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:15.363518000 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:15.407352924 CET	443	49952	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:15.995397091 CET	443	49952	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:15.995474100 CET	443	49952	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:15.995584011 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:15.995738983 CET	49952	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:15.995754004 CET	443	49952	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:16.556457996 CET	443	49956	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:16.556576014 CET	49956	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:16.558321953 CET	49956	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:16.558341026 CET	443	49956	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:16.558572054 CET	443	49956	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:16.559952021 CET	49956	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:16.560082912 CET	49956	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:16.560087919 CET	443	49956	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:16.560251951 CET	49956	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:16.607338905 CET	443	49956	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:17.104954004 CET	443	49956	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:17.105086088 CET	443	49956	20.198.119.84	192.168.2.6
Dec 23, 2024 07:28:17.105221987 CET	49956	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:17.105451107 CET	49956	443	192.168.2.6	20.198.119.84
Dec 23, 2024 07:28:17.105473995 CET	443	49956	20.198.119.84	192.168.2.6

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49706	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:26:15 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 6c 73 44 2f 4c 31 70 4d 79 55 4f 37 4d 77 57 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 64 35 30 39 34 35 31 39 30 35 65 39 61 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: lsD/L1pMyUO7MwW5.1Context: bd509451905e9a0
2024-12-23 06:26:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:26:15 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 6c 73 44 2f 4c 31 70 4d 79 55 4f 37 4d 77 57 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 64 35 30 39 34 35 31 39 30 35 65 39 61 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 50 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: lsD/L1pMyUO7MwW5.2Context: bd509451905e9a0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVwP
2024-12-23 06:26:15 UTC	73	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 35 0d 0a 4d 53 2d 43 56 3a 20 6c 73 44 2f 4c 31 70 4d 79 55 4f 37 4d 77 57 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 64 35 30 39 34 35 31 39 30 35 65 39 61 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 55MS-CV: lsD/L1pMyUO7MwW5.3Context: bd509451905e9a0
2024-12-23 06:26:16 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:26:16 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 2f 58 35 69 36 42 31 61 6b 4f 4f 41 51 6d 6c 34 39 6b 64 48 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: X/X5i6B1akOOAQml49kdHA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49708	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:26:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 48 4c 37 49 4c 62 65 73 6b 4f 6f 66 33 4f 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 33 33 65 66 37 37 36 61 66 66 62 39 35 36 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 9HL7ILbeskOof3OE.1Context: d33ef776affb956f
2024-12-23 06:26:25 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:26:25 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 39 48 4c 37 49 4c 62 65 73 6b 4f 6f 66 33 4f 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 33 33 65 66 37 37 36 61 66 66 62 39 35 36 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 9HL7ILbeskOof3OE.2Context: d33ef776affb956f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:26:25 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 39 48 4c 37 49 4c 62 65 73 6b 4f 6f 66 33 4f 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 33 33 65 66 37 37 36 61 66 66 62 39 35 36 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 9HL7ILbeskOof3OE.3Context: d33ef776affb956f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 06:26:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:26:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 70 63 44 6d 5a 73 51 51 55 2b 69 6c 6d 4d 75 4a 38 4f 63 61 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: hpcDmZsQQU+ilmMuJ8Ocag.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49709	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:26:28 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 5a 61 62 32 30 54 70 73 63 30 4b 65 34 6c 34 30 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 31 39 36 35 63 32 39 33 37 39 61 62 36 35 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Zab20Tpsc0Ke4l40.1Context: f1965c29379ab65a
2024-12-23 06:26:28 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:26:28 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 5a 61 62 32 30 54 70 73 63 30 4b 65 34 6c 34 30 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 31 39 36 35 63 32 39 33 37 39 61 62 36 35 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Zab20Tpsc0Ke4l40.2Context: f1965c29379ab65a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:26:28 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 5a 61 62 32 30 54 70 73 63 30 4b 65 34 6c 34 30 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 31 39 36 35 63 32 39 33 37 39 61 62 36 35 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: Zab20Tpsc0Ke4l40.3Context: f1965c29379ab65a
2024-12-23 06:26:28 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:26:28 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 53 6d 43 73 53 6e 52 74 6b 65 6f 33 39 48 43 4f 70 53 51 31 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dSmCsSnRtkeo39HCOpSQ1g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49721	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:26:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 7a 56 35 69 45 45 54 65 58 6b 61 52 42 57 48 6f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 38 62 65 34 32 36 66 36 32 30 61 36 61 38 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: zV5iEETeXkaRBWHo.1Context: 78be426f620a6a8a
2024-12-23 06:26:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:26:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 7a 56 35 69 45 45 54 65 58 6b 61 52 42 57 48 6f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 38 62 65 34 32 36 66 36 32 30 61 36 61 38 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: zV5iEETeXkaRBWHo.2Context: 78be426f620a6a8a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:26:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 7a 56 35 69 45 45 54 65 58 6b 61 52 42 57 48 6f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 38 62 65 34 32 36 66 36 32 30 61 36 61 38 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: zV5iEETeXkaRBWHo.3Context: 78be426f620a6a8a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 06:26:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:26:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 50 73 33 4d 35 44 58 7a 56 6b 75 34 66 45 2b 35 6f 6a 45 6b 6d 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Ps3M5DXzVku4fE+5ojEkmQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49734	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:26:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 4d 77 2f 33 63 53 6a 66 30 69 43 31 77 77 6f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 32 62 32 39 65 30 39 35 37 64 63 37 39 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: HMw/3cSjf0iC1wwo.1Context: 902b29e0957dc798
2024-12-23 06:26:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:26:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 48 4d 77 2f 33 63 53 6a 66 30 69 43 31 77 77 6f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 32 62 32 39 65 30 39 35 37 64 63 37 39 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: HMw/3cSjf0iC1wwo.2Context: 902b29e0957dc798<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:26:41 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 48 4d 77 2f 33 63 53 6a 66 30 69 43 31 77 77 6f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 32 62 32 39 65 30 39 35 37 64 63 37 39 38 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: HMw/3cSjf0iC1wwo.3Context: 902b29e0957dc798
2024-12-23 06:26:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:26:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 63 55 44 55 5a 47 65 4e 56 55 2b 6d 75 52 58 34 38 74 58 59 73 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: cUDUZGeNVU+muRX48tXYsQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49751	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:26:49 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 70 62 75 4a 46 59 59 43 55 79 6b 36 59 52 73 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 30 36 38 64 35 36 39 30 65 33 36 65 33 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mpbuJFYYCUyk6YRs.1Context: 43068d5690e36e3a
2024-12-23 06:26:49 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:26:49 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 70 62 75 4a 46 59 59 43 55 79 6b 36 59 52 73 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 30 36 38 64 35 36 39 30 65 33 36 65 33 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: mpbuJFYYCUyk6YRs.2Context: 43068d5690e36e3a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:26:49 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 70 62 75 4a 46 59 59 43 55 79 6b 36 59 52 73 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 30 36 38 64 35 36 39 30 65 33 36 65 33 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: mpbuJFYYCUyk6YRs.3Context: 43068d5690e36e3a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 06:26:49 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:26:49 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 68 4e 68 71 79 34 78 57 30 47 49 74 32 39 63 79 58 4b 4c 66 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: GhNhqy4xW0GIt29cyXKLfQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49772	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:26:57 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 57 54 67 45 65 43 6a 7a 30 32 67 38 4f 4d 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 65 34 66 35 38 38 38 62 31 35 63 31 37 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: PWTgEeCjz02g8OMa.1Context: b8e4f5888b15c176
2024-12-23 06:26:57 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:26:58 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 50 57 54 67 45 65 43 6a 7a 30 32 67 38 4f 4d 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 65 34 66 35 38 38 38 62 31 35 63 31 37 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: PWTgEeCjz02g8OMa.2Context: b8e4f5888b15c176<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:26:58 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 50 57 54 67 45 65 43 6a 7a 30 32 67 38 4f 4d 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 65 34 66 35 38 38 38 62 31 35 63 31 37 36 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: PWTgEeCjz02g8OMa.3Context: b8e4f5888b15c176
2024-12-23 06:26:58 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:26:58 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 37 36 63 39 46 4a 55 6c 45 71 54 4a 44 46 76 66 77 45 2f 56 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: q76c9FJUlEqTJDFvfwE/VQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49788	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:27:03 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 4f 6d 70 66 6b 5a 6b 49 55 6d 48 43 49 7a 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 61 63 63 36 38 33 38 34 34 61 66 38 62 31 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8OmpfkZkIUmHCIzi.1Context: 4acc683844af8b1b
2024-12-23 06:27:03 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:27:03 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 38 4f 6d 70 66 6b 5a 6b 49 55 6d 48 43 49 7a 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 61 63 63 36 38 33 38 34 34 61 66 38 62 31 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 8OmpfkZkIUmHCIzi.2Context: 4acc683844af8b1b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:27:03 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 4f 6d 70 66 6b 5a 6b 49 55 6d 48 43 49 7a 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 61 63 63 36 38 33 38 34 34 61 66 38 62 31 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8OmpfkZkIUmHCIzi.3Context: 4acc683844af8b1b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 06:27:03 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:27:03 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 45 32 69 4c 4f 71 4b 6a 55 65 69 36 55 79 49 63 7a 52 55 35 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gE2iLOqKjUei6UyIczRU5w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49812	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:27:16 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 5a 4b 35 37 2f 5a 4f 6c 48 45 71 39 41 6e 4d 4f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 63 65 61 36 62 66 61 38 38 35 33 39 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: ZK57/ZOlHEq9AnMO.1Context: 57cea6bfa885397
2024-12-23 06:27:16 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:27:16 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 5a 4b 35 37 2f 5a 4f 6c 48 45 71 39 41 6e 4d 4f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 63 65 61 36 62 66 61 38 38 35 33 39 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 50 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: ZK57/ZOlHEq9AnMO.2Context: 57cea6bfa885397<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVwP
2024-12-23 06:27:16 UTC	73	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 35 0d 0a 4d 53 2d 43 56 3a 20 5a 4b 35 37 2f 5a 4f 6c 48 45 71 39 41 6e 4d 4f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 63 65 61 36 62 66 61 38 38 35 33 39 37 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 55MS-CV: ZK57/ZOlHEq9AnMO.3Context: 57cea6bfa885397
2024-12-23 06:27:16 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:27:16 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6e 47 33 34 66 61 34 67 6a 45 4f 42 4d 4e 58 72 4e 36 66 78 32 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: nG34fa4gjEOBMNXrN6fx2w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49833	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:27:22 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 49 34 53 77 37 2f 4e 58 70 45 71 4c 78 2f 75 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 61 65 34 35 38 61 39 30 30 65 32 31 39 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: I4Sw7/NXpEqLx/uq.1Context: 62ae458a900e219b
2024-12-23 06:27:22 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:27:22 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 49 34 53 77 37 2f 4e 58 70 45 71 4c 78 2f 75 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 61 65 34 35 38 61 39 30 30 65 32 31 39 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: I4Sw7/NXpEqLx/uq.2Context: 62ae458a900e219b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:27:22 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 49 34 53 77 37 2f 4e 58 70 45 71 4c 78 2f 75 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 61 65 34 35 38 61 39 30 30 65 32 31 39 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: I4Sw7/NXpEqLx/uq.3Context: 62ae458a900e219b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 06:27:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:27:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 64 4e 49 50 4a 4e 47 55 45 36 66 78 69 30 75 35 71 59 53 4f 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: VdNIPJNGUE6fxi0u5qYSOw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49878	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:27:43 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 67 4c 41 70 48 4c 4e 68 61 6b 65 4a 72 70 72 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 64 38 31 63 33 37 34 31 33 61 65 37 35 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: gLApHLNhakeJrprJ.1Context: ffd81c37413ae757
2024-12-23 06:27:43 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:27:43 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 67 4c 41 70 48 4c 4e 68 61 6b 65 4a 72 70 72 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 64 38 31 63 33 37 34 31 33 61 65 37 35 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: gLApHLNhakeJrprJ.2Context: ffd81c37413ae757<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:27:43 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 67 4c 41 70 48 4c 4e 68 61 6b 65 4a 72 70 72 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 64 38 31 63 33 37 34 31 33 61 65 37 35 37 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: gLApHLNhakeJrprJ.3Context: ffd81c37413ae757
2024-12-23 06:27:43 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:27:43 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 51 7a 77 35 55 50 47 66 52 45 57 4a 56 62 54 6a 37 44 46 48 57 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Qzw5UPGfREWJVbTj7DFHWg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49891	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:27:48 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6b 4f 67 4d 56 6c 73 36 7a 55 43 73 58 57 79 2b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 36 66 63 33 64 66 34 30 61 38 38 66 66 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: kOgMVls6zUCsXWy+.1Context: e06fc3df40a88ffd
2024-12-23 06:27:48 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:27:48 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6b 4f 67 4d 56 6c 73 36 7a 55 43 73 58 57 79 2b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 36 66 63 33 64 66 34 30 61 38 38 66 66 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: kOgMVls6zUCsXWy+.2Context: e06fc3df40a88ffd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:27:48 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6b 4f 67 4d 56 6c 73 36 7a 55 43 73 58 57 79 2b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 36 66 63 33 64 66 34 30 61 38 38 66 66 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: kOgMVls6zUCsXWy+.3Context: e06fc3df40a88ffd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 06:27:49 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:27:49 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 43 4f 65 47 31 64 31 49 45 57 52 66 41 66 39 73 30 38 34 67 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: HCOeG1d1IEWRfAf9s084gQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49952	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:28:15 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 79 34 6e 65 35 66 6f 53 72 45 47 6b 72 54 4d 42 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 31 64 31 33 37 65 39 66 34 39 64 62 33 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: y4ne5foSrEGkrTMB.1Context: 701d137e9f49db32
2024-12-23 06:28:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:28:15 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 79 34 6e 65 35 66 6f 53 72 45 47 6b 72 54 4d 42 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 31 64 31 33 37 65 39 66 34 39 64 62 33 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: y4ne5foSrEGkrTMB.2Context: 701d137e9f49db32<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:28:15 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 79 34 6e 65 35 66 6f 53 72 45 47 6b 72 54 4d 42 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 31 64 31 33 37 65 39 66 34 39 64 62 33 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: y4ne5foSrEGkrTMB.3Context: 701d137e9f49db32<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 06:28:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:28:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 66 36 4a 4b 76 71 4d 49 6b 6d 32 4c 4d 59 63 31 51 35 69 69 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Sf6JKvqMIkm2LMYc1Q5iiQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49956	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:28:16 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4f 50 47 4b 64 70 72 42 37 30 75 64 69 6c 61 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 34 62 38 61 30 30 63 63 62 36 39 33 61 31 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: OPGKdprB70udilaM.1Context: 34b8a00ccb693a13
2024-12-23 06:28:16 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 06:28:16 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4f 50 47 4b 64 70 72 42 37 30 75 64 69 6c 61 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 34 62 38 61 30 30 63 63 62 36 39 33 61 31 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 65 69 75 6a 4a 42 37 43 41 4a 73 4d 6c 42 46 51 69 41 32 67 55 70 45 62 5a 56 32 2f 6b 4c 76 79 56 6d 57 68 37 2f 6e 4b 52 4e 52 30 42 59 42 51 66 69 5a 6e 4c 63 79 6d 39 64 62 56 73 68 6b 58 2f 4f 49 46 4b 57 56 70 57 79 52 32 67 4c 4f 67 5a 63 33 65 41 6a 79 74 34 6f 4f 57 65 6a 68 4c 55 4e 47 42 57 58 69 30 58 77 56 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: OPGKdprB70udilaM.2Context: 34b8a00ccb693a13<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATeiujJB7CAJsMlBFQiA2gUpEbZV2/kLvyVmWh7/nKRNR0BYBQfiZnLcym9dbVshkX/OIFKWVpWyR2gLOgZc3eAjyt4oOWejhLUNGBWXi0XwVw
2024-12-23 06:28:16 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 4f 50 47 4b 64 70 72 42 37 30 75 64 69 6c 61 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 34 62 38 61 30 30 63 63 62 36 39 33 61 31 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: OPGKdprB70udilaM.3Context: 34b8a00ccb693a13
2024-12-23 06:28:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 06:28:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6a 56 6a 4a 36 42 43 42 39 55 71 53 6c 62 4f 33 41 6f 6b 77 74 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: jVjJ6BCB9UqSlbO3Aokwtg.0Payload parsing failed.

Target ID:	0
Start time:	01:26:19
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\W53oi1JYy4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\W53oi1JYy4.exe"
Imagebase:	0x400000
File size:	2'764'288 bytes
MD5 hash:	BC72D38B806610A77E37D8B57D1D3721
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report W53oi1JYy4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: W53oi1JYy4.exePID: 6872, Parent PID: 4004

General

Chronological Activities

Disassembly

Windows Analysis Report
W53oi1JYy4.exe