Edit tour

Windows Analysis Report
https://www.support.av-ro.com/aU3V88/c1.php

Overview

General Information

Sample URL:	https://www.support.av-ro.com/aU3V88/c1.php
Analysis ID:	1589692
Infos:

Errors URL not reachable

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected non-DNS traffic on DNS port

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5912 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2332,i,7150791874960158825,1898553688990154955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5308 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.support.av-ro.com/aU3V88/c1.php" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://www.support.av-ro.com/aU3V88/c1.php

Avira URL Cloud: detection malicious, Label: phishing

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49783 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:61702 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.6:61639 -> 162.159.36.2:53

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49783 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.support.av-ro.com
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 61705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:61702 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@18/0@8/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2332,i,7150791874960158825,1898553688990154955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.support.av-ro.com/aU3V88/c1.php"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2332,i,7150791874960158825,1898553688990154955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://www.support.av-ro.com/aU3V88/c1.php	100%	Avira URL Cloud	phishing

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.186.100	true	false	high
www.support.av-ro.com	89.250.71.221	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
89.250.71.221	www.support.av-ro.com	Netherlands	41349	MVMTECH-ASRU	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589692
Start date and time:	2025-01-13 01:15:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.support.av-ro.com/aU3V88/c1.php
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@18/0@8/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 172.217.18.14, 66.102.1.84, 142.250.186.46, 142.250.74.206, 184.28.90.27, 4.175.87.197, 192.229.221.95, 40.69.42.241, 217.20.57.35, 142.250.185.206, 13.85.23.206, 20.242.39.171, 172.202.163.200, 142.250.181.238, 142.250.184.227, 2.23.227.215, 2.23.227.208, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, e86303.dscx.akamaiedge.net, redirector.gvt1.com, ocsp.digicert.com, www.bing.com.edgekey.net, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://www.support.av-ro.com/aU3V88/c1.php

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: https://www.support.av-ro.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://www.support.av-ro.com

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 01:16:35.841737032 CET	49673	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:35.841856956 CET	49674	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:36.154186964 CET	49672	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:43.780927896 CET	49716	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:43.780978918 CET	443	49716	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:43.781086922 CET	49716	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:43.781666040 CET	49716	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:43.781680107 CET	443	49716	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:44.577178955 CET	443	49716	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:44.577313900 CET	49716	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:44.583220959 CET	49716	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:44.583230019 CET	443	49716	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:44.583574057 CET	443	49716	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:44.586860895 CET	49716	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:44.587064028 CET	49716	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:44.587070942 CET	443	49716	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:44.587371111 CET	49716	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:44.635320902 CET	443	49716	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:44.761913061 CET	443	49716	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:44.762041092 CET	443	49716	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:44.762216091 CET	49716	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:44.762415886 CET	49716	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:45.449273109 CET	49674	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:45.449285030 CET	49673	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:45.761720896 CET	49672	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:46.571397066 CET	49718	443	192.168.2.6	142.250.186.100
Jan 13, 2025 01:16:46.571434975 CET	443	49718	142.250.186.100	192.168.2.6
Jan 13, 2025 01:16:46.571523905 CET	49718	443	192.168.2.6	142.250.186.100
Jan 13, 2025 01:16:46.572441101 CET	49718	443	192.168.2.6	142.250.186.100
Jan 13, 2025 01:16:46.572459936 CET	443	49718	142.250.186.100	192.168.2.6
Jan 13, 2025 01:16:47.214350939 CET	443	49718	142.250.186.100	192.168.2.6
Jan 13, 2025 01:16:47.218024969 CET	49718	443	192.168.2.6	142.250.186.100
Jan 13, 2025 01:16:47.218054056 CET	443	49718	142.250.186.100	192.168.2.6
Jan 13, 2025 01:16:47.219131947 CET	443	49718	142.250.186.100	192.168.2.6
Jan 13, 2025 01:16:47.219232082 CET	49718	443	192.168.2.6	142.250.186.100
Jan 13, 2025 01:16:47.236979008 CET	49718	443	192.168.2.6	142.250.186.100
Jan 13, 2025 01:16:47.237067938 CET	443	49718	142.250.186.100	192.168.2.6
Jan 13, 2025 01:16:47.285527945 CET	49718	443	192.168.2.6	142.250.186.100
Jan 13, 2025 01:16:47.285574913 CET	443	49718	142.250.186.100	192.168.2.6
Jan 13, 2025 01:16:47.332379103 CET	49718	443	192.168.2.6	142.250.186.100
Jan 13, 2025 01:16:47.541943073 CET	443	49705	173.222.162.64	192.168.2.6
Jan 13, 2025 01:16:47.542053938 CET	49705	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:50.276293993 CET	49732	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:16:50.276329994 CET	443	49732	89.250.71.221	192.168.2.6
Jan 13, 2025 01:16:50.276397943 CET	49732	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:16:50.276983023 CET	49733	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:16:50.277021885 CET	443	49733	89.250.71.221	192.168.2.6
Jan 13, 2025 01:16:50.277080059 CET	49733	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:16:50.278275013 CET	49733	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:16:50.278292894 CET	443	49733	89.250.71.221	192.168.2.6
Jan 13, 2025 01:16:50.278508902 CET	49732	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:16:50.278522968 CET	443	49732	89.250.71.221	192.168.2.6
Jan 13, 2025 01:16:51.599620104 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:51.599663973 CET	443	49740	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:51.599739075 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:51.600384951 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:51.600410938 CET	443	49740	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:52.417793036 CET	443	49740	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:52.417937040 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:52.420437098 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:52.420453072 CET	443	49740	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:52.420798063 CET	443	49740	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:52.422940016 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:52.422983885 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:52.422995090 CET	443	49740	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:52.423187971 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:52.463340998 CET	443	49740	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:52.603724957 CET	443	49740	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:52.603782892 CET	443	49740	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:52.604305029 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:52.605253935 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:52.605253935 CET	49740	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:16:52.605282068 CET	443	49740	40.113.110.67	192.168.2.6
Jan 13, 2025 01:16:57.130177975 CET	443	49718	142.250.186.100	192.168.2.6
Jan 13, 2025 01:16:57.130255938 CET	443	49718	142.250.186.100	192.168.2.6
Jan 13, 2025 01:16:57.130335093 CET	49718	443	192.168.2.6	142.250.186.100
Jan 13, 2025 01:16:58.775790930 CET	49705	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:58.775887012 CET	49705	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:58.776283979 CET	49783	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:58.776329994 CET	443	49783	173.222.162.64	192.168.2.6
Jan 13, 2025 01:16:58.776407957 CET	49783	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:58.776716948 CET	49783	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:16:58.776730061 CET	443	49783	173.222.162.64	192.168.2.6
Jan 13, 2025 01:16:58.780641079 CET	443	49705	173.222.162.64	192.168.2.6
Jan 13, 2025 01:16:58.780787945 CET	443	49705	173.222.162.64	192.168.2.6
Jan 13, 2025 01:16:59.058324099 CET	49718	443	192.168.2.6	142.250.186.100
Jan 13, 2025 01:16:59.058412075 CET	443	49718	142.250.186.100	192.168.2.6
Jan 13, 2025 01:16:59.376060963 CET	443	49783	173.222.162.64	192.168.2.6
Jan 13, 2025 01:16:59.376148939 CET	49783	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:17:03.633915901 CET	49815	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:17:03.634010077 CET	443	49815	40.113.110.67	192.168.2.6
Jan 13, 2025 01:17:03.634108067 CET	49815	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:17:03.635241032 CET	49815	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:17:03.635271072 CET	443	49815	40.113.110.67	192.168.2.6
Jan 13, 2025 01:17:04.415005922 CET	443	49815	40.113.110.67	192.168.2.6
Jan 13, 2025 01:17:04.415132999 CET	49815	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:17:04.418899059 CET	49815	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:17:04.418927908 CET	443	49815	40.113.110.67	192.168.2.6
Jan 13, 2025 01:17:04.419262886 CET	443	49815	40.113.110.67	192.168.2.6
Jan 13, 2025 01:17:04.421144009 CET	49815	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:17:04.421406984 CET	49815	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:17:04.421418905 CET	443	49815	40.113.110.67	192.168.2.6
Jan 13, 2025 01:17:04.421791077 CET	49815	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:17:04.467331886 CET	443	49815	40.113.110.67	192.168.2.6
Jan 13, 2025 01:17:04.596716881 CET	443	49815	40.113.110.67	192.168.2.6
Jan 13, 2025 01:17:04.596802950 CET	443	49815	40.113.110.67	192.168.2.6
Jan 13, 2025 01:17:04.596908092 CET	49815	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:17:04.597148895 CET	49815	443	192.168.2.6	40.113.110.67
Jan 13, 2025 01:17:04.597191095 CET	443	49815	40.113.110.67	192.168.2.6
Jan 13, 2025 01:17:11.734664917 CET	61639	53	192.168.2.6	162.159.36.2
Jan 13, 2025 01:17:11.739837885 CET	53	61639	162.159.36.2	192.168.2.6
Jan 13, 2025 01:17:11.739934921 CET	61639	53	192.168.2.6	162.159.36.2
Jan 13, 2025 01:17:11.739973068 CET	61639	53	192.168.2.6	162.159.36.2
Jan 13, 2025 01:17:11.744740963 CET	53	61639	162.159.36.2	192.168.2.6
Jan 13, 2025 01:17:12.184273005 CET	53	61639	162.159.36.2	192.168.2.6
Jan 13, 2025 01:17:12.185301065 CET	61639	53	192.168.2.6	162.159.36.2
Jan 13, 2025 01:17:12.190351009 CET	53	61639	162.159.36.2	192.168.2.6
Jan 13, 2025 01:17:12.190423012 CET	61639	53	192.168.2.6	162.159.36.2
Jan 13, 2025 01:17:18.570314884 CET	443	49783	173.222.162.64	192.168.2.6
Jan 13, 2025 01:17:18.570405960 CET	49783	443	192.168.2.6	173.222.162.64
Jan 13, 2025 01:17:20.280431032 CET	49733	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:17:20.280559063 CET	49732	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:17:20.280591965 CET	443	49733	89.250.71.221	192.168.2.6
Jan 13, 2025 01:17:20.280644894 CET	49733	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:17:20.280740976 CET	443	49732	89.250.71.221	192.168.2.6
Jan 13, 2025 01:17:20.280797958 CET	49732	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:17:21.798687935 CET	61702	443	192.168.2.6	40.113.103.199
Jan 13, 2025 01:17:21.798733950 CET	443	61702	40.113.103.199	192.168.2.6
Jan 13, 2025 01:17:21.798870087 CET	61702	443	192.168.2.6	40.113.103.199
Jan 13, 2025 01:17:21.799716949 CET	61702	443	192.168.2.6	40.113.103.199
Jan 13, 2025 01:17:21.799731970 CET	443	61702	40.113.103.199	192.168.2.6
Jan 13, 2025 01:17:21.956264973 CET	49707	443	192.168.2.6	40.126.32.74
Jan 13, 2025 01:17:21.956319094 CET	49707	443	192.168.2.6	40.126.32.74
Jan 13, 2025 01:17:21.961250067 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:21.961271048 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:21.961297989 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:21.961311102 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:21.961325884 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.171699047 CET	61705	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:17:22.171781063 CET	443	61705	89.250.71.221	192.168.2.6
Jan 13, 2025 01:17:22.171951056 CET	61705	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:17:22.172489882 CET	61706	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:17:22.172600031 CET	443	61706	89.250.71.221	192.168.2.6
Jan 13, 2025 01:17:22.172679901 CET	61706	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:17:22.173069954 CET	61705	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:17:22.173108101 CET	443	61705	89.250.71.221	192.168.2.6
Jan 13, 2025 01:17:22.173345089 CET	61706	443	192.168.2.6	89.250.71.221
Jan 13, 2025 01:17:22.173376083 CET	443	61706	89.250.71.221	192.168.2.6
Jan 13, 2025 01:17:22.340085030 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340106964 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340121984 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340195894 CET	49707	443	192.168.2.6	40.126.32.74
Jan 13, 2025 01:17:22.340415001 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340430975 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340447903 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340464115 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340471029 CET	49707	443	192.168.2.6	40.126.32.74
Jan 13, 2025 01:17:22.340480089 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340493917 CET	49707	443	192.168.2.6	40.126.32.74
Jan 13, 2025 01:17:22.340605974 CET	49707	443	192.168.2.6	40.126.32.74
Jan 13, 2025 01:17:22.340692997 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340708971 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340724945 CET	443	49707	40.126.32.74	192.168.2.6
Jan 13, 2025 01:17:22.340759039 CET	49707	443	192.168.2.6	40.126.32.74
Jan 13, 2025 01:17:22.385854959 CET	49707	443	192.168.2.6	40.126.32.74
Jan 13, 2025 01:17:22.593679905 CET	443	61702	40.113.103.199	192.168.2.6
Jan 13, 2025 01:17:22.593765974 CET	61702	443	192.168.2.6	40.113.103.199
Jan 13, 2025 01:17:22.597376108 CET	61702	443	192.168.2.6	40.113.103.199
Jan 13, 2025 01:17:22.597383022 CET	443	61702	40.113.103.199	192.168.2.6
Jan 13, 2025 01:17:22.597696066 CET	443	61702	40.113.103.199	192.168.2.6
Jan 13, 2025 01:17:22.600678921 CET	61702	443	192.168.2.6	40.113.103.199
Jan 13, 2025 01:17:22.600861073 CET	61702	443	192.168.2.6	40.113.103.199
Jan 13, 2025 01:17:22.600866079 CET	443	61702	40.113.103.199	192.168.2.6
Jan 13, 2025 01:17:22.601361990 CET	61702	443	192.168.2.6	40.113.103.199
Jan 13, 2025 01:17:22.647320032 CET	443	61702	40.113.103.199	192.168.2.6
Jan 13, 2025 01:17:22.775739908 CET	443	61702	40.113.103.199	192.168.2.6
Jan 13, 2025 01:17:22.775861025 CET	443	61702	40.113.103.199	192.168.2.6
Jan 13, 2025 01:17:22.775912046 CET	61702	443	192.168.2.6	40.113.103.199
Jan 13, 2025 01:17:22.776428938 CET	61702	443	192.168.2.6	40.113.103.199
Jan 13, 2025 01:17:22.776443005 CET	443	61702	40.113.103.199	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 01:16:42.508433104 CET	53	49320	1.1.1.1	192.168.2.6
Jan 13, 2025 01:16:42.578133106 CET	53	59773	1.1.1.1	192.168.2.6
Jan 13, 2025 01:16:43.549216986 CET	53	59211	1.1.1.1	192.168.2.6
Jan 13, 2025 01:16:46.561920881 CET	55115	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:16:46.562047005 CET	55937	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:16:46.568651915 CET	53	55115	1.1.1.1	192.168.2.6
Jan 13, 2025 01:16:46.568726063 CET	53	55937	1.1.1.1	192.168.2.6
Jan 13, 2025 01:16:48.576527119 CET	62043	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:16:48.577042103 CET	55281	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:16:49.637059927 CET	63627	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:16:49.641247034 CET	64669	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:16:50.156013012 CET	53	62043	1.1.1.1	192.168.2.6
Jan 13, 2025 01:16:52.439677000 CET	53	63627	1.1.1.1	192.168.2.6
Jan 13, 2025 01:16:54.916331053 CET	53	55281	1.1.1.1	192.168.2.6
Jan 13, 2025 01:16:56.723217010 CET	53	64669	1.1.1.1	192.168.2.6
Jan 13, 2025 01:17:00.989218950 CET	53	55171	1.1.1.1	192.168.2.6
Jan 13, 2025 01:17:11.733881950 CET	53	56470	162.159.36.2	192.168.2.6
Jan 13, 2025 01:17:12.200361967 CET	62690	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:17:12.207364082 CET	53	62690	1.1.1.1	192.168.2.6
Jan 13, 2025 01:17:22.108134031 CET	58959	53	192.168.2.6	1.1.1.1
Jan 13, 2025 01:17:22.168831110 CET	53	58959	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 13, 2025 01:16:52.439789057 CET	192.168.2.6	1.1.1.1	c1fd	(Port unreachable)	Destination Unreachable
Jan 13, 2025 01:16:54.916409016 CET	192.168.2.6	1.1.1.1	c1ed	(Port unreachable)	Destination Unreachable
Jan 13, 2025 01:16:56.723331928 CET	192.168.2.6	1.1.1.1	c244	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 01:16:46.561920881 CET	192.168.2.6	1.1.1.1	0x5a75	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:46.562047005 CET	192.168.2.6	1.1.1.1	0xd89e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 13, 2025 01:16:48.576527119 CET	192.168.2.6	1.1.1.1	0xf7bb	Standard query (0)	www.support.av-ro.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:48.577042103 CET	192.168.2.6	1.1.1.1	0x9e44	Standard query (0)	www.support.av-ro.com	65	IN (0x0001)	false
Jan 13, 2025 01:16:49.637059927 CET	192.168.2.6	1.1.1.1	0x2816	Standard query (0)	www.support.av-ro.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:49.641247034 CET	192.168.2.6	1.1.1.1	0x20ef	Standard query (0)	www.support.av-ro.com	65	IN (0x0001)	false
Jan 13, 2025 01:17:12.200361967 CET	192.168.2.6	1.1.1.1	0x4617	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 13, 2025 01:17:22.108134031 CET	192.168.2.6	1.1.1.1	0x7608	Standard query (0)	www.support.av-ro.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 01:16:46.568651915 CET	1.1.1.1	192.168.2.6	0x5a75	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:46.568726063 CET	1.1.1.1	192.168.2.6	0xd89e	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 13, 2025 01:16:47.213180065 CET	1.1.1.1	192.168.2.6	0x6e67	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 01:16:47.213180065 CET	1.1.1.1	192.168.2.6	0x6e67	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:50.156013012 CET	1.1.1.1	192.168.2.6	0xf7bb	No error (0)	www.support.av-ro.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:52.439677000 CET	1.1.1.1	192.168.2.6	0x2816	No error (0)	www.support.av-ro.com		89.250.71.221	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:54.916331053 CET	1.1.1.1	192.168.2.6	0x9e44	Server failure (2)	www.support.av-ro.com	none	none	65	IN (0x0001)	false
Jan 13, 2025 01:16:56.669718981 CET	1.1.1.1	192.168.2.6	0x533c	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 01:16:56.669718981 CET	1.1.1.1	192.168.2.6	0x533c	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:58.632992029 CET	1.1.1.1	192.168.2.6	0xb8f1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:58.632992029 CET	1.1.1.1	192.168.2.6	0xb8f1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:58.632992029 CET	1.1.1.1	192.168.2.6	0xb8f1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:58.632992029 CET	1.1.1.1	192.168.2.6	0xb8f1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:58.632992029 CET	1.1.1.1	192.168.2.6	0xb8f1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:58.632992029 CET	1.1.1.1	192.168.2.6	0xb8f1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:58.632992029 CET	1.1.1.1	192.168.2.6	0xb8f1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:16:58.632992029 CET	1.1.1.1	192.168.2.6	0xb8f1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 13, 2025 01:17:12.207364082 CET	1.1.1.1	192.168.2.6	0x4617	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 13, 2025 01:17:22.168831110 CET	1.1.1.1	192.168.2.6	0x7608	No error (0)	www.support.av-ro.com		89.250.71.221	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49716	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:16:44 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 75 48 6f 2f 2f 67 78 6c 38 45 4b 6b 48 37 33 76 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 35 64 30 39 64 38 64 37 34 38 33 39 64 36 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: uHo//gxl8EKkH73v.1Context: b5d09d8d74839d65
2025-01-13 00:16:44 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 00:16:44 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 75 48 6f 2f 2f 67 78 6c 38 45 4b 6b 48 37 33 76 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 35 64 30 39 64 38 64 37 34 38 33 39 64 36 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 49 46 6e 66 37 2f 70 38 73 4c 65 64 2f 63 4c 58 63 4c 66 30 4b 43 56 55 5a 4b 55 30 50 56 4f 32 72 65 77 75 38 34 65 6e 75 31 72 2b 6b 48 42 46 4d 4d 65 52 48 4c 41 6b 7a 72 52 34 51 58 78 64 4d 76 64 39 55 55 52 79 51 45 72 78 2f 42 38 32 4b 32 65 4b 50 71 36 2b 6f 30 45 65 49 44 36 6e 42 34 75 45 30 38 34 36 44 58 42 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: uHo//gxl8EKkH73v.2Context: b5d09d8d74839d65<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfIFnf7/p8sLed/cLXcLf0KCVUZKU0PVO2rewu84enu1r+kHBFMMeRHLAkzrR4QXxdMvd9UURyQErx/B82K2eKPq6+o0EeID6nB4uE0846DXBh
2025-01-13 00:16:44 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 75 48 6f 2f 2f 67 78 6c 38 45 4b 6b 48 37 33 76 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 35 64 30 39 64 38 64 37 34 38 33 39 64 36 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: uHo//gxl8EKkH73v.3Context: b5d09d8d74839d65<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 00:16:44 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 00:16:44 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 45 34 44 36 49 44 38 72 6b 57 75 37 30 49 6f 51 33 5a 2f 49 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qE4D6ID8rkWu70IoQ3Z/Iw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49740	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:16:52 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 57 66 4c 70 45 51 33 4e 6b 55 65 44 49 32 70 68 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 62 64 62 35 30 36 32 63 31 34 39 36 62 31 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: WfLpEQ3NkUeDI2ph.1Context: dbdb5062c1496b14
2025-01-13 00:16:52 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 00:16:52 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 57 66 4c 70 45 51 33 4e 6b 55 65 44 49 32 70 68 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 62 64 62 35 30 36 32 63 31 34 39 36 62 31 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 49 46 6e 66 37 2f 70 38 73 4c 65 64 2f 63 4c 58 63 4c 66 30 4b 43 56 55 5a 4b 55 30 50 56 4f 32 72 65 77 75 38 34 65 6e 75 31 72 2b 6b 48 42 46 4d 4d 65 52 48 4c 41 6b 7a 72 52 34 51 58 78 64 4d 76 64 39 55 55 52 79 51 45 72 78 2f 42 38 32 4b 32 65 4b 50 71 36 2b 6f 30 45 65 49 44 36 6e 42 34 75 45 30 38 34 36 44 58 42 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: WfLpEQ3NkUeDI2ph.2Context: dbdb5062c1496b14<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfIFnf7/p8sLed/cLXcLf0KCVUZKU0PVO2rewu84enu1r+kHBFMMeRHLAkzrR4QXxdMvd9UURyQErx/B82K2eKPq6+o0EeID6nB4uE0846DXBh
2025-01-13 00:16:52 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 57 66 4c 70 45 51 33 4e 6b 55 65 44 49 32 70 68 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 62 64 62 35 30 36 32 63 31 34 39 36 62 31 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: WfLpEQ3NkUeDI2ph.3Context: dbdb5062c1496b14<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 00:16:52 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 00:16:52 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 48 64 5a 34 44 4c 54 2f 55 69 50 67 49 6a 32 68 6f 78 2f 71 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /HdZ4DLT/UiPgIj2hox/qA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49815	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:17:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 45 48 39 2b 33 6f 4c 4d 47 55 43 6b 42 67 74 78 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 38 64 64 39 36 63 34 31 38 32 64 34 63 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: EH9+3oLMGUCkBgtx.1Context: 7b8dd96c4182d4ca
2025-01-13 00:17:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 00:17:04 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 45 48 39 2b 33 6f 4c 4d 47 55 43 6b 42 67 74 78 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 38 64 64 39 36 63 34 31 38 32 64 34 63 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 49 46 6e 66 37 2f 70 38 73 4c 65 64 2f 63 4c 58 63 4c 66 30 4b 43 56 55 5a 4b 55 30 50 56 4f 32 72 65 77 75 38 34 65 6e 75 31 72 2b 6b 48 42 46 4d 4d 65 52 48 4c 41 6b 7a 72 52 34 51 58 78 64 4d 76 64 39 55 55 52 79 51 45 72 78 2f 42 38 32 4b 32 65 4b 50 71 36 2b 6f 30 45 65 49 44 36 6e 42 34 75 45 30 38 34 36 44 58 42 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: EH9+3oLMGUCkBgtx.2Context: 7b8dd96c4182d4ca<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfIFnf7/p8sLed/cLXcLf0KCVUZKU0PVO2rewu84enu1r+kHBFMMeRHLAkzrR4QXxdMvd9UURyQErx/B82K2eKPq6+o0EeID6nB4uE0846DXBh
2025-01-13 00:17:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 45 48 39 2b 33 6f 4c 4d 47 55 43 6b 42 67 74 78 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 38 64 64 39 36 63 34 31 38 32 64 34 63 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: EH9+3oLMGUCkBgtx.3Context: 7b8dd96c4182d4ca<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 00:17:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 00:17:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 57 35 65 4c 76 47 4c 58 33 45 57 4e 79 52 39 63 2f 64 38 69 34 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: W5eLvGLX3EWNyR9c/d8i4w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	61702	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2025-01-13 00:17:22 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 69 49 7a 6f 35 30 39 55 45 32 59 37 52 6d 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 35 31 39 65 34 65 61 34 64 38 36 66 31 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: NiIzo509UE2Y7Rmr.1Context: 84519e4ea4d86f1d
2025-01-13 00:17:22 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-13 00:17:22 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 69 49 7a 6f 35 30 39 55 45 32 59 37 52 6d 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 35 31 39 65 34 65 61 34 64 38 36 66 31 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 49 46 6e 66 37 2f 70 38 73 4c 65 64 2f 63 4c 58 63 4c 66 30 4b 43 56 55 5a 4b 55 30 50 56 4f 32 72 65 77 75 38 34 65 6e 75 31 72 2b 6b 48 42 46 4d 4d 65 52 48 4c 41 6b 7a 72 52 34 51 58 78 64 4d 76 64 39 55 55 52 79 51 45 72 78 2f 42 38 32 4b 32 65 4b 50 71 36 2b 6f 30 45 65 49 44 36 6e 42 34 75 45 30 38 34 36 44 58 42 68 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: NiIzo509UE2Y7Rmr.2Context: 84519e4ea4d86f1d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfIFnf7/p8sLed/cLXcLf0KCVUZKU0PVO2rewu84enu1r+kHBFMMeRHLAkzrR4QXxdMvd9UURyQErx/B82K2eKPq6+o0EeID6nB4uE0846DXBh
2025-01-13 00:17:22 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 69 49 7a 6f 35 30 39 55 45 32 59 37 52 6d 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 35 31 39 65 34 65 61 34 64 38 36 66 31 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: NiIzo509UE2Y7Rmr.3Context: 84519e4ea4d86f1d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-13 00:17:22 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-13 00:17:22 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 36 48 66 38 7a 50 55 4c 6b 75 65 42 4b 31 70 31 51 41 78 52 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: D6Hf8zPULkueBK1p1QAxRA.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5020, Parent PID: 5840

General

Target ID:	1
Start time:	19:16:37
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5912, Parent PID: 5020

General

Target ID:	3
Start time:	19:16:40
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2332,i,7150791874960158825,1898553688990154955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5308, Parent PID: 5840

General

Target ID:	4
Start time:	19:16:47
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.support.av-ro.com/aU3V88/c1.php"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.support.av-ro.com/aU3V88/c1.php

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5020, Parent PID: 5840

General

Chronological Activities

Analysis Process: chrome.exePID: 5912, Parent PID: 5020

General

Chronological Activities

Analysis Process: chrome.exePID: 5308, Parent PID: 5840

General

Chronological Activities

Disassembly

Windows Analysis Report
https://www.support.av-ro.com/aU3V88/c1.php