Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://https:/u.infotracktiu.top/l

Overview

General Information

Sample URL:http://https:/u.infotracktiu.top/l
Analysis ID:1525136
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected non-DNS traffic on DNS port

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 2496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • chrome.exe (PID: 4412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2236,i,10249122622215152608,6724685745945457616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • chrome.exe (PID: 6404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://https:/u.infotracktiu.top/l" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownHTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:63892 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:63895 version: TLS 1.2
Source: global trafficTCP traffic: 192.168.2.6:63887 -> 162.159.36.2:53
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknownTCP traffic detected without corresponding DNS query: 40.115.3.253
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: google.com
Source: global trafficDNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63895 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63894 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 63892 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63892
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63894
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63895
Source: unknownHTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:63892 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:63895 version: TLS 1.2
Source: classification engineClassification label: clean0.win@20/0@6/5
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2236,i,10249122622215152608,6724685745945457616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://https:/u.infotracktiu.top/l"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2236,i,10249122622215152608,6724685745945457616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalse
    		unknown
    google.com
    		216.58.206.46
    		truefalse
      		unknown
      www.google.com
      		172.217.18.100
      		truefalse
        		unknown
        fp2e7a.wpc.phicdn.net
        		192.229.221.95
        		truefalse
          		unknown
          241.42.69.40.in-addr.arpa
          		unknown
          		unknownfalse
            		unknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            142.250.184.196
            		unknownUnited States
            		15169GOOGLEUSfalse
            239.255.255.250
            		unknownReserved
            		unknownunknownfalse
            172.217.18.100
            		www.google.comUnited States
            		15169GOOGLEUSfalse

            Private

            IP
            192.168.2.8
            192.168.2.6

            General Information

            Joe Sandbox version:41.0.0 Charoite
            Analysis ID:1525136
            Start date and time:2024-10-03 18:38:07 +02:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 3m 9s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:browseurl.jbs
            Sample URL:http://https:/u.infotracktiu.top/l
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:6
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Detection:CLEAN
            Classification:clean0.win@20/0@6/5
            EGA Information:Failed
            HCA Information:
            • Successful, ratio: 100%
            • Number of executed functions: 0
            • Number of non-executed functions: 0

            Warnings

            • Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
            • Excluded IPs from analysis (whitelisted): 142.250.184.227, 142.250.185.206, 66.102.1.84, 34.104.35.123, 4.175.87.197, 192.229.221.95, 13.85.23.206, 199.232.210.172, 40.69.42.241, 20.109.210.53, 142.250.181.227
            • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
            • Not all processes where analyzed, report is missing behavior information
            • Report size getting too big, too many NtSetInformationFile calls found.
            • VT rate limit hit for: http://https:/u.infotracktiu.top/l

            Simulations

            Behavior and APIs

            ⊘No simulations

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            ⊘No created / dropped files found

            Static File Info

            ⊘No static file info

            Network Behavior

            Network Port Distribution

            TCP Packets

            TimestampSource PortDest PortSource IPDest IP
            Oct 3, 2024 18:38:52.215538025 CEST49673443192.168.2.6173.222.162.64
            Oct 3, 2024 18:38:52.215585947 CEST49674443192.168.2.6173.222.162.64
            Oct 3, 2024 18:38:52.512408018 CEST49672443192.168.2.6173.222.162.64
            Oct 3, 2024 18:39:01.871790886 CEST49673443192.168.2.6173.222.162.64
            Oct 3, 2024 18:39:01.934302092 CEST49674443192.168.2.6173.222.162.64
            Oct 3, 2024 18:39:02.198576927 CEST49672443192.168.2.6173.222.162.64
            Oct 3, 2024 18:39:02.530471087 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:02.530524015 CEST4434971140.115.3.253192.168.2.6
            Oct 3, 2024 18:39:02.530715942 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:02.531447887 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:02.531466007 CEST4434971140.115.3.253192.168.2.6
            Oct 3, 2024 18:39:03.355003119 CEST4434971140.115.3.253192.168.2.6
            Oct 3, 2024 18:39:03.355132103 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:03.361352921 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:03.361360073 CEST4434971140.115.3.253192.168.2.6
            Oct 3, 2024 18:39:03.361664057 CEST4434971140.115.3.253192.168.2.6
            Oct 3, 2024 18:39:03.364280939 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:03.364712000 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:03.364720106 CEST4434971140.115.3.253192.168.2.6
            Oct 3, 2024 18:39:03.364901066 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:03.411401987 CEST4434971140.115.3.253192.168.2.6
            Oct 3, 2024 18:39:03.536350965 CEST4434971140.115.3.253192.168.2.6
            Oct 3, 2024 18:39:03.536712885 CEST4434971140.115.3.253192.168.2.6
            Oct 3, 2024 18:39:03.536847115 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:03.537542105 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:03.537575960 CEST4434971140.115.3.253192.168.2.6
            Oct 3, 2024 18:39:03.537632942 CEST49711443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:03.804580927 CEST44349703173.222.162.64192.168.2.6
            Oct 3, 2024 18:39:03.804825068 CEST49703443192.168.2.6173.222.162.64
            Oct 3, 2024 18:39:06.826325893 CEST49716443192.168.2.6172.217.18.100
            Oct 3, 2024 18:39:06.826359034 CEST44349716172.217.18.100192.168.2.6
            Oct 3, 2024 18:39:06.826452017 CEST49716443192.168.2.6172.217.18.100
            Oct 3, 2024 18:39:06.828113079 CEST49716443192.168.2.6172.217.18.100
            Oct 3, 2024 18:39:06.828128099 CEST44349716172.217.18.100192.168.2.6
            Oct 3, 2024 18:39:06.937587023 CEST49717443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:06.937681913 CEST44349717184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:06.937781096 CEST49717443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:06.939563990 CEST49717443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:06.939599991 CEST44349717184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:07.504568100 CEST44349716172.217.18.100192.168.2.6
            Oct 3, 2024 18:39:07.505042076 CEST49716443192.168.2.6172.217.18.100
            Oct 3, 2024 18:39:07.505074024 CEST44349716172.217.18.100192.168.2.6
            Oct 3, 2024 18:39:07.506071091 CEST44349716172.217.18.100192.168.2.6
            Oct 3, 2024 18:39:07.506139040 CEST49716443192.168.2.6172.217.18.100
            Oct 3, 2024 18:39:07.513026953 CEST49716443192.168.2.6172.217.18.100
            Oct 3, 2024 18:39:07.513139963 CEST44349716172.217.18.100192.168.2.6
            Oct 3, 2024 18:39:07.552414894 CEST49716443192.168.2.6172.217.18.100
            Oct 3, 2024 18:39:07.552424908 CEST44349716172.217.18.100192.168.2.6
            Oct 3, 2024 18:39:07.604906082 CEST44349717184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:07.605010986 CEST49717443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:07.605700016 CEST49716443192.168.2.6172.217.18.100
            Oct 3, 2024 18:39:07.638761997 CEST49717443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:07.638804913 CEST44349717184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:07.639137030 CEST44349717184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:07.686014891 CEST49717443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:08.214782953 CEST49717443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:08.259407997 CEST44349717184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:08.403724909 CEST44349717184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:08.403786898 CEST44349717184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:08.403848886 CEST49717443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:08.404793978 CEST49717443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:08.404814005 CEST44349717184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:08.404825926 CEST49717443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:08.404833078 CEST44349717184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:08.482634068 CEST49719443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:08.482667923 CEST44349719184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:08.482750893 CEST49719443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:08.483252048 CEST49719443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:08.483267069 CEST44349719184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:09.143564939 CEST44349719184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:09.143640995 CEST49719443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:09.147772074 CEST49719443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:09.147777081 CEST44349719184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:09.148044109 CEST44349719184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:09.149293900 CEST49719443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:09.191435099 CEST44349719184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:09.420480013 CEST44349719184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:09.420547009 CEST44349719184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:09.420622110 CEST49719443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:09.427858114 CEST49719443192.168.2.6184.28.90.27
            Oct 3, 2024 18:39:09.427881956 CEST44349719184.28.90.27192.168.2.6
            Oct 3, 2024 18:39:10.533288956 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:10.533319950 CEST4434972040.115.3.253192.168.2.6
            Oct 3, 2024 18:39:10.533381939 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:10.533993959 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:10.534015894 CEST4434972040.115.3.253192.168.2.6
            Oct 3, 2024 18:39:11.519222975 CEST4434972040.115.3.253192.168.2.6
            Oct 3, 2024 18:39:11.519309998 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:11.521883965 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:11.521897078 CEST4434972040.115.3.253192.168.2.6
            Oct 3, 2024 18:39:11.522228003 CEST4434972040.115.3.253192.168.2.6
            Oct 3, 2024 18:39:11.524910927 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:11.524981976 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:11.524991035 CEST4434972040.115.3.253192.168.2.6
            Oct 3, 2024 18:39:11.525113106 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:11.567395926 CEST4434972040.115.3.253192.168.2.6
            Oct 3, 2024 18:39:11.706849098 CEST4434972040.115.3.253192.168.2.6
            Oct 3, 2024 18:39:11.707130909 CEST4434972040.115.3.253192.168.2.6
            Oct 3, 2024 18:39:11.707194090 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:11.707442045 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:11.707456112 CEST4434972040.115.3.253192.168.2.6
            Oct 3, 2024 18:39:11.707470894 CEST49720443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:17.390441895 CEST44349716172.217.18.100192.168.2.6
            Oct 3, 2024 18:39:17.390501976 CEST44349716172.217.18.100192.168.2.6
            Oct 3, 2024 18:39:17.390614986 CEST49716443192.168.2.6172.217.18.100
            Oct 3, 2024 18:39:18.611393929 CEST49716443192.168.2.6172.217.18.100
            Oct 3, 2024 18:39:18.611442089 CEST44349716172.217.18.100192.168.2.6
            Oct 3, 2024 18:39:23.291858912 CEST49725443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:23.291907072 CEST4434972540.115.3.253192.168.2.6
            Oct 3, 2024 18:39:23.292479992 CEST49725443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:23.293057919 CEST49725443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:23.293068886 CEST4434972540.115.3.253192.168.2.6
            Oct 3, 2024 18:39:24.160815954 CEST4434972540.115.3.253192.168.2.6
            Oct 3, 2024 18:39:24.160921097 CEST49725443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:24.174015045 CEST49725443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:24.174031019 CEST4434972540.115.3.253192.168.2.6
            Oct 3, 2024 18:39:24.174303055 CEST4434972540.115.3.253192.168.2.6
            Oct 3, 2024 18:39:24.178599119 CEST49725443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:24.178720951 CEST49725443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:24.178728104 CEST4434972540.115.3.253192.168.2.6
            Oct 3, 2024 18:39:24.179016113 CEST49725443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:24.223400116 CEST4434972540.115.3.253192.168.2.6
            Oct 3, 2024 18:39:24.355099916 CEST4434972540.115.3.253192.168.2.6
            Oct 3, 2024 18:39:24.355176926 CEST4434972540.115.3.253192.168.2.6
            Oct 3, 2024 18:39:24.355226994 CEST49725443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:24.355545998 CEST49725443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:24.355560064 CEST4434972540.115.3.253192.168.2.6
            Oct 3, 2024 18:39:26.816023111 CEST6388753192.168.2.6162.159.36.2
            Oct 3, 2024 18:39:26.820934057 CEST5363887162.159.36.2192.168.2.6
            Oct 3, 2024 18:39:26.821115971 CEST6388753192.168.2.6162.159.36.2
            Oct 3, 2024 18:39:26.821541071 CEST6388753192.168.2.6162.159.36.2
            Oct 3, 2024 18:39:26.826495886 CEST5363887162.159.36.2192.168.2.6
            Oct 3, 2024 18:39:27.299882889 CEST5363887162.159.36.2192.168.2.6
            Oct 3, 2024 18:39:27.300867081 CEST6388753192.168.2.6162.159.36.2
            Oct 3, 2024 18:39:27.306245089 CEST5363887162.159.36.2192.168.2.6
            Oct 3, 2024 18:39:27.306312084 CEST6388753192.168.2.6162.159.36.2
            Oct 3, 2024 18:39:43.230180025 CEST63892443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:43.230206013 CEST4436389240.115.3.253192.168.2.6
            Oct 3, 2024 18:39:43.230351925 CEST63892443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:43.231029987 CEST63892443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:43.231044054 CEST4436389240.115.3.253192.168.2.6
            Oct 3, 2024 18:39:44.071608067 CEST4436389240.115.3.253192.168.2.6
            Oct 3, 2024 18:39:44.071773052 CEST63892443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:44.075542927 CEST63892443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:44.075553894 CEST4436389240.115.3.253192.168.2.6
            Oct 3, 2024 18:39:44.076307058 CEST4436389240.115.3.253192.168.2.6
            Oct 3, 2024 18:39:44.080698967 CEST63892443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:44.081202030 CEST63892443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:44.081207991 CEST4436389240.115.3.253192.168.2.6
            Oct 3, 2024 18:39:44.081480026 CEST63892443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:44.127418041 CEST4436389240.115.3.253192.168.2.6
            Oct 3, 2024 18:39:44.276590109 CEST4436389240.115.3.253192.168.2.6
            Oct 3, 2024 18:39:44.276763916 CEST4436389240.115.3.253192.168.2.6
            Oct 3, 2024 18:39:44.276957989 CEST63892443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:44.286703110 CEST63892443192.168.2.640.115.3.253
            Oct 3, 2024 18:39:44.286715984 CEST4436389240.115.3.253192.168.2.6
            Oct 3, 2024 18:40:06.731853008 CEST63894443192.168.2.6142.250.184.196
            Oct 3, 2024 18:40:06.731884003 CEST44363894142.250.184.196192.168.2.6
            Oct 3, 2024 18:40:06.731976986 CEST63894443192.168.2.6142.250.184.196
            Oct 3, 2024 18:40:06.732887030 CEST63894443192.168.2.6142.250.184.196
            Oct 3, 2024 18:40:06.732908964 CEST44363894142.250.184.196192.168.2.6
            Oct 3, 2024 18:40:07.386415958 CEST44363894142.250.184.196192.168.2.6
            Oct 3, 2024 18:40:07.402973890 CEST63894443192.168.2.6142.250.184.196
            Oct 3, 2024 18:40:07.402992964 CEST44363894142.250.184.196192.168.2.6
            Oct 3, 2024 18:40:07.404112101 CEST44363894142.250.184.196192.168.2.6
            Oct 3, 2024 18:40:07.426546097 CEST63894443192.168.2.6142.250.184.196
            Oct 3, 2024 18:40:07.426754951 CEST44363894142.250.184.196192.168.2.6
            Oct 3, 2024 18:40:07.480000019 CEST63894443192.168.2.6142.250.184.196
            Oct 3, 2024 18:40:10.472078085 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:10.472126007 CEST4436389540.115.3.253192.168.2.6
            Oct 3, 2024 18:40:10.472237110 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:10.472986937 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:10.473005056 CEST4436389540.115.3.253192.168.2.6
            Oct 3, 2024 18:40:11.428895950 CEST4436389540.115.3.253192.168.2.6
            Oct 3, 2024 18:40:11.429003954 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:11.430654049 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:11.430671930 CEST4436389540.115.3.253192.168.2.6
            Oct 3, 2024 18:40:11.430946112 CEST4436389540.115.3.253192.168.2.6
            Oct 3, 2024 18:40:11.432578087 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:11.432578087 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:11.432601929 CEST4436389540.115.3.253192.168.2.6
            Oct 3, 2024 18:40:11.432889938 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:11.475399017 CEST4436389540.115.3.253192.168.2.6
            Oct 3, 2024 18:40:11.623270988 CEST4436389540.115.3.253192.168.2.6
            Oct 3, 2024 18:40:11.623795986 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:11.623795986 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:11.623807907 CEST4436389540.115.3.253192.168.2.6
            Oct 3, 2024 18:40:11.623820066 CEST4436389540.115.3.253192.168.2.6
            Oct 3, 2024 18:40:11.623927116 CEST63895443192.168.2.640.115.3.253
            Oct 3, 2024 18:40:17.295306921 CEST44363894142.250.184.196192.168.2.6
            Oct 3, 2024 18:40:17.295511007 CEST44363894142.250.184.196192.168.2.6
            Oct 3, 2024 18:40:17.295603037 CEST63894443192.168.2.6142.250.184.196
            Oct 3, 2024 18:40:18.611746073 CEST63894443192.168.2.6142.250.184.196
            Oct 3, 2024 18:40:18.611773014 CEST44363894142.250.184.196192.168.2.6

            UDP Packets

            TimestampSource PortDest PortSource IPDest IP
            Oct 3, 2024 18:39:02.343758106 CEST53614301.1.1.1192.168.2.6
            Oct 3, 2024 18:39:02.348488092 CEST53567261.1.1.1192.168.2.6
            Oct 3, 2024 18:39:03.400897980 CEST53561051.1.1.1192.168.2.6
            Oct 3, 2024 18:39:04.107842922 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:04.857764959 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:05.619684935 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:06.472755909 CEST5309453192.168.2.61.1.1.1
            Oct 3, 2024 18:39:06.473035097 CEST6220853192.168.2.61.1.1.1
            Oct 3, 2024 18:39:06.480701923 CEST53530941.1.1.1192.168.2.6
            Oct 3, 2024 18:39:06.481930017 CEST53622081.1.1.1192.168.2.6
            Oct 3, 2024 18:39:06.574136019 CEST5450753192.168.2.68.8.8.8
            Oct 3, 2024 18:39:06.575122118 CEST5688853192.168.2.61.1.1.1
            Oct 3, 2024 18:39:06.625953913 CEST53568881.1.1.1192.168.2.6
            Oct 3, 2024 18:39:06.626995087 CEST53545078.8.8.8192.168.2.6
            Oct 3, 2024 18:39:07.614342928 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:08.369730949 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:09.123739958 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:14.923321962 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:15.682281017 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:16.432738066 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:20.526504040 CEST53562611.1.1.1192.168.2.6
            Oct 3, 2024 18:39:26.815445900 CEST5352165162.159.36.2192.168.2.6
            Oct 3, 2024 18:39:27.313493967 CEST4930253192.168.2.61.1.1.1
            Oct 3, 2024 18:39:27.321702957 CEST53493021.1.1.1192.168.2.6
            Oct 3, 2024 18:39:47.203267097 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:47.955590963 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:39:48.714612961 CEST137137192.168.2.6192.168.2.255
            Oct 3, 2024 18:40:06.721328020 CEST5553053192.168.2.61.1.1.1
            Oct 3, 2024 18:40:06.728872061 CEST53555301.1.1.1192.168.2.6

            DNS Queries

            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
            Oct 3, 2024 18:39:06.472755909 CEST192.168.2.61.1.1.10x730eStandard query (0)www.google.comA (IP address)IN (0x0001)false
            Oct 3, 2024 18:39:06.473035097 CEST192.168.2.61.1.1.10xc33eStandard query (0)www.google.com65IN (0x0001)false
            Oct 3, 2024 18:39:06.574136019 CEST192.168.2.68.8.8.80x54afStandard query (0)google.comA (IP address)IN (0x0001)false
            Oct 3, 2024 18:39:06.575122118 CEST192.168.2.61.1.1.10x393fStandard query (0)google.comA (IP address)IN (0x0001)false
            Oct 3, 2024 18:39:27.313493967 CEST192.168.2.61.1.1.10xb8baStandard query (0)241.42.69.40.in-addr.arpaPTR (Pointer record)IN (0x0001)false
            Oct 3, 2024 18:40:06.721328020 CEST192.168.2.61.1.1.10x9decStandard query (0)www.google.comA (IP address)IN (0x0001)false

            DNS Answers

            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
            Oct 3, 2024 18:39:06.480701923 CEST1.1.1.1192.168.2.60x730eNo error (0)www.google.com172.217.18.100A (IP address)IN (0x0001)false
            Oct 3, 2024 18:39:06.481930017 CEST1.1.1.1192.168.2.60xc33eNo error (0)www.google.com65IN (0x0001)false
            Oct 3, 2024 18:39:06.625953913 CEST1.1.1.1192.168.2.60x393fNo error (0)google.com216.58.206.46A (IP address)IN (0x0001)false
            Oct 3, 2024 18:39:06.626995087 CEST8.8.8.8192.168.2.60x54afNo error (0)google.com142.250.184.206A (IP address)IN (0x0001)false
            Oct 3, 2024 18:39:12.866929054 CEST1.1.1.1192.168.2.60x7f1No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
            Oct 3, 2024 18:39:12.866929054 CEST1.1.1.1192.168.2.60x7f1No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
            Oct 3, 2024 18:39:14.395279884 CEST1.1.1.1192.168.2.60x4d27No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
            Oct 3, 2024 18:39:14.395279884 CEST1.1.1.1192.168.2.60x4d27No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
            Oct 3, 2024 18:39:27.321702957 CEST1.1.1.1192.168.2.60xb8baName error (3)241.42.69.40.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false
            Oct 3, 2024 18:40:06.728872061 CEST1.1.1.1192.168.2.60x9decNo error (0)www.google.com142.250.184.196A (IP address)IN (0x0001)false

            HTTP Request Dependency Graph

            • fs.microsoft.com

            HTTPS Proxied Packets

            Session IDSource IPSource PortDestination IPDestination Port
            0192.168.2.64971140.115.3.253443
            TimestampBytes transferredDirectionData
            2024-10-03 16:39:03 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 52 66 69 57 4f 57 4e 54 43 45 57 71 50 4b 61 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 62 66 33 39 39 30 38 33 36 31 66 31 39 35 0d 0a 0d 0a
            Data Ascii: CNT 1 CON 305MS-CV: RfiWOWNTCEWqPKaM.1Context: 2ebf39908361f195
            2024-10-03 16:39:03 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
            Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
            2024-10-03 16:39:03 UTC1084OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 52 66 69 57 4f 57 4e 54 43 45 57 71 50 4b 61 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 62 66 33 39 39 30 38 33 36 31 66 31 39 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47
            Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: RfiWOWNTCEWqPKaM.2Context: 2ebf39908361f195<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
            2024-10-03 16:39:03 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 52 66 69 57 4f 57 4e 54 43 45 57 71 50 4b 61 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 62 66 33 39 39 30 38 33 36 31 66 31 39 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
            Data Ascii: BND 3 CON\WNS 0 197MS-CV: RfiWOWNTCEWqPKaM.3Context: 2ebf39908361f195<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
            2024-10-03 16:39:03 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
            Data Ascii: 202 1 CON 58
            2024-10-03 16:39:03 UTC58INData Raw: 4d 53 2d 43 56 3a 20 4c 38 57 41 62 67 36 6d 72 45 6d 6c 7a 33 45 49 2f 74 57 46 4c 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
            Data Ascii: MS-CV: L8WAbg6mrEmlz3EI/tWFLw.0Payload parsing failed.


            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            1192.168.2.649717184.28.90.27443
            TimestampBytes transferredDirectionData
            2024-10-03 16:39:08 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
            Connection: Keep-Alive
            Accept: */*
            Accept-Encoding: identity
            User-Agent: Microsoft BITS/7.8
            Host: fs.microsoft.com
            2024-10-03 16:39:08 UTC464INHTTP/1.1 200 OK
            Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
            Content-Type: application/octet-stream
            ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
            Last-Modified: Tue, 16 May 2017 22:58:00 GMT
            Server: ECAcc (lpl/EF67)
            X-CID: 11
            X-Ms-ApiVersion: Distribute 1.2
            X-Ms-Region: prod-neu-z1
            Cache-Control: public, max-age=408
            Date: Thu, 03 Oct 2024 16:39:08 GMT
            Connection: close
            X-CID: 2


            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            2192.168.2.649719184.28.90.27443
            TimestampBytes transferredDirectionData
            2024-10-03 16:39:09 UTC239OUTGET /fs/windows/config.json HTTP/1.1
            Connection: Keep-Alive
            Accept: */*
            Accept-Encoding: identity
            If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
            Range: bytes=0-2147483646
            User-Agent: Microsoft BITS/7.8
            Host: fs.microsoft.com
            2024-10-03 16:39:09 UTC514INHTTP/1.1 200 OK
            ApiVersion: Distribute 1.1
            Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
            Content-Type: application/octet-stream
            ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
            Last-Modified: Tue, 16 May 2017 22:58:00 GMT
            Server: ECAcc (lpl/EF06)
            X-CID: 11
            X-Ms-ApiVersion: Distribute 1.2
            X-Ms-Region: prod-weu-z1
            Cache-Control: public, max-age=25924
            Date: Thu, 03 Oct 2024 16:39:09 GMT
            Content-Length: 55
            Connection: close
            X-CID: 2
            2024-10-03 16:39:09 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
            Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


            Session IDSource IPSource PortDestination IPDestination Port
            3192.168.2.64972040.115.3.253443
            TimestampBytes transferredDirectionData
            2024-10-03 16:39:11 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 6f 72 64 43 4f 2f 58 78 55 79 4e 42 65 7a 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 36 63 33 35 34 38 63 61 34 31 33 34 39 38 39 0d 0a 0d 0a
            Data Ascii: CNT 1 CON 305MS-CV: GordCO/XxUyNBezJ.1Context: c6c3548ca4134989
            2024-10-03 16:39:11 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
            Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
            2024-10-03 16:39:11 UTC1084OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 47 6f 72 64 43 4f 2f 58 78 55 79 4e 42 65 7a 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 36 63 33 35 34 38 63 61 34 31 33 34 39 38 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47
            Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: GordCO/XxUyNBezJ.2Context: c6c3548ca4134989<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
            2024-10-03 16:39:11 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 47 6f 72 64 43 4f 2f 58 78 55 79 4e 42 65 7a 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 36 63 33 35 34 38 63 61 34 31 33 34 39 38 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
            Data Ascii: BND 3 CON\WNS 0 197MS-CV: GordCO/XxUyNBezJ.3Context: c6c3548ca4134989<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
            2024-10-03 16:39:11 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
            Data Ascii: 202 1 CON 58
            2024-10-03 16:39:11 UTC58INData Raw: 4d 53 2d 43 56 3a 20 59 66 31 7a 31 35 5a 79 41 45 53 6a 72 38 69 58 56 31 52 7a 44 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
            Data Ascii: MS-CV: Yf1z15ZyAESjr8iXV1RzDg.0Payload parsing failed.


            Session IDSource IPSource PortDestination IPDestination Port
            4192.168.2.64972540.115.3.253443
            TimestampBytes transferredDirectionData
            2024-10-03 16:39:24 UTC70OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 72 64 72 74 42 46 30 37 57 30 36 53 76 55 49 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 37 37 32 30 34 37 61 65 39 39 35 61 39 0d 0a 0d 0a
            Data Ascii: CNT 1 CON 304MS-CV: rdrtBF07W06SvUI5.1Context: e0772047ae995a9
            2024-10-03 16:39:24 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
            Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
            2024-10-03 16:39:24 UTC1083OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 72 64 72 74 42 46 30 37 57 30 36 53 76 55 49 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 37 37 32 30 34 37 61 65 39 39 35 61 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 59
            Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: rdrtBF07W06SvUI5.2Context: e0772047ae995a9<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9GY
            2024-10-03 16:39:24 UTC217OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 72 64 72 74 42 46 30 37 57 30 36 53 76 55 49 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 37 37 32 30 34 37 61 65 39 39 35 61 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
            Data Ascii: BND 3 CON\WNS 0 196MS-CV: rdrtBF07W06SvUI5.3Context: e0772047ae995a9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
            2024-10-03 16:39:24 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
            Data Ascii: 202 1 CON 58
            2024-10-03 16:39:24 UTC58INData Raw: 4d 53 2d 43 56 3a 20 79 76 63 64 69 77 4e 6d 4e 30 6d 38 6b 48 32 30 78 47 45 49 45 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
            Data Ascii: MS-CV: yvcdiwNmN0m8kH20xGEIEA.0Payload parsing failed.


            Session IDSource IPSource PortDestination IPDestination Port
            5192.168.2.66389240.115.3.253443
            TimestampBytes transferredDirectionData
            2024-10-03 16:39:44 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 70 57 6e 44 6c 6d 71 68 55 2b 2b 70 39 77 6f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 35 35 34 34 64 31 32 38 39 61 39 37 62 30 33 0d 0a 0d 0a
            Data Ascii: CNT 1 CON 305MS-CV: ApWnDlmqhU++p9wo.1Context: 55544d1289a97b03
            2024-10-03 16:39:44 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
            Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
            2024-10-03 16:39:44 UTC1084OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 41 70 57 6e 44 6c 6d 71 68 55 2b 2b 70 39 77 6f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 35 35 34 34 64 31 32 38 39 61 39 37 62 30 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47
            Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ApWnDlmqhU++p9wo.2Context: 55544d1289a97b03<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
            2024-10-03 16:39:44 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 41 70 57 6e 44 6c 6d 71 68 55 2b 2b 70 39 77 6f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 35 35 34 34 64 31 32 38 39 61 39 37 62 30 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
            Data Ascii: BND 3 CON\WNS 0 197MS-CV: ApWnDlmqhU++p9wo.3Context: 55544d1289a97b03<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
            2024-10-03 16:39:44 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
            Data Ascii: 202 1 CON 58
            2024-10-03 16:39:44 UTC58INData Raw: 4d 53 2d 43 56 3a 20 57 53 57 37 38 52 46 43 35 45 2b 59 36 39 5a 4c 7a 56 38 54 61 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
            Data Ascii: MS-CV: WSW78RFC5E+Y69ZLzV8TaA.0Payload parsing failed.


            Session IDSource IPSource PortDestination IPDestination Port
            6192.168.2.66389540.115.3.253443
            TimestampBytes transferredDirectionData
            2024-10-03 16:40:11 UTC71OUTData Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 6d 31 76 54 45 77 6c 38 6b 32 68 6d 4b 56 44 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 30 61 30 32 65 61 37 61 32 30 35 62 63 31 0d 0a 0d 0a
            Data Ascii: CNT 1 CON 305MS-CV: dm1vTEwl8k2hmKVD.1Context: e00a02ea7a205bc1
            2024-10-03 16:40:11 UTC249OUTData Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e
            Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
            2024-10-03 16:40:11 UTC1084OUTData Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 64 6d 31 76 54 45 77 6c 38 6b 32 68 6d 4b 56 44 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 30 61 30 32 65 61 37 61 32 30 35 62 63 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47
            Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: dm1vTEwl8k2hmKVD.2Context: e00a02ea7a205bc1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
            2024-10-03 16:40:11 UTC218OUTData Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 6d 31 76 54 45 77 6c 38 6b 32 68 6d 4b 56 44 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 30 61 30 32 65 61 37 61 32 30 35 62 63 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e
            Data Ascii: BND 3 CON\WNS 0 197MS-CV: dm1vTEwl8k2hmKVD.3Context: e00a02ea7a205bc1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
            2024-10-03 16:40:11 UTC14INData Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a
            Data Ascii: 202 1 CON 58
            2024-10-03 16:40:11 UTC58INData Raw: 4d 53 2d 43 56 3a 20 51 77 73 76 57 38 35 63 35 6b 53 30 68 4d 64 56 57 6b 37 44 59 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e
            Data Ascii: MS-CV: QwsvW85c5kS0hMdVWk7DYQ.0Payload parsing failed.


            Statistics

            CPU Usage

            Click to jump to process

            Memory Usage

            Click to jump to process

            Behavior

            Click to jump to process

            System Behavior

            General

            Target ID:0
            Start time:12:38:54
            Start date:03/10/2024
            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
            Imagebase:0x7ff684c40000
            File size:3'242'272 bytes
            MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:false

            General

            Target ID:2
            Start time:12:39:00
            Start date:03/10/2024
            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2236,i,10249122622215152608,6724685745945457616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
            Imagebase:0x7ff684c40000
            File size:3'242'272 bytes
            MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:false

            General

            Target ID:3
            Start time:12:39:03
            Start date:03/10/2024
            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://https:/u.infotracktiu.top/l"
            Imagebase:0x7ff684c40000
            File size:3'242'272 bytes
            MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            Disassembly

            ⊘No disassembly