Edit tour

Windows Analysis Report
Xeno Executor Setup 1.0.0.exe

Overview

General Information

Sample name:	Xeno Executor Setup 1.0.0.exe
Analysis ID:	1554977
MD5:	3e16cbd302cb621239608ac3caf444cf
SHA1:	9fb50388df593182080dddc0e710aca82e9a9d8d
SHA256:	b95bfdd546145dc16df5684b0f808aa993e3f0fa6ac0b9364bd95d589e34a1b7
Tags:	exeuser-likeastar20
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Multi AV Scanner detection for submitted file

Drops large PE files

Maps a DLL or memory area into another process

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Xeno Executor Setup 1.0.0.exe (PID: 6488 cmdline: "C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe" MD5: 3E16CBD302CB621239608AC3CAF444CF)

cmd.exe (PID: 6684 cmdline: cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Xeno Executor.exe" | %SYSTEMROOT%\System32\find.exe "Xeno Executor.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4228 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Xeno Executor.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 1344 cmdline: C:\Windows\System32\find.exe "Xeno Executor.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

Xeno Executor.exe (PID: 4048 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" MD5: 1D932D5598C44D2BA24C72C7F58D3F37)

cmd.exe (PID: 1712 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1880 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

Xeno Executor.exe (PID: 2132 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 1D932D5598C44D2BA24C72C7F58D3F37)

Xeno Executor.exe (PID: 5100 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2448 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 1D932D5598C44D2BA24C72C7F58D3F37)

chrome.exe (PID: 6564 cmdline: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2072,i,5952011540355768207,9689636640769716154,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7620 cmdline: "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2912 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8624 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6496 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6980 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8776 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8796 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

cmd.exe (PID: 8036 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8316 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8324 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6228 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8352 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2140 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 3408 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3520 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 3176 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7500 cmdline: taskkill /F /T /IM msedge.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7348 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7544 cmdline: taskkill /F /T /IM msedge.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7384 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7568 cmdline: taskkill /F /T /IM msedge.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7272 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6844 cmdline: taskkill /IM EpicGamesLauncher.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8584 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4192 cmdline: taskkill /IM javaw.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6736 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8776 cmdline: taskkill /IM Steam.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8900 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8944 cmdline: taskkill /F /T /IM msedge.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Xeno Executor.exe (PID: 8052 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 1D932D5598C44D2BA24C72C7F58D3F37)

cleanup

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400, CommandLine: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400, CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe, ParentProcessId: 4048, ParentProcessName: Xeno Executor.exe, ProcessCommandLine: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400, ProcessId: 6564, ProcessName: chrome.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T09:53:15.864670+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49730	TCP
2024-11-13T09:53:55.336645+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49861	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Xeno Executor Setup 1.0.0.exe

Virustotal: Detection: 8%

Perma Link

Source: Xeno Executor Setup 1.0.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c9a54b87-cac9-56e1-8f4e-d6dc8640d022

Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\LICENSE.electron.txt			Jump to behavior

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50070 version: TLS 1.2

Source: Xeno Executor Setup 1.0.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: BCC = $(NCC) -nologo -W3 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** is constructed during statement parsing and is held on Vdbe.pDblStr. source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003174826.0000000005164000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: del /Q .exp .lo .ilk .lib .obj .ncb .pdb .sdf *.suo 2>NUL source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: LTCOMPILE = $(TCC) -Fo$@ -Fd$*.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\STATEMENT.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\STATEMENT.CC source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: CLEANFILES="$CLEANFILES .lib .dll .pdb .exp" source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.41.34120\LIB\X64\LIBCMT.AMD64.PDB source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.41.34120\LIB\X64\LIBCPMT.AMD64.PDB source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\hexon\Desktop\hexon\Api\crypter\script\node_modules\sqlite3\build\Release\sqlite3.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\PROGRAM FILES\NODEJS\NODE_MODULES\NPM\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1953197036.0000000004F22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| *.dSYM ) ;; source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\BACKUP.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\BACKUP.CC source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: SQLITE3EXEPDB = /pdb:sqlite3sh.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1952283473.0000000004F2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1952283473.0000000004F2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\electron.exe.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BCC = $(NCC) -nologo -W4 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1961538346.0000000004F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /OUT:"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\HEXON\\.ELECTRON-GYP\\24.8.8\\X64\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X64 /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\NODE_SQLITE3\WIN_DELAY_LOAD_HOOK.OBJ source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) ;; source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\DATABASE.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\DATABASE.CC source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\NODE_SQLITE3.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\NODE_SQLITE3.CC source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.41.34120\LIB\X64\LIBVCRUNTIME.AMD64.PDB source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0. source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1962645888.0000000005163000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 10MB later: 27MB

Source: global traffic

TCP traffic: 192.168.2.4:49755 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 108.181.20.35 108.181.20.35
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49861

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 20.151.152.98
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=nPtt+6KKERhgrKN&MD=omBsCfMH HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=nPtt+6KKERhgrKN&MD=omBsCfMH HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: * **Google Hangouts Video**: http://www.youtube.com/watch?v=I9nDOSGfwZg equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: catbox.moe
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1085
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1452
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1512
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1637
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1936
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2046
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2152
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2273
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2894
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2978
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3027
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3045
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3246
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3682
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3729
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3997
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4214
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4267
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4646
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/482
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5469
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5577
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036dumpShaderSourceWrite
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7527
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760enableShaderSubstitutionCheck
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761Frontend
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://austingroupbugs.net/view.php?id=542
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cgit.freedesktop.org/xorg/xserver/tree/COPYING
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cldr.unicode.org/index/downloads
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/smhasher/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/v8
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1094869
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/110263
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1144207
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1165751
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1165751disableProgramBinaryDisable
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1171371
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1181068
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1181193
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/308366
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/403957
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/550292
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/565179
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/642227
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/642605
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/644669
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/650547
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/672380
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/709351
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/797243
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/809422
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/830046
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/849576
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/883276
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/927470
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/941620
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.godaddy.com/gds1-20
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16452
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://devel.freebsoft.org/speechd
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://developer.android.com/tools/extras/support-library.html
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999252444.0000000005163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eksempel.dk
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/commonnode-set..
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedorahosted.org/lohit>
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://flex.sourceforge.net/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedesktop.org
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59788
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.github.io/snappy/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://icl.com/saxon
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003174826.0000000005164000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://int3.de/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcode>
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mxr.mozilla.org/comm-central/source/mozilla/netwerk/base/src/nsURLParsers.cpp
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://nfs.sourceforge.net/#faq_a8
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.godaddy.com/0J
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s..
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFL
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://source.android.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://source.android.com/compatibility)
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sqlite.org/cli.html#sqlar_archive_support
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sqlite.org/lockingv3.html
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1949151315.00000000073F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/xz/COPYING
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tukaani.org/xz/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://valgrind.org
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://webkit.org/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wpad/wpad.dat
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wpad/wpad.dat..
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1949151315.00000000073F0000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chromium.org
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fossil-scm.org/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/gethelp/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/licenses/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/s/libtool/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/software
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/software/coreutils/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jclark.com/xt
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/MPL/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nabble.com/SQLite-on-NFS-cache-coherency-td15655701.html
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nongnu.org/freebangfont/downloads.html#mukti
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.perl.org/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ploscompbiol.org/static/license
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org)
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/cli.html
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/compile.html).
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/src/info/6709574d2a
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.strongtalk.org/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com/tools/smslib.html
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com/tools/smslib.html>
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.webrtc.org
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zlib.net/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://android-review.googlesource.com/#/c/115351/3/dist/sqlite3.c)
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://android.com/pay
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4674
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4849
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5140
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5536
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7405
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/3rpDuEX.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/3rpDuEX.WebBundleURLLoaderFactory::OnResponseParsedInvalid
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/audio-worklet)
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/audio-worklet)ScriptProcessorHandler::ProcessScriptProcessorHandler::Process
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.htmlMixed
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1072773
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=695438).
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.android.clients.google.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.bigcache.googleapis.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.doc-0-0-sj.sj.googleusercontent.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.docs.google.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.drive.google.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.googlesyndication.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.pack.google.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.play.google.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.youtube.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2000317521.0000000005163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=id&category=theme81https://myactivity.google.com/myactivity/?u
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2001324131.0000000005163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ru&category=theme81https://myactivity.google.com/myactivity/?u
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2002241069.0000000005163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromestatus.com/feature/5105856067141632.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1038223.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1042393
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1046462
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1060012
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1091824
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1137851
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908.The
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908Changing
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1154140
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1300575
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1356053
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1393662).
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1412729
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/593024
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/619103.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/619103.Subsequence
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/650547
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/655534
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/705865
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/710443
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/811661
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/848952
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/927119
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/927119..
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/981419
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dejavu-fonts.github.io/Download.html
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/blog/enabling-shared-array-buffer/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/blog/immutable-document-domain/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/SpiderMonkey/Parser_API
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/android/guides/setup
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999252444.0000000005163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eksempel.dk.Brug
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://example.org
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://example.orgExpired
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://feross.org
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gcp.gvt2.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gcp.gvt6.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Cyan4973/xxHash
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Cross
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.border-boxcontent-bo
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/shared-element-transitions/blob/main/debugging_overflow_on_images.md.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aawc/unrar.git
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/acornjs/acorn/issues/575
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/andyperlitch/jsbn.git
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-styles?sponsor=1
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/estree/estree/blob/a27003adf4fd7bfad44de9cef372a2eacd527b1c/es5.md#regexpliteral
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/feross/buffer/issues/154
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/feross/buffer/pull/148
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/distributed_point_functions
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/ruy
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/ukey2
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/woff2
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/xnnpack
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mathiasbynens/emoji-regex.git
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-addon-api
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-addon-api/issues
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/27791
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/sindresorhus
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/models
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tensorflow
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/text.git
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tflite-support
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.WindowPostMessageOptionstargetOriginhgMH
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/wasdk/wasmparser
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/web-animations/web-animations-js
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.freedesktop.org/wayland/weston
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.freedesktop.org/xdg/xdgmime
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/4NeimX
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/7K7WLu
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/7K7WLuThe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/7K7WLuWebAudio.AutoplayWebAudio.Autoplay.CrossOriginWebAudio.Autoplay.UnlockType..
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/EuHzyv
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/HxfxSQ
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/J6ASzs
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/LdLk22
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/LdLk22Media
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/rStTGz
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/xX8pDD
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/xX8pDDplay()
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/ximf56
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/ximf56Iframe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gle/chrome-insecure-origins
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-analytics.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google.com/pay
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google.com/payhttps://android.com/paysecure-payment-confirmationAppStoreBillingPlaceHolderZZ
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://googlevideo.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gvt1.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gvt2.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gvt6.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequentlyOut
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jimmy.warting.se/opensource
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/emoji
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/emoji-regex
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0-headers.tar.gz
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gz
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gzhttps://nodejs.org/download/release
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/win-x64/node.lib
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/en/docs/inspector
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/en/docs/inspectorFor
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.ico
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://openjsf.org/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pagure.io/lohit
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/billing
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/billingQuota
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sindresorhus.com
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sindresorhus.com)
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/src/info/4e8e4857d32d401f
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/src/info/ff5be73dee
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/src/tktview/c52b09c7f38903b1311cec40.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2002034703.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999009904.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999592783.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2001784526.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2000483986.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2000123721.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2001613175.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999803448.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2002365980.0000000005163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2002034703.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999386559.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999009904.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999592783.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2001784526.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2000483986.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2000123721.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2001613175.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999803448.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2002365980.0000000005163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webrtc.googlesource.com/src/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/characteristics
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/descriptors
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/services
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/4664843055398912
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5093566007214080
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5636954674692096
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312InputDeviceCapabilities
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Alternative
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Atom
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClass
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlLetter
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalDigits
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Disjunction
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigit
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexEscapeSequence
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-OctalDigit
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-PatternCharacter
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Quantifier
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-QuantifierPrefix
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-RegExpUnicodeEscapeSequence
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-SyntaxCharacter
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-AtomEscape
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-CharacterEscape
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassEscape
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedPatternCharacter
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-IdentityEscape
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-InvalidBracedQuantifier
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-LegacyOctalEscapeSequence
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Term
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-term
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gnu.org/licenses/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/src/info/083f9e6270).
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/src/info/343634942dd54ab
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/src/info/7fa8049685b50b5a
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/src/info/908f001483982c43
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/src/info/bba7b69f9849b5bf
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.swift.org/download/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.unicode.org/copyright.html.
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50070 version: TLS 1.2

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Code function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405461

Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVE

memstr_2c00cec8-0

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File dump: Xeno Executor.exe.0.dr 162117120			Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File dump: Xeno Executor.exe0.0.dr 162117120			Jump to dropped file

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040338F

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Code function: 0_2_00406B15	0_2_00406B15
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Code function: 0_2_004072EC	0_2_004072EC
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Code function: 0_2_00404C9E	0_2_00404C9E

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Process token adjusted: Security

Jump to behavior

Source: vulkan-1.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: libEGL.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: Xeno Executor.exe.0.dr	Static PE information: Number of sections : 15 > 10
Source: vk_swiftshader.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libEGL.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: Xeno Executor.exe0.0.dr	Static PE information: Number of sections : 15 > 10

Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs Xeno Executor Setup 1.0.0.exe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs Xeno Executor Setup 1.0.0.exe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1961538346.0000000004F2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs Xeno Executor Setup 1.0.0.exe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1952283473.0000000004F2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs Xeno Executor Setup 1.0.0.exe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1956831384.0000000004F2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs Xeno Executor Setup 1.0.0.exe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003174826.0000000005164000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameElevate.exeH vs Xeno Executor Setup 1.0.0.exe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1964101442.000000000522F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename< vs Xeno Executor Setup 1.0.0.exe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948879307.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename< vs Xeno Executor Setup 1.0.0.exe
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1875401477.0000000006996000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs Xeno Executor Setup 1.0.0.exe

Source: Xeno Executor Setup 1.0.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.troj.spyw.evad.winEXE@119/372@25/14

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

0_2_0040338F

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Code function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404722

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5292:120:WilError_03
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7108:120:WilError_03
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Mutant created: \Sessions\1\BaseNamedObjects\c9a54b87-cac9-56e1-8f4e-d6dc8640d022
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7380:120:WilError_03

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

File created: C:\Users\user\AppData\Local\Temp\nsl5305.tmp

Jump to behavior

Source: Xeno Executor Setup 1.0.0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XENO EXECUTOR.EXE'
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Steam.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "EpicGamesLauncher.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "javaw.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Steam.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: SELECT name FROM sqlite_master WHERE type='table';

Source: Xeno Executor Setup 1.0.0.exe

Virustotal: Detection: 8%

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

File read: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe "C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe"
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Xeno Executor.exe" \| %SYSTEMROOT%\System32\find.exe "Xeno Executor.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Xeno Executor.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "Xeno Executor.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2448 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2072,i,5952011540355768207,9689636640769716154,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2912 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6496 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6980 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Xeno Executor.exe" \| %SYSTEMROOT%\System32\find.exe "Xeno Executor.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Xeno Executor.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "Xeno Executor.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2448 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2072,i,5952011540355768207,9689636640769716154,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2912 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6496 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6980 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: d3d12core.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: dxilconv.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: d3dscache.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Section loaded: twinapi.appcore.dll

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Xeno Executor.exe"

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\c9a54b87-cac9-56e1-8f4e-d6dc8640d022

Jump to behavior

Source: Xeno Executor Setup 1.0.0.exe

Static file information: File size 86060027 > 1048576

Source: Xeno Executor Setup 1.0.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: BCC = $(NCC) -nologo -W3 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** is constructed during statement parsing and is held on Vdbe.pDblStr. source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003174826.0000000005164000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: del /Q .exp .lo .ilk .lib .obj .ncb .pdb .sdf *.suo 2>NUL source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: LTCOMPILE = $(TCC) -Fo$@ -Fd$*.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\STATEMENT.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\STATEMENT.CC source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: CLEANFILES="$CLEANFILES .lib .dll .pdb .exp" source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.41.34120\LIB\X64\LIBCMT.AMD64.PDB source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.41.34120\LIB\X64\LIBCPMT.AMD64.PDB source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\hexon\Desktop\hexon\Api\crypter\script\node_modules\sqlite3\build\Release\sqlite3.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\PROGRAM FILES\NODEJS\NODE_MODULES\NPM\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1953197036.0000000004F22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| *.dSYM ) ;; source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\BACKUP.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\BACKUP.CC source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: SQLITE3EXEPDB = /pdb:sqlite3sh.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0, then it is assumed to already be present on the source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1952283473.0000000004F2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1952283473.0000000004F2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\electron.exe.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BCC = $(NCC) -nologo -W4 -Fd$*.pdb $(CCOPTS) $(BCCOPTS) source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1961538346.0000000004F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /OUT:"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\HEXON\\.ELECTRON-GYP\\24.8.8\\X64\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\NODE_SQLITE3.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X64 /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\NODE_SQLITE3\WIN_DELAY_LOAD_HOOK.OBJ source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) ;; source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\DATABASE.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\DATABASE.CC source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\INCLUDE\NODE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\SRC" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\CONFIG" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\UV\INCLUDE" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\ZLIB" /I"C:\USERS\HEXON\.ELECTRON-GYP\24.8.8\DEPS\V8\INCLUDE" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\NODE_MODULES\NODE-ADDON-API" /I"C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\BUILD\RELEASE\OBJ\GLOBAL_INTERMEDIATE\SQLITE-AUTOCONF-3320300" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=node_sqlite3 /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D ELECTRON_ENSURE_CONFIG_GYPI /D USING_ELECTRON_CONFIG_GYPI /D V8_COMPRESS_POINTERS /D V8_COMPRESS_POINTERS_IN_SHARED_CAGE /D V8_ENABLE_SANDBOX /D V8_31BIT_SMIS_ON_64BIT_ARCH /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D OPENSSL_NO_ASM /D NAPI_VERSION=6 /D NAPI_DISABLE_CPP_EXCEPTIONS=1 /D SQLITE_THREADSAFE=1 /D HAVE_USLEEP=1 /D SQLITE_ENABLE_FTS3 /D SQLITE_ENABLE_FTS4 /D SQLITE_ENABLE_FTS5 /D SQLITE_ENABLE_JSON1 /D SQLITE_ENABLE_RTREE /D SQLITE_ENABLE_DBSTAT_VTAB=1 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D NDEBUG /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\NODE_SQLITE3\\SRC\NODE_SQLITE3.OBJ" /Fd"RELEASE\OBJ\NODE_SQLITE3\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /FC /Zc:__cplusplus -std:c++17 C:\USERS\HEXON\DESKTOP\HEXON\API\CRYPTER\SCRIPT\NODE_MODULES\SQLITE3\SRC\NODE_SQLITE3.CC source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** for all file descriptors with rbu_file.pDb!=0. If the argument has source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.41.34120\LIB\X64\LIBVCRUNTIME.AMD64.PDB source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ** rbu_file.pDb!=0. source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869878410.0000000006830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1962645888.0000000005163000.00000004.00000020.00020000.00000000.sdmp

Source: ffmpeg.dll.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: Xeno Executor.exe.0.dr	Static PE information: section name: .00cfg
Source: Xeno Executor.exe.0.dr	Static PE information: section name: .gxfg
Source: Xeno Executor.exe.0.dr	Static PE information: section name: .retplne
Source: Xeno Executor.exe.0.dr	Static PE information: section name: .rodata
Source: Xeno Executor.exe.0.dr	Static PE information: section name: CPADinfo
Source: Xeno Executor.exe.0.dr	Static PE information: section name: LZMADEC
Source: Xeno Executor.exe.0.dr	Static PE information: section name: _RDATA
Source: Xeno Executor.exe.0.dr	Static PE information: section name: malloc_h
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll0.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll0.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll0.0.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll0.0.dr	Static PE information: section name: _RDATA
Source: Xeno Executor.exe0.0.dr	Static PE information: section name: .00cfg
Source: Xeno Executor.exe0.0.dr	Static PE information: section name: .gxfg
Source: Xeno Executor.exe0.0.dr	Static PE information: section name: .retplne
Source: Xeno Executor.exe0.0.dr	Static PE information: section name: .rodata
Source: Xeno Executor.exe0.0.dr	Static PE information: section name: CPADinfo
Source: Xeno Executor.exe0.0.dr	Static PE information: section name: LZMADEC
Source: Xeno Executor.exe0.0.dr	Static PE information: section name: _RDATA
Source: Xeno Executor.exe0.0.dr	Static PE information: section name: malloc_h
Source: 5999447d-fc8e-40d7-b3ca-dfeca4eb669f.tmp.node.9.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\Xeno Executor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File created: C:\Users\user\AppData\Local\Temp\5999447d-fc8e-40d7-b3ca-dfeca4eb669f.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File created: C:\Users\user\AppData\Local\Temp\529dddfe-00fe-4c4f-bbf8-cbcfe5f3d926.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\SpiderBanner.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File created: C:\Users\user\AppData\Local\Temp\5999447d-fc8e-40d7-b3ca-dfeca4eb669f.tmp.node			Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File created: C:\Users\user\AppData\Local\Temp\529dddfe-00fe-4c4f-bbf8-cbcfe5f3d926.tmp.node			Jump to dropped file

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\LICENSE.electron.txt			Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xeno Executor.lnk

Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5999447d-fc8e-40d7-b3ca-dfeca4eb669f.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\529dddfe-00fe-4c4f-bbf8-cbcfe5f3d926.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\SpiderBanner.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File Volume queried: C:\Users\user\AppData\Local\Programs\unrealgame FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File Volume queried: C:\Users\user\AppData\Local\Programs\unrealgame FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File Volume queried: C:\Users\user FullSizeInformation

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior

Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1961035721.000000000615A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$/
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1961087150.0000000006156000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}L
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1961087150.0000000006156000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1961087150.0000000006156000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestX
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1953197036.0000000004F22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: (IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliT8xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliG31OrOlder(functions))
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1953197036.0000000004F22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Screen Codec / VMware Video

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

API call chain: ExitProcess graph end node

graph_0-3407

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Xeno Executor.exe" \| %SYSTEMROOT%\System32\find.exe "Xeno Executor.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Xeno Executor.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "Xeno Executor.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2448 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM msedge.exe

Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "c:\users\user\appdata\local\programs\unrealgame\xeno executor.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1884 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "c:\users\user\appdata\local\programs\unrealgame\xeno executor.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --mojo-platform-channel-handle=2448 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "c:\users\user\appdata\local\programs\unrealgame\xeno executor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "c:\users\user\appdata\local\programs\unrealgame\xeno executor.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1884 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "c:\users\user\appdata\local\programs\unrealgame\xeno executor.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --mojo-platform-channel-handle=2448 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe "c:\users\user\appdata\local\programs\unrealgame\xeno executor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2	Jump to behavior

Source: Xeno Executor.exe, 00000009.00000000.2035153140.00007FF60BE9A000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
Source: Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ..\..\third_party\webrtc\modules\desktop_capture\win\window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progman..\..\third_party\webrtc\modules\desktop_capture\cropping_window_capturer.ccWindow no longer on top when ScreenCapturer finishesScreenCapturer failed to capture a frameWindow rect is emptyWindow is outside of the captured displaySysShadowWebRTC.DesktopCapture.Win.WindowGdiCapturerFrameTimeWindowCapturerWinGdi::CaptureFrame..\..\third_party\webrtc\modules\desktop_capture\win\window_capturer_win_gdi.ccWindow hasn't been selected: Target window has been closed.Failed to get drawable window area: Failed to get window DC: Failed to create frame.Both PrintWindow() and BitBlt() failed.Capturing owned window failed (previous error/warning pertained to that)WebRTC.DesktopCapture.BlankFrameDetectedWebRTC.DesktopCapture.PrimaryCapturerSelectSourceErrorWebRTC.DesktopCapture.PrimaryCapturerErrorWebRTC.DesktopCapture.PrimaryCapturerPermanentErrordwmapi.dllDwmEnableCompositionScreenCapturerWinGdi::CaptureFrame..\..\third_party\webrtc\modules\desktop_capture\win\screen_capturer_win_gdi.ccFailed to capture screen by GDI.WebRTC.DesktopCapture.Win.ScreenGdiCapturerFrameTimedesktop_dc_memory_dc_Failed to get screen rect.Failed to create frame buffer.Failed to select current bitmap into memery dc.BitBlt failed..\..\third_party\webrtc\modules\desktop_capture\win\screen_capturer_win_magnifier.ccMagnifier initialization failed.Magnifier capturer failed to capture a frame.WebRTC.DesktopCapture.Win.MagnifierCapturerFrameTimeCaptureImageFailed to call SetWindowPos: . Rect = {Failed to call MagSetWindowSource: InitializeMagnifierMagnifier capturer cannot work on multi-screen system.Magnification.dllMagInitializeMagUninitializeMagSetWindowSourceMagSetWindowFilterListMagSetImageScalingCallbackFailed to initialize ScreenCapturerWinMagnifier: library functions missing.Failed to initialize ScreenCapturerWinMagnifier: error from MagInitialize Failed to initialize ScreenCapturerWinMagnifier: error from GetModulehandleExA Failed to initialize ScreenCapturerWinMagnifier: error from creating host window Failed to initialize ScreenCapturerWinMagnifier: error from creating magnifier window Failed to initialize ScreenCapturerWinMagnifier: error from MagSetImageScalingCallback Failed to initialize ScreenCapturerWinMagnifier: error from MagSetWindowFilterList OnCapturedOutput format does not match the captured format: width = , height = , stride = , bpp = , pixel format RGBA ? ..\..\third_party\webrtc\modules\desktop_capture\win\cursor.ccCreateMouseCursorFromHCursorUnable to get cursor icon info. Error = Unable to get bitmap info. Error = Unable to get bitmap bits. Error = `

Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\si8q5befaws3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\si8q5befaws3\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\si8q5befaws3\Passwords VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\si8q5befaws3\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\si8q5befaws3\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\si8q5befaws3\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\si8q5befaws3.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Program Files\Google\Chrome\Application\chrome.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\hyphen-data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MEIPreload VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\RecoveryImproved VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\AppData\Roaming\All_Wallets.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\Downloads VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Users\user\Documents VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe

0_2_0040338F

Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	13 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Extra Window Memory Injection	1 DLL Side-Loading	11 Input Capture	36 System Information Discovery	Remote Desktop Protocol	11 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Extra Window Memory Injection	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	11 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	11 Masquerading	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	112 Process Injection	1 Virtualization/Sandbox Evasion	LSA Secrets	3 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	112 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Xeno Executor Setup 1.0.0.exe	9%	Virustotal		Browse
Xeno Executor Setup 1.0.0.exe	5%	ReversingLabs	Win32.Malware.Malicord

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\529dddfe-00fe-4c4f-bbf8-cbcfe5f3d926.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5999447d-fc8e-40d7-b3ca-dfeca4eb669f.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\Xeno Executor.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\SpiderBanner.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\nsis7z.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.sqlite.org)	0%	Avira URL Cloud	safe
https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess	0%	Avira URL Cloud	safe
https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
catbox.moe	108.181.20.35	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
sb.scorecardresearch.com	18.244.18.122	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	216.58.206.68	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.97	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.sqlite.org)	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/answer/6098869	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2002034703.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999386559.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999009904.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999592783.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2001784526.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2000483986.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2000123721.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2001613175.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1999803448.0000000005163000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2002365980.0000000005163000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bluetooth.com/specifications/gatt/services	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/mathiasbynens/emoji-regex.git	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-Atom	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.gnu.org/software/coreutils/	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.chromestatus.com/feature/5093566007214080	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://goo.gl/7K7WLuThe	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://crbug.com/1356053	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://goo.gl/7K7WLu	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crbug.com/110263	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://openjsf.org/	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromium.googlesource.com/chromium/src/	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://sqlite.org/lockingv3.html	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bit.ly/3rpDuEX.	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://crbug.com/593024	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://w3c.github.io/manifest/#installability-signals	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://exslt.org/common	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/models	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://c.docs.google.com/	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/KhronosGroup/SPIRV-Headers.git	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.sqlite.org/src/info/908f001483982c43	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://crbug.com/1300575	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.nongnu.org/freebangfont/downloads.html#mukti	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://crbug.com/710443	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/tflite-support	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sqlite.org/	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=id&category=theme81https://myactivity.google.com/myactivity/?u	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2000317521.0000000005163000.00000004.00000020.00020000.00000000.sdmp	false		high
https://crbug.com/1060012	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://sqlite.org/src/tktview/c52b09c7f38903b1311cec40.	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1869461779.0000000005A20000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/3997	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crbug.com/642605	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/1452	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://crbug.com/650547callClearTwiceUsing	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://gitlab.freedesktop.org/xdg/xdgmime	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://beacons.gcp.gvt2.com/domainreliability/upload	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/2894	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.gnu.org/gethelp/	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/wasdk/wasmparser	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/3970	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dejavu-fonts.github.io/Download.html	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pagure.io/lohit	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gz	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005C20000.00000004.00001000.00020000.00000000.sdmp	false		high
http://.jpg	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.sqlite.org	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	false		high
https://android.com/pay	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/5901	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=695438).	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nodejs.org/en/docs/inspectorFor	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/.	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948318231.0000000005EA2000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/3965	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59788	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	false		high
https://anglebug.com/7161	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/web-animations/web-animations-js	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.chromestatus.com/feature/6662647093133312	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcode>	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1958362229.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anglebug.com/7162	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.gnu.org/licenses/	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/3729	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://sindresorhus.com	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1868903001.0000000005271000.00000004.00001000.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/5906	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crbug.com/830046	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/2517	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/4937	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://crbug.com/1144908	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1948596626.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/166809097	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/feross/buffer/issues/154	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.2003001076.0000000005224000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1870122899.0000000006C30000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crbug.com/672380	Xeno Executor Setup 1.0.0.exe, 00000000.00000003.1882276879.0000000006970000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
108.181.20.35	catbox.moe	Canada	852	ASN852CA	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.114.95	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.151.152.98	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
4.150.155.223	unknown	United States	3356	LEVEL3US	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554977
Start date and time:	2024-11-13 09:51:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	61
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Xeno Executor Setup 1.0.0.exe
Detection:	MAL
Classification:	mal68.troj.spyw.evad.winEXE@119/372@25/14
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 41 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.131, 192.229.221.95, 216.58.212.131, 64.233.167.84, 142.250.186.46, 34.104.35.123, 13.107.42.16, 204.79.197.239, 13.107.21.239, 142.250.185.142, 13.107.6.158, 204.79.197.203, 2.19.126.152, 2.19.126.145, 20.93.72.182, 88.221.110.195, 88.221.110.179, 2.23.209.188, 2.23.209.189, 2.23.209.193, 2.23.209.186, 2.23.209.130, 2.23.209.133, 2.23.209.137, 2.23.209.192, 2.23.209.136, 23.38.98.108, 23.38.98.106, 23.38.98.100, 23.38.98.95, 23.38.98.107, 23.38.98.104, 23.38.98.97, 23.38.98.99, 23.38.98.98, 2.23.209.150, 2.23.209.153, 2.23.209.158, 2.23.209.149, 2.23.209.154, 2.23.209.142, 2.23.209.144, 2.23.209.143, 2.23.209.156, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.19.126.151, 2.19.126.157, 172.205.80.42, 142.250.113.94, 142.250.115.94, 142.250.114.94
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, prod-agic-ne-8.northeurope.cloudapp.azure.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanage
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	new.bat	Get hash	malicious	Unknown	Browse
	pdfguruhub.msi	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	specifications and technical requirements.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://t.ly/SjDNX	Get hash	malicious	Python Stealer, Braodo	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse
	https://t.ly/D5x5U	Get hash	malicious	Braodo	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
108.181.20.35	Document.pdf.lnk	Get hash	malicious	Unknown	Browse	files.catbox.moe/p1yr9i.pdf
108.181.20.35	SecuriteInfo.com.HEUR.Trojan.OLE2.Agent.gen.26943.12401.msi	Get hash	malicious	LummaC Stealer	Browse	files.catbox.moe/nzct1p
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sb.scorecardresearch.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.72
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.72
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	18.245.60.53
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.32
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
catbox.moe	file.exe	Get hash	malicious	FormBook	Browse	108.181.20.35
	file.exe	Get hash	malicious	FormBook	Browse	108.181.20.35
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	108.181.20.35
	1.cmd	Get hash	malicious	Unknown	Browse	108.181.20.35
	Exploit Detector.bat	Get hash	malicious	Unknown	Browse	108.181.20.35
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	108.181.20.35
	SCV.cmd	Get hash	malicious	Unknown	Browse	108.181.20.35
	SCV.cmd	Get hash	malicious	Unknown	Browse	108.181.20.35
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	108.181.20.39

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DNnGv_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA92MMGG0eeFCZzQMnosAWydLTI7R4yQPl90fJpGVjewvRcCF77tY5-2B3PAHwq6SU-2Fc2kSK8E1mMumIEdp0dsw2BfptVK6-2FXO4Hh-2FAV8-2FJ5YFUs6qp3oyRx3LiWrBnDVYrVE-3D	Get hash	malicious	Unknown	Browse	13.107.137.11
	http://t.nypost.com/1/e/r?aqet=clk&r=2&ca=26510028&v0=aftua%40gmail.com&ru=//www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%SERIAL%25wDnNeW8yycT&sa=t&esrc=nNeW8F%SERIAL%25A0xys8Em2FL&source=&cd=tS6T8%SERIAL%25Tiw9XH&cad=XpPkDfJX%SERIAL%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%62%79%64%61%2E%6E%67%2F%63%69%67%2E%62%69%6E%2F%67%67%6C%6E%46%78%50%51%30%47%76%38%64%43%45%35%45%43%61%37%66%37%78%63%58%71%32%79%74%4D%57%65%54%6E%31%37%53%74%68%66%4C%56%74%52%44%70%4E%58%36%63%6B%42%66%50%7A%42%38%6B%51%52%36%38%64%67%53%64%31%4C%6C%73%33%71%37%76%6E%79%6E%48%6D%75%41%73%31%2F%23Y2hyaXN0b3BoZXIuZG9sYW5AdmlyZ2lubW9uZXkuY29t	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fportal.eftsure.com.au%2finvite%2f%7b5943C803%2d027A%2d43C9%2dBBBB%2dDE0322D1F961%7d&umid=92db6cfc-6cf7-46fe-8f32-20799b471c27&auth=3a5566c60b1f4d8525fa8ab109f94675a663eb25-8cbc03c09e9a72f57497c9be7e9f6ecc1a7de37e	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://newsletter.beyondkey.net/l/b7m9dXlumpLnfYVtr2FDJA/n5lHXXJe9HZ3IfhaVldmnw/G050vNJkt892QtBQ0L0RNk8w	Get hash	malicious	Unknown	Browse	20.51.210.249
	https://qacvconsulting.aha.io/shared/9d080aba3b5bbe9dd55708b4063b235a	Get hash	malicious	Unknown	Browse	13.107.246.45
	yakuza.arm5.elf	Get hash	malicious	Unknown	Browse	65.55.115.26
	yakuza.i586.elf	Get hash	malicious	Unknown	Browse	20.159.40.115
	meerkat.ppc.elf	Get hash	malicious	Mirai	Browse	170.165.135.40
	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	20.51.67.246
CLOUDFLARENETUS	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DNnGv_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA92MMGG0eeFCZzQMnosAWydLTI7R4yQPl90fJpGVjewvRcCF77tY5-2B3PAHwq6SU-2Fc2kSK8E1mMumIEdp0dsw2BfptVK6-2FXO4Hh-2FAV8-2FJ5YFUs6qp3oyRx3LiWrBnDVYrVE-3D	Get hash	malicious	Unknown	Browse	188.114.97.3
	rGO880-PDF.exe	Get hash	malicious	FormBook	Browse	172.67.181.11
	PO AT-5228.exe	Get hash	malicious	FormBook	Browse	104.21.14.183
	Loader.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	http://t.nypost.com/1/e/r?aqet=clk&r=2&ca=26510028&v0=aftua%40gmail.com&ru=//www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%SERIAL%25wDnNeW8yycT&sa=t&esrc=nNeW8F%SERIAL%25A0xys8Em2FL&source=&cd=tS6T8%SERIAL%25Tiw9XH&cad=XpPkDfJX%SERIAL%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%62%79%64%61%2E%6E%67%2F%63%69%67%2E%62%69%6E%2F%67%67%6C%6E%46%78%50%51%30%47%76%38%64%43%45%35%45%43%61%37%66%37%78%63%58%71%32%79%74%4D%57%65%54%6E%31%37%53%74%68%66%4C%56%74%52%44%70%4E%58%36%63%6B%42%66%50%7A%42%38%6B%51%52%36%38%64%67%53%64%31%4C%6C%73%33%71%37%76%6E%79%6E%48%6D%75%41%73%31%2F%23Y2hyaXN0b3BoZXIuZG9sYW5AdmlyZ2lubW9uZXkuY29t	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	setup7.0.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	blhbZrtqbLg6O1K.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Updatev4_5.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	Payment Copy.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
ASN852CA	meerkat.spc.elf	Get hash	malicious	Mirai	Browse	207.102.160.232
	meerkat.sh4.elf	Get hash	malicious	Mirai	Browse	142.61.68.229
	mtv21xElsr.exe	Get hash	malicious	GhostRat, Nitol	Browse	108.181.157.69
	svhost.exe	Get hash	malicious	GhostRat, Nitol	Browse	108.181.157.69
	amen.arm.elf	Get hash	malicious	Unknown	Browse	216.226.40.246
	amen.ppc.elf	Get hash	malicious	Mirai	Browse	198.168.109.104
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	96.1.104.28
	file.exe	Get hash	malicious	FormBook	Browse	108.181.20.35
	file.exe	Get hash	malicious	FormBook	Browse	108.181.20.35
CLOUDFLARENETUS	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DNnGv_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA92MMGG0eeFCZzQMnosAWydLTI7R4yQPl90fJpGVjewvRcCF77tY5-2B3PAHwq6SU-2Fc2kSK8E1mMumIEdp0dsw2BfptVK6-2FXO4Hh-2FAV8-2FJ5YFUs6qp3oyRx3LiWrBnDVYrVE-3D	Get hash	malicious	Unknown	Browse	188.114.97.3
	rGO880-PDF.exe	Get hash	malicious	FormBook	Browse	172.67.181.11
	PO AT-5228.exe	Get hash	malicious	FormBook	Browse	104.21.14.183
	Loader.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	http://t.nypost.com/1/e/r?aqet=clk&r=2&ca=26510028&v0=aftua%40gmail.com&ru=//www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%SERIAL%25wDnNeW8yycT&sa=t&esrc=nNeW8F%SERIAL%25A0xys8Em2FL&source=&cd=tS6T8%SERIAL%25Tiw9XH&cad=XpPkDfJX%SERIAL%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%62%79%64%61%2E%6E%67%2F%63%69%67%2E%62%69%6E%2F%67%67%6C%6E%46%78%50%51%30%47%76%38%64%43%45%35%45%43%61%37%66%37%78%63%58%71%32%79%74%4D%57%65%54%6E%31%37%53%74%68%66%4C%56%74%52%44%70%4E%58%36%63%6B%42%66%50%7A%42%38%6B%51%52%36%38%64%67%53%64%31%4C%6C%73%33%71%37%76%6E%79%6E%48%6D%75%41%73%31%2F%23Y2hyaXN0b3BoZXIuZG9sYW5AdmlyZ2lubW9uZXkuY29t	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	setup7.0.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	blhbZrtqbLg6O1K.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Updatev4_5.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	Payment Copy.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DNnGv_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA92MMGG0eeFCZzQMnosAWydLTI7R4yQPl90fJpGVjewvRcCF77tY5-2B3PAHwq6SU-2Fc2kSK8E1mMumIEdp0dsw2BfptVK6-2FXO4Hh-2FAV8-2FJ5YFUs6qp3oyRx3LiWrBnDVYrVE-3D	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 40.126.32.74 13.107.246.45 173.222.162.32
	http://t.nypost.com/1/e/r?aqet=clk&r=2&ca=26510028&v0=aftua%40gmail.com&ru=//www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%SERIAL%25wDnNeW8yycT&sa=t&esrc=nNeW8F%SERIAL%25A0xys8Em2FL&source=&cd=tS6T8%SERIAL%25Tiw9XH&cad=XpPkDfJX%SERIAL%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%62%79%64%61%2E%6E%67%2F%63%69%67%2E%62%69%6E%2F%67%67%6C%6E%46%78%50%51%30%47%76%38%64%43%45%35%45%43%61%37%66%37%78%63%58%71%32%79%74%4D%57%65%54%6E%31%37%53%74%68%66%4C%56%74%52%44%70%4E%58%36%63%6B%42%66%50%7A%42%38%6B%51%52%36%38%64%67%53%64%31%4C%6C%73%33%71%37%76%6E%79%6E%48%6D%75%41%73%31%2F%23Y2hyaXN0b3BoZXIuZG9sYW5AdmlyZ2lubW9uZXkuY29t	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.202.163.200 184.28.90.27 40.126.32.74 13.107.246.45 173.222.162.32
	Rapport.html	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 40.126.32.74 13.107.246.45 173.222.162.32
	https://eu-central-1.protection.sophos.com/?d=xxxlgroup.com&u=aHR0cHM6Ly9zZXJ2aWNlcy5pc3QueHh4bGdyb3VwLmNvbS9QYXltZW50U2VydmljZS8xNy8wWi8wMDAxYzk5YzBhYzVjMGUzMDAwMDNmMzgwMDAwODkxODE0Nzk3NWMy&i=NWM0YWFhZTFlYmMxMjgxMzI2Mzk1MmZj&t=UjJrRmV2QXpnYUF0RUsvV3haZ0lQMllKYVZRbjFESmtncHdLSjlTVGFWST0=&h=30d9cb4dc2a54dd59052f7a4a0edde4a&s=AVNPUEhUT0NFTkNSWVBUSVYENbLvm6o_1YsgOojZ1VDNrB0gxZ-tcqRfXFH68hrgRw	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 40.126.32.74 13.107.246.45 173.222.162.32
	https://eu-central-1.protection.sophos.com/?d=xxxlgroup.com&u=aHR0cHM6Ly9zZXJ2aWNlcy5pc3QueHh4bGdyb3VwLmNvbS9QYXltZW50U2VydmljZS8xNy8wWi8wMDAxYzk5YzBhYzVjMGUzMDAwMDNmMzgwMDAwODkxODE0Nzk3NWMy&i=NWM0YWFhZTFlYmMxMjgxMzI2Mzk1MmZj&t=UjJrRmV2QXpnYUF0RUsvV3haZ0lQMllKYVZRbjFESmtncHdLSjlTVGFWST0=&h=30d9cb4dc2a54dd59052f7a4a0edde4a&s=AVNPUEhUT0NFTkNSWVBUSVYENbLvm6o_1YsgOojZ1VDNrB0gxZ-tcqRfXFH68hrgRw	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 40.126.32.74 13.107.246.45 173.222.162.32
	Document-v05-53-20.js	Get hash	malicious	BruteRatel, Latrodectus	Browse	172.202.163.200 184.28.90.27 40.126.32.74 13.107.246.45 173.222.162.32
	https://sdr.jprlighting.com/i/?bGFuZz1lbiZzdj1nZW5lcmFsJnJib3g9Y2F1Y2lkb2t1#Isabel.almeida@momentum.co.za	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 40.126.32.74 13.107.246.45 173.222.162.32
	https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fportal.eftsure.com.au%2finvite%2f%7b5943C803%2d027A%2d43C9%2dBBBB%2dDE0322D1F961%7d&umid=92db6cfc-6cf7-46fe-8f32-20799b471c27&auth=3a5566c60b1f4d8525fa8ab109f94675a663eb25-8cbc03c09e9a72f57497c9be7e9f6ecc1a7de37e	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27 40.126.32.74 13.107.246.45 173.222.162.32
	https://script.google.com/a/macros/catercare.com.au/s/AKfycbyCQDtAU1dyuYvwnJPmeXCt3bDo8DLMZUezG7uLZMhwcRRbpqjlDlglPr6M9ZhhmyylXA/exec	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 40.126.32.74 13.107.246.45 173.222.162.32

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	malware-DONT-RUN.ps1	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\D3DSCache\30d3a0d8b88cfc9f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	0.012607063453690242
Encrypted:	false
SSDEEP:	3:3r6FlGlll/l/lXp9ZjrPBY0GlKlltlYGDP:b6F0dPBY0yK/dz
MD5:	7F2E37859A2F08A9FE79875F0E914D45
SHA1:	F064CF922964642D0AE533DE8C2E448C1F527CD9
SHA-256:	C4CF3CC12C5D46B92A32969B1E2BBD05F60B0DF85E8E41626AC9D824C372A337
SHA-512:	11768BB13C128D5A894C06C32081DBB374975BD70E7BA9B5DE96DD3B8ECBDAE4B5CBA1456F9404D6DAE012E7B28DD0DCFFBA64C369CCB5721856B10649BDBD0D
Malicious:	false
Preview:	...m........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\D3DSCache\30d3a0d8b88cfc9f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:R:R
MD5:	F49655F856ACB8884CC0ACE29216F511
SHA1:	CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
SHA-256:	7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
SHA-512:	599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
Malicious:	false
Preview:	EERF

C:\Users\user\AppData\Local\D3DSCache\30d3a0d8b88cfc9f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.028463361795261693
Encrypted:	false
SSDEEP:	6:E9q0sRKUEZ+lX1IbRmAe96syfLt72Hrn:N1RKQ1Ib8AessG2L
MD5:	75B95A808E8025B8AAF267AEDE343E4C
SHA1:	07B20F6C881FEAE1DEA1D4012194A54DECC8C93A
SHA-256:	CD1FF62E0D34F61713D6B643404980F9B1C52BA4F4E3CAE972A6FB190A80143F
SHA-512:	CE87E8A8F1430C929CFEC46AC65FD02EB6BBA99CD95072B9E0F3D336890A19231E00B3E4D9D41CF2CE76E624CCB5BD9A6E588B1307D68C4AF45269D25E094E43
Malicious:	false
Preview:	....................(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.u.n.r.e.a.l.g.a.m.e.\.X.e.n.o. .E.x.e.c.u.t.o.r...e.x.e.........................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1faa0066-2d54-4257-aef4-f7677ad11763.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791646866248086
Encrypted:	false
SSDEEP:	96:iaqkHfV2qZn5ih/cI9URLl8RotopMFVvlwhCMe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIYweiRUqhC86qRAq1k8SPxVLZ7VTiq
MD5:	CA7BCA4C91BF17C0B45F745E70600B14
SHA1:	5846D3C92E49F0594ED6E2D04E34158C7215B21D
SHA-256:	7882C9A547DF6DA86E97F03B33A21B870F4759C721E89B9D1A1FCC45C9937EC1
SHA-512:	F23B25B86DC444A5771F7928942884B410F19D9F8829F0DFE08A786F8A7B5B6B6FB38EDED9E8ADD030710183A41CA4BA564B490DF267F17F9700651EDFF72C1F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1GEC8P84bQaiSJnQSZc6wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAJr0qZBbzi6FeYxde8XQM08u2eF35KMrqfGEJQ2GHy5QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9c6dd258-02de-41ac-a63a-27f6152b425c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8381
Entropy (8bit):	5.795294832770205
Encrypted:	false
SSDEEP:	192:fsNwIYMeiRUH6QClkCsVn6qRAq1k8SPxVLZ7VTiQ:fsNwwiDC2zd6q3QxVNZTiQ
MD5:	71F4EEE4DF27ABA6AE0F56C1B2FBDA21
SHA1:	CD2FC4F63962C019A9AE276DB556C0136915945E
SHA-256:	304C999115B0E322B0AD8640B21D04675E9E2A1B1C4D964DA7B550F767C96EAC
SHA-512:	7D8386DC9011A8F4EA358FCD94DC76504E72573746DEB3E7C312707060C19AA4D405501B99339FB84089CD970D34F4F8F9F617A89CDA4A8E997FA0D7145951EC
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139880887754
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
MD5:	7781A0DE57A3606D285D686A487FEB1B
SHA1:	5F702CBBA11E1AF5598DBC7A253A8D382D074ECB
SHA-256:	CF32BBA9E0B08B317F4E9A5DB38CE561C8BB13D337E41DCAB38AC85720F7EF0D
SHA-512:	A185790DAFC4904EA7DD258947811D58F855DBCC6C0D8165C179DF3669B7A7D7EC792EC27FBE671EB9076717C841631928D8BC601EC90F705FE3EB9C876C9C2E
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d66ca4e6-ebdc-472c-b9f3-f57d4727d0cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139880887754
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
MD5:	7781A0DE57A3606D285D686A487FEB1B
SHA1:	5F702CBBA11E1AF5598DBC7A253A8D382D074ECB
SHA-256:	CF32BBA9E0B08B317F4E9A5DB38CE561C8BB13D337E41DCAB38AC85720F7EF0D
SHA-512:	A185790DAFC4904EA7DD258947811D58F855DBCC6C0D8165C179DF3669B7A7D7EC792EC27FBE671EB9076717C841631928D8BC601EC90F705FE3EB9C876C9C2E
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6734690C-1DC4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.32651687658222756
Encrypted:	false
SSDEEP:	3072:/yBNeEKbzxiPVTxFEFVdb2H02r37Cwq8tihRWcY:OebxiP5xuFVNf23q8tihZY
MD5:	4A706BEEDDE6ADA468C4B0B3486729D7
SHA1:	F34D4F9286C027A17BFAF79AADA9F4417B190999
SHA-256:	114BFC3C514819F8BC79080FAE4D2022B29847A8575BCACA5BE102A258FD2A98
SHA-512:	C5CCEC9687E680B9D691204EF975690850142B6E2F3D74C6928AFFD4E9CBF4F4C239FAE33611360A1CA9E1EA539431742D4B55E84B41D2F5275C2AAC8A263B0A
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ryawcn20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U..G...W6.....>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1750482074144895
Encrypted:	false
SSDEEP:	3:FiWWltl/9NViHSRqOFhJXI2EyBl+BVP/Sh/JzvLi2RRIxINXj1C:o1/HViyRqsx+BVsJDG2Yq2
MD5:	109D135A924FF0D6CA41052000753A95
SHA1:	8A035392177378347106A01001D2F700F6F97F14
SHA-256:	8CA165B3570E1F43811E3E75CC3F90E9BC427AE0F8C48A07902B5039B09E3148
SHA-512:	53E82218E4A0273863BA30DDA234CB6B0AC42F79A3BAF2C1EAA38B61BBD483E2FE1179B42F609AFC1166895024DBCD02F48BF45947E3DA05B42BFDF57375C3C3
Malicious:	false
Preview:	sdPC......................5.y&.K.?...."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\06a34cad-e526-4d2a-ac07-829b2c85cdf0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\24f4476c-a674-46e0-97ee-845645258613.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7aefae36-765a-4e8a-9124-76fe63baf987.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\879978f6-e175-4ed4-b67b-98d1df5f5890.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12928
Entropy (8bit):	5.162609307878908
Encrypted:	false
SSDEEP:	192:sViJ9pQTryZigaba4uyw91JKSgeY9cE8Tpj+FNSQANIh1f:sViLA3uzJKSzpUcQ8W
MD5:	BA90301246C149B441DEEC9D7DC478C4
SHA1:	0BDB030ED1FED4671B4B2A753DE023E408B70D93
SHA-256:	FE909749B406DD2FF63C4C25CF7BEB54E57777949D36FD0EBDA4DC2A74F85643
SHA-512:	D875418B5BDA536EAC479C3A96184B27653FDBC3223E0BF2D3D0893E5D6345C266A0740EAE1015DF293CC2D42416189AEA7D247247F4D7C4AE81AC87931072DD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13375961612842941","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8efa69d1-ad43-4315-8869-7a6a1bef2b6b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37816
Entropy (8bit):	5.5560661714752015
Encrypted:	false
SSDEEP:	768:sFDaD37pLGLpGoWPNdfmL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6B9AHrwGPoDdKE:sFDaDxcpGoWPNdfmLu1ja33AUGPyStg
MD5:	1E50F4DF5BA4590069F0C072824FA049
SHA1:	F8359C06E2536A9A9CE2D55D3E82FBC6ABF59D27
SHA-256:	6B8FB73996C1521A59C860E120C87054C1F532A811DD2566D1A12246397EF18A
SHA-512:	41CFD8C0592C0B3E1E1EC9E2E30102D69223ACD4229E86A91FC62A3068E4DFCF73ADC28C11F85FFBA363D51C63F371805EF284CEE908E305A68685E7727EB709
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375961612337147","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375961612337147","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1695826
Entropy (8bit):	5.04113555777849
Encrypted:	false
SSDEEP:	24576:aPfQUg6kAdRhiGzmYoAo2ENU0ifYeV3br2M:aPfZ/mS5
MD5:	DFE8799F8C9495316FD252D62EC756E1
SHA1:	3F33C5D6D5A1F56365C1EA34C205BDD97F5EEB54
SHA-256:	E7B978D48CB56BF2D9A31D6390EDCB9331AC2421471F7E9CC9AD85228A7BB749
SHA-512:	E68FEA609BCB98F5F7E0F54706A01CB46447A052F739C741EC5D0160148996EF0D4E8A2F95A335DB4212A28710AECCA64C9104CF3ABCB4137EE8B178D01235AD
Malicious:	false
Preview:	...m.................DB_VERSION.1'.\.................QUERY_TIMESTAMP:arbitration_priority_list4...13375961616872028.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}] ...................QUERY_TIMESTAMP:edge_hub_apps_manifest_gz4.7..13375961616902846.$QUERY:edge_hub_apps_manifest_gz4.7...[{"name":"edge_hub_apps_manifest_gz","url":"https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline","version":{"major":4,"minor":7,"patch":107},"hash":"Qoxdh2pZS19o99emYo77uFsfzxtXVDB75kV6eln53YE=","size":1682291}]=_.../..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivileged

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.098822517730441
Encrypted:	false
SSDEEP:	6:HUWbQpj+RM1wkn23oH+Tcwt9Eh1ZB2KLlVUWhq2Pwkn23oH+Tcwt9Eh1tIFUv:vXrfYeb9Eh1ZFLVvYfYeb9Eh16FUv
MD5:	6565D1A75500F3FB8C8E3783DFED4A21
SHA1:	28D15B16C61877366B2DD0CF24A2FACE0FE45913
SHA-256:	2C84DC2B4A00988715767708EC3DC984319C5FCA7322A4F6CA00FD5338B3DC1A
SHA-512:	BBF502F3A6C44C574D23F6F980B92189510ECE1B0083ACAC5F67938B6646A18197B7F463D04DEF486E727BF09EF04FC7EEDECEF6C5707490358FFB7135720770
Malicious:	false
Preview:	2024/11/13-03:53:35.755 21e4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/11/13-03:53:36.006 21e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4632406265309028
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuwEHW:TouQq3qh7z3bY2LNW9WMcUvBuwEH
MD5:	EEB3C5BF6958851C0E23EB687629546E
SHA1:	E01716D9174CD2A92B07113243D239AE7DD5F15A
SHA-256:	2C2133C0A04733FB85A97098752CA6250745E617550B91212FEDF0C5EF439D00
SHA-512:	FDBED34447B89B4EF8EC2C3AC1DBD7835399023EC4BB624D8D5228B279CC4511F5DD6541458EFCB83B80888DB920D947BA10A6DBA6657906FD0A18B2476A3CBA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl12l:Ls3Ql
MD5:	028AD11B80107E0205F38349C3CD8AF9
SHA1:	9DA8BE21C57770D6CCF49042A7F8FC3D9F135A25
SHA-256:	5FC3022B669B269109A830C82607AAF28EA17003DF8A622A102E069A1494F7C0
SHA-512:	5790AD41F19447B786556B2EAF939DEF080D8A52629DA3787D64E49CEF75CBAF9941895DC920F0764F60D8915CE03AA88ABCD0D62E69AE8F89BBCF2C6A75395D
Malicious:	false
Preview:	........................................Dxt.]./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.1933990483414165
Encrypted:	false
SSDEEP:	6:HUWN+NFD1wkn23oH+TcwtnG2tbB2KLlVUWNMzN9+q2Pwkn23oH+TcwtnG2tMsIF2:xA0fYebn9VFLJMZ4vYfYebn9GFUv
MD5:	76510A9EAA462E0B1E57C052822862C9
SHA1:	A5D7C6398624EA545405B95E920E355713C9E076
SHA-256:	665F300CBB7444A406181C30F6491D2AE869243C7DB318652B5648E44730403F
SHA-512:	49B30E6BFB03E6A8479721BAB30D51FE44E2EAB44ABBD5157ADBE8824D7F2D1450F7B5AD44BA033B88330CBFA448E778C4F2261B8861DA2653E6C36408C292F5
Malicious:	false
Preview:	2024/11/13-03:53:32.358 1e28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/11/13-03:53:32.372 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6132936120070819
Encrypted:	false
SSDEEP:	24:TLqpR+DDNzWjJ0npnyXKUO8+j60DpM7mL:Te8D4jJ/6Up+j1
MD5:	32BE29442A0276E03FA5D7F4535CA99F
SHA1:	C84D4150D0D4FC6AC636193CCAE5AF60BDA078D4
SHA-256:	EB2FAA5AA72EA8AABBAC9C8827A34CA9EDE99F984FEBF7CDD909161644C5ECF6
SHA-512:	6FC4F1956FD545D2C116EB24B7877013E605FD14C04BED795EC9D51B8D3B115FA306486413B3B31E0EB8C55D8D23ACF91463364E9E090EFD660582F626AA9B28
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354126782422963
Encrypted:	false
SSDEEP:	6144:qA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:qFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	230BF2F70CD09D02304004E03AF6ABAB
SHA1:	CA88D6067F23CEEEF1B48504273B45F01EA5C433
SHA-256:	212041875B9A2C401A3DDC4B1E6C784D67DA803B43E211636DFC265DB5609BE4
SHA-512:	945EBE92576B665ECD84634C8494FEA1B56B68341E756D8C1A460CAF1B2D3FAA1E72DE6A78EB4F2FA83ED065B6B1D56B290D48E1778B713A35348EAFD5AD04F8
Malicious:	false
Preview:	...m.................DB_VERSION.1..Tq...............&QUERY_TIMESTAMP:domains_config_gz2...13375961617000966..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.185269927006471
Encrypted:	false
SSDEEP:	6:HUWLwU1wkn23oH+Tcwtk2WwnvB2KLlVUWDcH4yq2Pwkn23oH+Tcwtk2WwnvIFUv:nwDfYebkxwnvFLnvyvYfYebkxwnQFUv
MD5:	F779305B0C9096C17DD9315936094B7B
SHA1:	B8AFDB02688B343E78D4D3F798E60D4F138922CA
SHA-256:	2F8841F868EA5A817DFF4EF97B81285FF424318959D8AB745D96A0A94DBC7AFF
SHA-512:	8583038CC8FF8BF92A1BFD235093882237E771ED0EF49660BC341077E172A0F3C215E5E9F4CC2EB93DF78BA6A0FD3A3B342996DC26FE4E25A4A9CB4857B898BE
Malicious:	false
Preview:	2024/11/13-03:53:35.977 2210 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/13-03:53:36.051 2210 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324611530393056
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R3:C1gAg1zfvv
MD5:	A9E66DDD70CC1B11D9ABCB6A8CAA018F
SHA1:	6FA6A8A02CE7AD0B6257C145DE55EA2CAA5B3C19
SHA-256:	8BEB09B20BF842B7CD78DF42DB6F9A694B0F8D83733087AAEE304D309BECDD9B
SHA-512:	F9E5EBB5596A7E59440BF4A17F6B5DE224DF07600EE921F0F16784D0FC298E5C88BE7007F08B4B049C7D60E5DE299547FFC5720F7C1845449B74D70A5AB150C6
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	190
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCT
MD5:	BD4367115C311692E06B63F1793B0624
SHA1:	CD807FEF06588E7C56FDB1A3A2CE15EF04955A16
SHA-256:	46ED76C989FA492AF602D813EAF61C17EDD71251674807A443B8F9CCC988292A
SHA-512:	98E63595B75951B719868396E11CA9153B7B987DD9737E3DEC67E067C9A68AB706FE993BDB8DB86D664D7353D9DC7D742D10430DDD0FE5F0847C687FCB257E52
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.166517151399492
Encrypted:	false
SSDEEP:	6:HUWNVUATRFuM1wkn23oH+Tcwt8aVdg2KLlVUWtj34q2Pwkn23oH+Tcwt8aPrqIF2:xVUBrfYeb0LZj34vYfYebL3FUv
MD5:	9E1252D3BE786A22DAD854E6A15114E4
SHA1:	E513F12D840DF5CEB62F0852289DB41420E93B2F
SHA-256:	ADDB23AB6865B87053452A5FA5BF81E0A77880B4922F9D211D0B615EE307D273
SHA-512:	B7ECA86A73F1292BFA342E99CB91A309670E3C6A0D0FF916B0041DE672E44BDEE5A87A343504B1DF576D5AB232349EA102AEB9E5DF4DED23C4BA15B9FF6CE51B
Malicious:	false
Preview:	2024/11/13-03:53:32.380 1e64 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/11/13-03:53:32.407 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	190
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCT
MD5:	BD4367115C311692E06B63F1793B0624
SHA1:	CD807FEF06588E7C56FDB1A3A2CE15EF04955A16
SHA-256:	46ED76C989FA492AF602D813EAF61C17EDD71251674807A443B8F9CCC988292A
SHA-512:	98E63595B75951B719868396E11CA9153B7B987DD9737E3DEC67E067C9A68AB706FE993BDB8DB86D664D7353D9DC7D742D10430DDD0FE5F0847C687FCB257E52
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.1384594107608175
Encrypted:	false
SSDEEP:	6:HUWlFuM1wkn23oH+Tcwt86FB2KLlVUWL5FZX4q2Pwkn23oH+Tcwt865IFUv:RorfYeb/FFLhFp4vYfYeb/WFUv
MD5:	695A358070A5847123EA7DB200C8C613
SHA1:	F96B879786F3447D3DDF3DCCB495CC6C7706BBA1
SHA-256:	FF56F8E40694098E6E490AF817C0A8776BD310C237A2050DF7795613EC180D3E
SHA-512:	35797D2540A9C2F17882C3AD9437C2402E7E9733BD65B84FE5FB8374BE0ED126FEB61347096B74C2745E6938180E8A29AA788986838E53D5832537476C3CB815
Malicious:	false
Preview:	2024/11/13-03:53:32.430 1e64 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/11/13-03:53:32.506 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	914FD8DC5F9A741C6947E1AB12A9D113
SHA1:	6529EFE14E7B0BEA47D78B147243096408CDAAE4
SHA-256:	8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
SHA-512:	2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.087064336976855
Encrypted:	false
SSDEEP:	6:HUW1Fiq2Pwkn23oH+Tcwt8NIFUt8YUWFA/ZZmw+YUWFA/zkwOwkn23oH+Tcwt8+Q:TivYfYebpFUt8tZ/+tz5JfYebqJ
MD5:	8718DE1E0C424B069C962650B8FF0DA5
SHA1:	1305D48D33939DCF4657D1623FF03CD3D8F709F9
SHA-256:	E55B1CC5211AADC701065C48FF2299B5B65BF6E45CAA105D0CD86828ADBAAD6B
SHA-512:	D952E346E1CEDB0976511BB310D83ADB93B7143E78C3937EC35FDC0684D0F7D596912C446D07D810C8B521316428F7D1F745ACFF294712A4D1E43E1A3BF9AABA
Malicious:	false
Preview:	2024/11/13-03:53:33.060 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/13-03:53:33.061 1e20 Recovering log #3.2024/11/13-03:53:33.061 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.087064336976855
Encrypted:	false
SSDEEP:	6:HUW1Fiq2Pwkn23oH+Tcwt8NIFUt8YUWFA/ZZmw+YUWFA/zkwOwkn23oH+Tcwt8+Q:TivYfYebpFUt8tZ/+tz5JfYebqJ
MD5:	8718DE1E0C424B069C962650B8FF0DA5
SHA1:	1305D48D33939DCF4657D1623FF03CD3D8F709F9
SHA-256:	E55B1CC5211AADC701065C48FF2299B5B65BF6E45CAA105D0CD86828ADBAAD6B
SHA-512:	D952E346E1CEDB0976511BB310D83ADB93B7143E78C3937EC35FDC0684D0F7D596912C446D07D810C8B521316428F7D1F745ACFF294712A4D1E43E1A3BF9AABA
Malicious:	false
Preview:	2024/11/13-03:53:33.060 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/13-03:53:33.061 1e20 Recovering log #3.2024/11/13-03:53:33.061 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.548601076678917
Encrypted:	false
SSDEEP:	384:zj9P0WyQkQeracp773pLIgam6IDP/KbtERKToaAQhf:zdxye2Np7hzP/hRKc09
MD5:	4DD6BDDFCA7D63320B2382CA12AE0307
SHA1:	EDE0F13873157AFA93E9C1146DBDF4DB65FFA2DE
SHA-256:	13E40EE2BA408905C3E066ED41F7B8E1CDD6A955C29B04F7AF5454FEE0A34316
SHA-512:	025ACD5628C0934C6512A9FC94F942C4DFA04FE44EB7D137636671C50C664CC9036BBC5C736307D492620CBF284B40FC7A955A4367BA490412AB03BDC985FB65
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.278429678200887
Encrypted:	false
SSDEEP:	12:TzvYfYeb8rcHEZrELFUt8i/+O5JfYeb8rcHEZrEZSJ:nYfYeb8nZrExg88JfYeb8nZrEZe
MD5:	A672E3D397F7169C0910D1D8AF6473D6
SHA1:	5047A475F14F9BDC0C34259C7C8FEA625418CA35
SHA-256:	37EE85BC2691778105A321402264714166AD74B393F7C720398F179385D85F70
SHA-512:	B9B53DF6C3A6517EB584810B33BC00AF19FA9CDB7E9AB73CEA7450279B8F4229B467D2BF987D033EC45A2337A8FEECC45AD8CCBA68FC9820522D96B6E4524E6D
Malicious:	false
Preview:	2024/11/13-03:53:33.768 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/13-03:53:33.769 1e20 Recovering log #3.2024/11/13-03:53:33.769 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.278429678200887
Encrypted:	false
SSDEEP:	12:TzvYfYeb8rcHEZrELFUt8i/+O5JfYeb8rcHEZrEZSJ:nYfYeb8nZrExg88JfYeb8nZrEZe
MD5:	A672E3D397F7169C0910D1D8AF6473D6
SHA1:	5047A475F14F9BDC0C34259C7C8FEA625418CA35
SHA-256:	37EE85BC2691778105A321402264714166AD74B393F7C720398F179385D85F70
SHA-512:	B9B53DF6C3A6517EB584810B33BC00AF19FA9CDB7E9AB73CEA7450279B8F4229B467D2BF987D033EC45A2337A8FEECC45AD8CCBA68FC9820522D96B6E4524E6D
Malicious:	false
Preview:	2024/11/13-03:53:33.768 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/13-03:53:33.769 1e20 Recovering log #3.2024/11/13-03:53:33.769 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.131596837063767
Encrypted:	false
SSDEEP:	6:HUWjrN+q2Pwkn23oH+Tcwt8a2jMGIFUt8YUWZZZmw+YUWZVVkwOwkn23oH+Tcwtw:nrN+vYfYeb8EFUt80/+KVV5JfYeb8bJ
MD5:	3293D405B177377F0F6BB81AF8F55B89
SHA1:	701E1054EF5B3A07FB5DCFB9C6789E53847BF461
SHA-256:	E92569D931E05175FDAB6C1126E543588FC9C734BDC852EAE1782B4A00AC06C2
SHA-512:	330EDD26B274D0696ECE503A1C4BD598BD51AC1B5108D48ACB2F927AE0B8E08E26B161B97DD5AC537B01F0EC7E976E9EDF788797B7F1E8E247A393A87878E217
Malicious:	false
Preview:	2024/11/13-03:53:33.001 1f7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/13-03:53:33.018 1f7c Recovering log #3.2024/11/13-03:53:33.032 1f7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.131596837063767
Encrypted:	false
SSDEEP:	6:HUWjrN+q2Pwkn23oH+Tcwt8a2jMGIFUt8YUWZZZmw+YUWZVVkwOwkn23oH+Tcwtw:nrN+vYfYeb8EFUt80/+KVV5JfYeb8bJ
MD5:	3293D405B177377F0F6BB81AF8F55B89
SHA1:	701E1054EF5B3A07FB5DCFB9C6789E53847BF461
SHA-256:	E92569D931E05175FDAB6C1126E543588FC9C734BDC852EAE1782B4A00AC06C2
SHA-512:	330EDD26B274D0696ECE503A1C4BD598BD51AC1B5108D48ACB2F927AE0B8E08E26B161B97DD5AC537B01F0EC7E976E9EDF788797B7F1E8E247A393A87878E217
Malicious:	false
Preview:	2024/11/13-03:53:33.001 1f7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/13-03:53:33.018 1f7c Recovering log #3.2024/11/13-03:53:33.032 1f7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\55992956-4d8a-43bb-a104-e7526fa43b05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7d1ec3f9-192f-40f6-a848-2e2654045b95.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	22
Entropy (8bit):	3.788754913993502
Encrypted:	false
SSDEEP:	3:YWRAW4J2LSQ:YWyW5SQ
MD5:	3BB76EC23C5506830EAD56540E06159F
SHA1:	94695E47D907E559E91E677CEC4EB763DC0C5CA9
SHA-256:	6B40F4AE548688A472BE3CA0C1B08ECF520B31E706FEC0F9793B4666134EBA06
SHA-512:	307F9BD06CA5EE753ACDC450CF1599DFC8ED080D9A1B19D752DD9B7950377A5B04E44D374F12ED76ABD74961C2B1F8AD6C93E4663EA77F5D6E066570C1AA6BAD
Malicious:	false
Preview:	{"sts":[],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF37233.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF34b33.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF35c98.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF37233.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a990d289-d274-47d2-8dc7-9f18eccb851f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b8fb4a14-790f-4f9e-9fa6-120d7edb2cb2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c3a4a9e3-04a1-407c-9717-f41a06ef81d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec6afda1-5cc3-425a-af40-6d57ab183989.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5877891092219624
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isRdjiG1dOfNS9K0xHZ7y:TLiOUOq0afDdWec9sJ1VI7J5fc
MD5:	C5B844241F847FB9AC61F4A8E9206AC8
SHA1:	B4F64969D3AA0EB1EC97AFA248785CE8D9B69274
SHA-256:	01D60A02D87F7995E9D25F35D7C681447F5C3BA03102BCC2B67D0A2C7C0E5F63
SHA-512:	CB4F66149937A69C7232358E3A978296BD408321185FD42C71CE5DFD7CADD5C89A734D72A4D837CA6FBC987B77EDEE919201E1A33CCABA926B553D411F233900
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12928
Entropy (8bit):	5.162609307878908
Encrypted:	false
SSDEEP:	192:sViJ9pQTryZigaba4uyw91JKSgeY9cE8Tpj+FNSQANIh1f:sViLA3uzJKSzpUcQ8W
MD5:	BA90301246C149B441DEEC9D7DC478C4
SHA1:	0BDB030ED1FED4671B4B2A753DE023E408B70D93
SHA-256:	FE909749B406DD2FF63C4C25CF7BEB54E57777949D36FD0EBDA4DC2A74F85643
SHA-512:	D875418B5BDA536EAC479C3A96184B27653FDBC3223E0BF2D3D0893E5D6345C266A0740EAE1015DF293CC2D42416189AEA7D247247F4D7C4AE81AC87931072DD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13375961612842941","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37816
Entropy (8bit):	5.5560661714752015
Encrypted:	false
SSDEEP:	768:sFDaD37pLGLpGoWPNdfmL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6B9AHrwGPoDdKE:sFDaDxcpGoWPNdfmLu1ja33AUGPyStg
MD5:	1E50F4DF5BA4590069F0C072824FA049
SHA1:	F8359C06E2536A9A9CE2D55D3E82FBC6ABF59D27
SHA-256:	6B8FB73996C1521A59C860E120C87054C1F532A811DD2566D1A12246397EF18A
SHA-512:	41CFD8C0592C0B3E1E1EC9E2E30102D69223ACD4229E86A91FC62A3068E4DFCF73ADC28C11F85FFBA363D51C63F371805EF284CEE908E305A68685E7727EB709
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375961612337147","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375961612337147","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1356046080295865
Encrypted:	false
SSDEEP:	6:S85aEFljljljljljljlfzllaV935erqodUV:S+a8ljljljljljljlfzlc5s7W
MD5:	A9280F186EB8B3D4C39F5F126C776A91
SHA1:	E40589030394DA2123ED5FD346AA86C1C87A29C1
SHA-256:	D056E3C0FE2A0D570666F7ACC69917C9988E68269A36E657A2791F43040516E9
SHA-512:	1B9B1295198753C2B226FA21E318F67B91AF7A0A281D69171279D08D7B6DBB24DBDD293BA9877DC2ABE5AB720F99348AD8D7070BD2775579FDC95B236DE91C73
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f................C..b................next-map-id.1.Cnamespace-27615cf9_0615_41a7_918f_97a7e03a5521-https://ntp.msn.com/.0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.129558884689119
Encrypted:	false
SSDEEP:	6:HUWf/+q2Pwkn23oH+TcwtrQMxIFUt8YUWJ0Zmw+YUWnVkwOwkn23oH+TcwtrQMFd:rGvYfYebCFUt8l/+A5JfYebtJ
MD5:	BC3C80488240ECD3BB99FD1D2D5D6074
SHA1:	553506E1A6148B13234390A727BFFF19DC573A16
SHA-256:	F1809C6E8EDE7AF05EF1B050CD44EA24DC3C13B161C80A0AB158B0CFAD78D2BC
SHA-512:	F4B28157878147625A48B0FA993A01BCCE2FEAF1EA67DCB903BD532B4B87478E18DB76B2970D216554EF35C98602BE2AA8C10DE5F2E350264DD48EC17B8565CE
Malicious:	false
Preview:	2024/11/13-03:53:33.084 1f98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/13-03:53:33.102 1f98 Recovering log #3.2024/11/13-03:53:33.112 1f98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.129558884689119
Encrypted:	false
SSDEEP:	6:HUWf/+q2Pwkn23oH+TcwtrQMxIFUt8YUWJ0Zmw+YUWnVkwOwkn23oH+TcwtrQMFd:rGvYfYebCFUt8l/+A5JfYebtJ
MD5:	BC3C80488240ECD3BB99FD1D2D5D6074
SHA1:	553506E1A6148B13234390A727BFFF19DC573A16
SHA-256:	F1809C6E8EDE7AF05EF1B050CD44EA24DC3C13B161C80A0AB158B0CFAD78D2BC
SHA-512:	F4B28157878147625A48B0FA993A01BCCE2FEAF1EA67DCB903BD532B4B87478E18DB76B2970D216554EF35C98602BE2AA8C10DE5F2E350264DD48EC17B8565CE
Malicious:	false
Preview:	2024/11/13-03:53:33.084 1f98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/13-03:53:33.102 1f98 Recovering log #3.2024/11/13-03:53:33.112 1f98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375961614837730

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1323
Entropy (8bit):	3.69328001617458
Encrypted:	false
SSDEEP:	24:3ePxmjDjHfpsAF4unxKftLp3X2amEtG1Chq5XiuTWDQKkOAM4Z:3ePgjPfzF61Lp2FEkChyiyWMHOp
MD5:	F8147CC24024458027D9D2CF79AC2354
SHA1:	DDE98F77948F5A0530C1C6EEC73F0FA87348026B
SHA-256:	D306234C8340B885A3053D4E04A952B7464DDCA2005A97CB9A04ECD0849658E7
SHA-512:	A1C2A5F5535E17BA1A83D8D0A7EB8FFCE149A5AA06ECFAB6D403EF6312FB699031A3AF6B732767888318944BEC0F4E49BD36C13AE78048CBF69D4FE8284D3B12
Malicious:	false
Preview:	SNSS........1z.............1z.......".1z.............1z.........1z.........1z.........1z.....!...1z.................................1z..1z.1..,....1z.$...27615cf9_0615_41a7_918f_97a7e03a5521....1z.........1z......7..........1z.....1z............................1z.............1z.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......}..x.&..~..x.&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8....................................................................... .......................................................P...$...a.3.9.7.7.f.b.c.-.8.b.5.6.-.4.d.e.6.-.9.a.e.7

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.140381822191306
Encrypted:	false
SSDEEP:	6:HUWN6L4q2Pwkn23oH+Tcwt7Uh2ghZIFUt8YUWNfi3JZmw+YUWNfi3DkwOwkn23oz:x6L4vYfYebIhHh2FUt8sfi3J/+sfi3Dw
MD5:	381D572975A5CA264E126CED290DA6A3
SHA1:	5C96A74ABAB13ACE9F9F5145E353D4FE6CE44C6F
SHA-256:	1963F61C9A323CD74C41870D6F29376EF9ECA9793E609C27F11F0A39A446B0F1
SHA-512:	0BCC7E63F61C5E4BDB6B424F9D387A428AE838EC555C42DF575E372487130FC5B9872F06813AA50CADD965E4E61E101C9DACF9B5E8EC411003202649C0507228
Malicious:	false
Preview:	2024/11/13-03:53:32.363 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/13-03:53:32.367 1e64 Recovering log #3.2024/11/13-03:53:32.367 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.140381822191306
Encrypted:	false
SSDEEP:	6:HUWN6L4q2Pwkn23oH+Tcwt7Uh2ghZIFUt8YUWNfi3JZmw+YUWNfi3DkwOwkn23oz:x6L4vYfYebIhHh2FUt8sfi3J/+sfi3Dw
MD5:	381D572975A5CA264E126CED290DA6A3
SHA1:	5C96A74ABAB13ACE9F9F5145E353D4FE6CE44C6F
SHA-256:	1963F61C9A323CD74C41870D6F29376EF9ECA9793E609C27F11F0A39A446B0F1
SHA-512:	0BCC7E63F61C5E4BDB6B424F9D387A428AE838EC555C42DF575E372487130FC5B9872F06813AA50CADD965E4E61E101C9DACF9B5E8EC411003202649C0507228
Malicious:	false
Preview:	2024/11/13-03:53:32.363 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/13-03:53:32.367 1e64 Recovering log #3.2024/11/13-03:53:32.367 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:Lsul0DKll/l:Ls7D+l/l
MD5:	4D03CAC7086A5D05F4D1D30370CE890A
SHA1:	53CC20FC4C532D2206EF312889D9027A7F9B61A6
SHA-256:	23DC1FF6095F9A40A803849C3F9D2EEBDB4E13A8A19CA01051E069086BFFC202
SHA-512:	487AE4E3381D39CD87236DDE0D0822EF2B731685A368F6C03CAC2EDCBBE8CF7677AA910E802840C6367F21EA64A82869A6A6787237E4C32126C7973D1A9AF327
Malicious:	false
Preview:	............................................]./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlxhl4ll/l:Ls3nl4//l
MD5:	48FEC331C52B0267D6BC1AE3D57DBD3A
SHA1:	3A364B58C7BB675DF090F15BDF804E3E1167B9B7
SHA-256:	D996A34CFEA45F0267AF4287CDDEA110A9E8DA0716552826B4B8AD0F9FC1D764
SHA-512:	1A1BB95A321C2423ACD862525AA1DA391133D2FA31EC83B23F8E5202886CC391F889F3F5E9C7450E576B400018C923A118DA1D76A4DF8A556BF292CDCFA8AC96
Malicious:	false
Preview:	........................................)%..]./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.224904742266156
Encrypted:	false
SSDEEP:	6:HUWzpFN+q2Pwkn23oH+TcwtzjqEKj3K/2jMGIFUt8YUWIBZmw+YUWeVkwOwkn230:Z+vYfYebvqBQFUt8p/+1V5JfYebvqBvJ
MD5:	3DE03D5180091744AC415A932440B13F
SHA1:	2586AEE5A17F9B94285FD99E765CBD05FB91A0CA
SHA-256:	C7399474E8E737EFBD181AF5A2EC9DEF9472A6BF3F7388531F5AFAF5FD8EB91C
SHA-512:	B49031454D030E3E91BCD056D131F403087D8AAFADFB2DD35DA704F82907E73D1A0C7BF4A2FBFCA2E8F6086FB9159CF124BBD81185B34ABA49F2D2BD7636E217
Malicious:	false
Preview:	2024/11/13-03:53:33.108 1f7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/13-03:53:33.109 1f7c Recovering log #3.2024/11/13-03:53:33.112 1f7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.224904742266156
Encrypted:	false
SSDEEP:	6:HUWzpFN+q2Pwkn23oH+TcwtzjqEKj3K/2jMGIFUt8YUWIBZmw+YUWeVkwOwkn230:Z+vYfYebvqBQFUt8p/+1V5JfYebvqBvJ
MD5:	3DE03D5180091744AC415A932440B13F
SHA1:	2586AEE5A17F9B94285FD99E765CBD05FB91A0CA
SHA-256:	C7399474E8E737EFBD181AF5A2EC9DEF9472A6BF3F7388531F5AFAF5FD8EB91C
SHA-512:	B49031454D030E3E91BCD056D131F403087D8AAFADFB2DD35DA704F82907E73D1A0C7BF4A2FBFCA2E8F6086FB9159CF124BBD81185B34ABA49F2D2BD7636E217
Malicious:	false
Preview:	2024/11/13-03:53:33.108 1f7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/13-03:53:33.109 1f7c Recovering log #3.2024/11/13-03:53:33.112 1f7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\13c32ca4-a520-4885-9c5c-74e0e9ab80e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF35c98.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ac815555-ba1c-44b0-9c6f-c9233e010a66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c9af0232-ed72-44a2-ad5a-59b473d30c69.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.235359782453558
Encrypted:	false
SSDEEP:	6:HUWNfuN+q2Pwkn23oH+TcwtpIFUt8YUWkFZmw+YUWkpVkwOwkn23oH+Tcwta/WLJ:xfuIvYfYebmFUt85F/+5X5JfYebaUJ
MD5:	9A8D1B43DD5D139C18FA2B6D2CA500F9
SHA1:	4AF14B6B5676527CF8D0C04E7ABAF6001FB3C2D7
SHA-256:	E5B39B20158BC17005EE1C63481877D11AE577C219A27EB4FEB782A27B2996FD
SHA-512:	6E8E093DC9A4FFFBD8C3F8BF0D58F8F72529B37405CA657C0FEF421EDDFEF6627CF0907924B261404ADCFA351160CAF8F00F6D91974C2A5E7D810265F8EC44B4
Malicious:	false
Preview:	2024/11/13-03:53:32.367 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/13-03:53:32.419 1e68 Recovering log #3.2024/11/13-03:53:32.419 1e68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.235359782453558
Encrypted:	false
SSDEEP:	6:HUWNfuN+q2Pwkn23oH+TcwtpIFUt8YUWkFZmw+YUWkpVkwOwkn23oH+Tcwta/WLJ:xfuIvYfYebmFUt85F/+5X5JfYebaUJ
MD5:	9A8D1B43DD5D139C18FA2B6D2CA500F9
SHA1:	4AF14B6B5676527CF8D0C04E7ABAF6001FB3C2D7
SHA-256:	E5B39B20158BC17005EE1C63481877D11AE577C219A27EB4FEB782A27B2996FD
SHA-512:	6E8E093DC9A4FFFBD8C3F8BF0D58F8F72529B37405CA657C0FEF421EDDFEF6627CF0907924B261404ADCFA351160CAF8F00F6D91974C2A5E7D810265F8EC44B4
Malicious:	false
Preview:	2024/11/13-03:53:32.367 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/13-03:53:32.419 1e68 Recovering log #3.2024/11/13-03:53:32.419 1e68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.067116241795288
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumY3Hn6:QrzWMffznzkkqtXnTK+hNH+5EVumM
MD5:	A60105F4DD3D8DC8E90EDF43623C636C
SHA1:	5F5190FE69D6CDA7BBB463B5FF8E0FBA7C6C8D65
SHA-256:	025904F089855210DB3A7F426F088F7647509C7BA0A7ED6DB55B299C55676243
SHA-512:	34D77AA231B2A9B1CB2C53D80F326CB0B23D46E62958569F99D964B650114F5E35D3AE371FAEA9C41AA7DEAD46EED403E3A261A200F4B095058C120C74BD7BA1
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03861178772764072
Encrypted:	false
SSDEEP:	3:Gtl5/8f0lQ6JW7oCltl5/8f0lQ6JW7o3+Ra9//9lnl/telfl6ll:Gtof0lvY0Cltof0lvY03+89XHl/c
MD5:	08E5E856C333EE7899C3BAE0760C07CC
SHA1:	918EE8FFAE352115720A6582EF8C8E4C54555211
SHA-256:	F77FBAEF419649753B73D96EC60F50BDB5DE8A8938B275FB5097D2B074C58A14
SHA-512:	EBA43F3CC379BA20EAEDE07858C00FF38E66F5B834169BC9547CCE1E265B4180E38F6C6F99929E8DFE5DC3D2185A024F0722A86554AE3592256F4A8B37E23E09
Malicious:	false
Preview:	..-.......................U......~."..G...#q.K..-.......................U......~."..G...#q.K........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	0.22542367821881676
Encrypted:	false
SSDEEP:	6:KUru2N77CzdYjdkTwA7odL2UllJAtlNdkTwAlyDRHaGjdYjdPaMNUern:KAVezajsoJ28lJq8w9zajjUA
MD5:	2ECBEA4E2898D8A7D78FFA89E94E291A
SHA1:	2E0CC6FC560186502856D97C5A7DF13AD5FC66E4
SHA-256:	888B5880D0E45EFF4A737DC44C5D9F8C2146C10337F177D60A6EB512213A8DED
SHA-512:	32AC372E8121FD537A0C7061C3282E3C5096C9410CD593FC25DD1A2332263A7BC1D0CB9D46FCF32C525912932BE516B4C61892A8D5600A3D948B5F5DB532AAE2
Malicious:	false
Preview:	7....-............~."...e.AH9............~."...x*XF..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.29193989140738
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQPqVTl3seGKT9rcQ6xoHgYUtlTxotl:/XntM+KqVTl3sedhOo9Uu
MD5:	11621FFB5E2C8483B6F5E53A89468224
SHA1:	C44F1E6FBDE3CFD479244222F8DAC92AB679947B
SHA-256:	7E5D7AA999C7D8681B81E09E50C54F8971717823292A000B94DCDA3D05DBA55D
SHA-512:	E0908E851DD6F1A83D375BEBCC8CCFB7F53A64490C009CE8301CD8F459DA9F03C19573FCE237B1C26017A9E036DD2EB450FC337203F2F814A5457B8CE69BC4DD
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1....0................39_config..........6.....n ....1u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.222116827735382
Encrypted:	false
SSDEEP:	6:HUW1R1wkn23oH+Tcwtfrl2KLlVUWdQFL+q2Pwkn23oH+TcwtfrK+IFUv:mfYeb1LxQovYfYeb23FUv
MD5:	036A2F7D6F1DD16D3F19D620496B62A6
SHA1:	870A2B4F18CB127085C973535EAB9C1D44E223F2
SHA-256:	B298839CF6591DB586280283350159E8A80A2AE17BE26DC43D76BD7A4ECF2B63
SHA-512:	04DA3D0DC4947CA7831308245202CCC0D580F063704E737EEC757BB09D3C094D77D24E7C0841B84A4B80FE9D2FEDFEC63150BB97A662F2EBB5863E6CD0071667
Malicious:	false
Preview:	2024/11/13-03:53:33.173 1e58 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/11/13-03:53:33.194 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9357594062751415
Encrypted:	false
SSDEEP:	12:G0nYUtegetU3p/Uz0RuWlJhC+lvBavRtin01zv0:G0nYUteu3RUovhC+lvBOL0
MD5:	F92B1772933BEFBDD45935AF16DF0BB6
SHA1:	234A775CD7ABD7D5E8C5001D713840C70EA72DE5
SHA-256:	06F489DF91A06096A4BD4C2D0C8E321AD982F1147C4C0033FE90B8A2A3D252F0
SHA-512:	58FD0B7654A12FBC7AB05A71C363B441F6170A904C3DACDC591C700D8C354995215BC5B289B3572A65C159D4BD85810028F4624F636057CD4E9497094E5DB6E5
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................21_......-.t.................21_......'..................33_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.192842095478311
Encrypted:	false
SSDEEP:	6:HUWx4D1wkn23oH+Tcwtfrzs52KLlVUW2VlL+q2Pwkn23oH+TcwtfrzAdIFUv:F3fYebs9LtvYfYeb9FUv
MD5:	316B47FF69A889B2ED10346808C18BB7
SHA1:	932CF32810E5D1B7624B8EA7317C2C6709D7E870
SHA-256:	AC8F1D1159E2C6A8C0F43DC0EDB443610CECA7B2915E0ED1F2C67A9270865C13
SHA-512:	051AFB1D8C8EE854222623F13F37C0A391977C9DC0887D80B9B933420978C0A3B1ED9ACDF7AE1811D7AD0B245EAEA192B879A9FA73414ABF57C712A3FC9E2FEC
Malicious:	false
Preview:	2024/11/13-03:53:33.077 1e58 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/11/13-03:53:33.167 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlHG/l:Ls3m/l
MD5:	3CD21635CA45790A4F5F1330AC622AA6
SHA1:	7A2E235C1F6912BF5C8BF4FBC3B0814A62C5F757
SHA-256:	7E4F3DCA7277969BF84995F6E5E4220D9D76603302DF8D1AF105E2299470D4B6
SHA-512:	D8DA5476985CB947FA766B1CB46ADFD0983F92CB2C13D8B6461636586CB8DE6373235A5D32880181DD108A5E6DFBB1CFB947C829F4DACA02AAC2455103B551AF
Malicious:	false
Preview:	..........................................w.]./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlHa+tl:Ls3ztl
MD5:	01E93CCF7EC97D8ED77269400B2A68B3
SHA1:	23010429647A4BB5E805B6C9D9CF5DE5BC934DE7
SHA-256:	70B54EF300543FBF0269CA7719AD3019BB3BDDB0C071313340CCAB51B93A4AE3
SHA-512:	8F6DBC24A71F7DEF68E425082593B29C47422DCB23BF75F1619B824640C845BE91DA9EAEA0EA8E1A26E164D6769F06BC30564D3C309058C035C832AB215A0B79
Malicious:	false
Preview:	.........................................}.]./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791646866248086
Encrypted:	false
SSDEEP:	96:iaqkHfV2qZn5ih/cI9URLl8RotopMFVvlwhCMe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIYweiRUqhC86qRAq1k8SPxVLZ7VTiq
MD5:	CA7BCA4C91BF17C0B45F745E70600B14
SHA1:	5846D3C92E49F0594ED6E2D04E34158C7215B21D
SHA-256:	7882C9A547DF6DA86E97F03B33A21B870F4759C721E89B9D1A1FCC45C9937EC1
SHA-512:	F23B25B86DC444A5771F7928942884B410F19D9F8829F0DFE08A786F8A7B5B6B6FB38EDED9E8ADD030710183A41CA4BA564B490DF267F17F9700651EDFF72C1F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1GEC8P84bQaiSJnQSZc6wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAJr0qZBbzi6FeYxde8XQM08u2eF35KMrqfGEJQ2GHy5QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF343d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791646866248086
Encrypted:	false
SSDEEP:	96:iaqkHfV2qZn5ih/cI9URLl8RotopMFVvlwhCMe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIYweiRUqhC86qRAq1k8SPxVLZ7VTiq
MD5:	CA7BCA4C91BF17C0B45F745E70600B14
SHA1:	5846D3C92E49F0594ED6E2D04E34158C7215B21D
SHA-256:	7882C9A547DF6DA86E97F03B33A21B870F4759C721E89B9D1A1FCC45C9937EC1
SHA-512:	F23B25B86DC444A5771F7928942884B410F19D9F8829F0DFE08A786F8A7B5B6B6FB38EDED9E8ADD030710183A41CA4BA564B490DF267F17F9700651EDFF72C1F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1GEC8P84bQaiSJnQSZc6wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAJr0qZBbzi6FeYxde8XQM08u2eF35KMrqfGEJQ2GHy5QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF343f0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791646866248086
Encrypted:	false
SSDEEP:	96:iaqkHfV2qZn5ih/cI9URLl8RotopMFVvlwhCMe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIYweiRUqhC86qRAq1k8SPxVLZ7VTiq
MD5:	CA7BCA4C91BF17C0B45F745E70600B14
SHA1:	5846D3C92E49F0594ED6E2D04E34158C7215B21D
SHA-256:	7882C9A547DF6DA86E97F03B33A21B870F4759C721E89B9D1A1FCC45C9937EC1
SHA-512:	F23B25B86DC444A5771F7928942884B410F19D9F8829F0DFE08A786F8A7B5B6B6FB38EDED9E8ADD030710183A41CA4BA564B490DF267F17F9700651EDFF72C1F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1GEC8P84bQaiSJnQSZc6wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAJr0qZBbzi6FeYxde8XQM08u2eF35KMrqfGEJQ2GHy5QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36b00.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791646866248086
Encrypted:	false
SSDEEP:	96:iaqkHfV2qZn5ih/cI9URLl8RotopMFVvlwhCMe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIYweiRUqhC86qRAq1k8SPxVLZ7VTiq
MD5:	CA7BCA4C91BF17C0B45F745E70600B14
SHA1:	5846D3C92E49F0594ED6E2D04E34158C7215B21D
SHA-256:	7882C9A547DF6DA86E97F03B33A21B870F4759C721E89B9D1A1FCC45C9937EC1
SHA-512:	F23B25B86DC444A5771F7928942884B410F19D9F8829F0DFE08A786F8A7B5B6B6FB38EDED9E8ADD030710183A41CA4BA564B490DF267F17F9700651EDFF72C1F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1GEC8P84bQaiSJnQSZc6wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAJr0qZBbzi6FeYxde8XQM08u2eF35KMrqfGEJQ2GHy5QAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlpil/l:Ls3Ul/l
MD5:	A742C622003457EDCD5214738AE4CB2D
SHA1:	FF4B94A95F4EDAE7E5556E84BC6C436A1D728372
SHA-256:	1BCCF2DD6F01FCC92C81FE9FDF85407DB353AAE3CE01455A0FFA725C34505A5D
SHA-512:	B961B3C22797108F9D05F301A79069F5336D9AA744BD3F0E7C085EFA39AA3498DA004BCC8ECC6F9154A307AE630AC8590C8FA9C303BA6ECE7839BDE85D28B577
Malicious:	false
Preview:	.........................................Mm.]./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.011854261814867
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUIfUTjbVn:YWLSGTt1o9LuLgfGBPAzkVj/T8lUIupn
MD5:	584CDD257CF4E4C8A9D2517FED6B205A
SHA1:	A02880B6C1D4F2180D6BE266EBF5DFAA455E2CE9
SHA-256:	E5BB7B16653E030524313A7DF83CB5664DA9E72E7FC642534AC1CA435FB142D9
SHA-512:	39B6E14273DFDD4CB2AD9B643E1C8EFE6540EA2075140625D8C9382BA95E332239E3E82FBD48CD53CC87CECBA26F3D744BDCBF61EDC0F2B7EB985B5229F740EC
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731588816488827}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.415446034314543
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQd:YQ3Kq9X0dMgAEwjj
MD5:	3FA87FFDBFD627F217A5F052D6D3A7AC
SHA1:	0746F46DE416E30212C78E240BF6B5352EE2EF9C
SHA-256:	7C782809649AE44D26AD9EC63F900A8B306E91ED01410EEDD6A9AB778770ED2B
SHA-512:	EDAEDD2E75B29829BE86D25CB0D894832FCA323FD12493133E9230007D3FA353F12F3DBC87DAD9FE2B86D0F26EC3814C9951975ADFF3421623C44642AA780894
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":14}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\df193bdf-fab3-4c58-9ec3-ec477c04e29e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22833
Entropy (8bit):	6.050638961683816
Encrypted:	false
SSDEEP:	384:8tMkaMJH2m8qVT8IeQ0I5t0b9lQg0wsNwhM1OC2z1IjlSSuQgdvM92aQxR:cMkbJrT8IeQcrQgx1GOC2z1IxuQL9c
MD5:	7E26C24D5227715BA9477D7DBFDAA8AD
SHA1:	36D83215851D954BE1DFDA02A26E437587AE405A
SHA-256:	97458E5FF6848CA9C39FACC7C9688938544FCC06F1240A93D6D48F28A45120C7
SHA-512:	77556A0B4F742FD0657684008F80A180E54C062E8E54752A7F65791F0AF8F1456B3606614BCC9FE0D2EA94D733C5A00736D372A7940C430A3CD97DD6062C560A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375961612905752","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ff63037b-fa95-4da1-a8d3-8dc7f63fd6b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8299
Entropy (8bit):	5.801578939762558
Encrypted:	false
SSDEEP:	192:fsNAIYMeiRUw6QClkCsVn6qRAq1k8SPxVLZ7VTiQ:fsNAwTDC2zd6q3QxVNZTiQ
MD5:	330C8A3DE1C529E698DB6F0ACA967EF8
SHA1:	9F58286E57C66121B9B7D0C5D59A21D04E420865
SHA-256:	EF9C34E0C6A77499204611EC1C2AC4EBC15191D603205FBE28797E49790852E7
SHA-512:	684121CD6521D0232A5CC0F5CC509238AB1E6C0C15029D092C2D48402D47097DE035BA58D86D071708B545BC32D4A2B650C7933B246D1579FE366B4F36D21D54
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8440019662439644
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxAzOxl9Il8uqqP+namNv3ZcR0LRAlUd1rc:mLzqYBOamNqRWAB
MD5:	153AA1A804C17EC15CF48D6862D9002B
SHA1:	2F96AC868A87AF7C61C180FD5277456844BDC462
SHA-256:	2A04736DCAB4A38A1DEFC07A5DBBAFAB63EB5161B10FA298A72791692F0C0D5F
SHA-512:	4EF9003F308D64EE2C108CB66C9377E78C7FAB8A049A1F32C154C215DCD083D10ABBB48CB3C2157C267DB4903791414B9EB6E6C61266E9CE6D6BACF5CC5740CD
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.K.M.V.5.7.E.1.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.R.h.A.v.D.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9986305231394974
Encrypted:	false
SSDEEP:	96:BYPSMjQAbgk5i3cRHVaMMSNVGOfu+rAJN:BortF5iwHIXIBuaSN
MD5:	714045DAD4A00B4E388B6AC980A13BF1
SHA1:	80C804F52C7597BFC513C9DB7F1EFC10A1BC702C
SHA-256:	D581909248A937D24AB118F66F4B2A73605FBDCAE8213935633AC337C9043290
SHA-512:	4099067939452C3324F9DC5E0CE785D7484B05D35C304EBF6C34E42CFFE03132D7C1747E7D9BF7DA557D4946290D4859199763CCE93D6316DB0D4BD97E7387B3
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".j.8.X.z.z.K.k.1.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.R.h.A.v.D.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.906391245714882
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x4xl9Il8uH3f0iczoavG+RR1pPDblDhEyDbgiAFjJ8d/vc:a6YB3f0YavG6VbfxbRApJ1
MD5:	237F8FC7BD6CD6EB7A0E68C78015A6EB
SHA1:	2CDD2C39B87F6F74F352760D18BCA760BEF22113
SHA-256:	5A04AE7CA7530D8E3B38790FB53A6EFFAE5F545E76966EE3B64098884367BCB6
SHA-512:	D30FB1B94AEF35F57A5CF95C4C7B8C384AADEB8B38949F5A5E1D446822D2121995EFDBA5FB9878F3ED8EBB7047B6F4382A935685C601C6281FD60DB0BFFEC896
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".w.B.g.O./.n.p.U.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.R.h.A.v.D.

C:\Users\user\AppData\Local\Programs\unrealgame\LICENSE.electron.txt

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Programs\unrealgame\LICENSES.chromium.html

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	8315859
Entropy (8bit):	4.706254155756507
Encrypted:	false
SSDEEP:	24576:dbTq6T06T5kJWSIRWnBIl70mfT76y6E65606F/HXpErpem:t4scj
MD5:	8303B3A19888F41062A614CD95B2E2D2
SHA1:	A112EE5559C27B01E3114CF10050531CAB3D98A6
SHA-256:	9C088CAAC76CF5BE69E0397D76FE9397017585CFFDBA327692FF1B3A6C00D68F
SHA-512:	281B2ECC99502A050EE69E31256DEC135E8CB877D1A6BA9F1C975FCFB11C062980EE6061D2368B62F91E392953AE6235DD726A9D98E6EFC1302F7ED713099179
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162117120
Entropy (8bit):	6.733463302285596
Encrypted:	false
SSDEEP:	1572864:gTmw0ciLNpDPuAvHxJLkY2O6Ea3f9kwZXeT6EivLp1vUAtdjtZn+f4FnIvGaC9dU:Tv6E70+Mk
MD5:	1D932D5598C44D2BA24C72C7F58D3F37
SHA1:	2724B9BC5A48DA781CFA5DAB2DD55AE128AD3C5C
SHA-256:	7F6C1FD9DF66629E5845465B61B9E13924448788C222E70551C14EE9C1EEBF35
SHA-512:	04A7BD5F09A3D6C41833CE0EB8C8CB8C64B9ACA64E193E0A81E8894103D69F0AA596108263C50ACA585AE62259DB1BDFE8695EA16F0A5A212AE210032F7FD889
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e..........".................P..........@..........................................`...........................................I.. ....M.h....... ....p...f@..........`........?.......................?.(... !..@.............M.......I......................text............................... ..`.rdata..h.n.......n.................@..@.data....TB...Q.......P.............@....pdata...f@..p...h@...X.............@..@.00cfg..0............ ..............@..@.gxfg...pA.......B..."..............@..@.retplne.....@.......d...................rodata......P.......f.............. ..`.tls.........p.......x..............@...CPADinfo8............\|..............@...LZMADEC..............~.............. ..`_RDATA..\...........................@..@malloc_h+........................... ..`.rsrc... ...........................@..@.reloc.......`......................@..B................

C:\Users\user\AppData\Local\Programs\unrealgame\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	127125
Entropy (8bit):	7.915612661029362
Encrypted:	false
SSDEEP:	3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
MD5:	ACD0FA0A90B43CD1C87A55A991B4FAC3
SHA1:	17B84E8D24DA12501105B87452F86BFA5F9B1B3C
SHA-256:	CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
SHA-512:	3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
Malicious:	false
Preview:	..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......

C:\Users\user\AppData\Local\Programs\unrealgame\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	177406
Entropy (8bit):	7.939611912805236
Encrypted:	false
SSDEEP:	3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
MD5:	4610337E3332B7E65B73A6EA738B47DF
SHA1:	8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
SHA-256:	C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
SHA-512:	039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
Malicious:	false
Preview:	..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~...R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q......................................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............

C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916712
Entropy (8bit):	6.398049523846958
Encrypted:	false
SSDEEP:	49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5:	2191E768CC2E19009DAD20DC999135A3
SHA1:	F49A46BA0E954E657AAED1C9019A53D194272B6A
SHA-256:	7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
SHA-512:	5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: malware-DONT-RUN.ps1, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2882560
Entropy (8bit):	6.699294130576871
Encrypted:	false
SSDEEP:	49152:WdTodIrn9wbFV6Ps2cA7SJ/W1C1fLPzhkE7hjU7gUxGJwDw3lCQTQY/N3lzl3heH:C79fe/CmP6w3lXQYef/3
MD5:	A007299C49FA50AEFF594655859780AE
SHA1:	D202F1F617023763A0E9418878E8ECAC96BE9FD4
SHA-256:	B78F0036621AD1D5833289F2AD509963EF78F1A89A3C7DF0F1370FD2D35A2804
SHA-512:	444C4BAA1E1D941BD04F78184CEC519C6EB53A83FBC3AA3EA30522BFFC9ECDE73EBE7B910C1A37C345429298ADA3C0FFCB3E3849E21B2009487B5CD1A02CB2A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ....."#..................................................@B...........`A..................................................(.............@...............B..3....).......................).(....R#.@............".P............................text....!#......"#................. ..`.rdata..D....@#......&#.............@..@.data...........".................@....pdata........@....................@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\unrealgame\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	10544880
Entropy (8bit):	6.276833777601164
Encrypted:	false
SSDEEP:	98304:GKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8j:GKPBhORjOhCliXUxiG9Ha93Whla6ZGr4
MD5:	2134E5DBC46FB1C46EAC0FE1AF710EC3
SHA1:	DBECF2D193AE575ABA4217194D4136BD9291D4DB
SHA-256:	EE3C8883EFFD90EDFB0FF5B758C560CBCA25D1598FCB55B80EF67E990DD19D41
SHA-512:	B9B50614D9BAEBF6378E5164D70BE7FE7EF3051CFFF38733FE3C7448C5DE292754BBBB8DA833E26115A185945BE419BE8DD1030FC230ED69F388479853BC0FCB
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@'..H..`.(..H...e).7H..0.).VH...).xH......H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	480768
Entropy (8bit):	6.335610382348666
Encrypted:	false
SSDEEP:	6144:afuE2DT96QHENooSYBjLkt4sasMHemPwlrX+nZiML7hn:afuE2DbkGoS2jLku/wWUiNn
MD5:	CA5BB0794B7700601E9438283D458665
SHA1:	7FCF090B19820B9450937BE800575C526448B581
SHA-256:	4A8BE3B4D9FE790EFDCE38CFF8F312A2F8276908D6703E0C6C37818E217CF1E3
SHA-512:	36EBAB858FE7E014837548575389E7DF2E86676888E4A9039C736D0F2E6463102E68989B794D949DDB16D9BCCE43CE55737FCF2A4B09B1667BF968A9540E9F32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ....."..........`.....................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....!.......".................. ..`.rdata......@.......&..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............<...................tls....!............>..............@..._RDATA..\............@..............@..@.rsrc...x............B..............@..@.reloc..0............H..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7626240
Entropy (8bit):	6.463446463154237
Encrypted:	false
SSDEEP:	98304:WJTPQhRQ4t2fzqJ3IZ155Rl5F/tpcAgsOMN:Wm2foIzRJosr
MD5:	05B585464F18FE0E3BDDB20527697D66
SHA1:	8BCEC2F0B409AFA9FF054E25F3CE85EB9BD50010
SHA-256:	0BB7C6C08B569C1D2DE90A40E6C142591E160A7C6CB15D21807F3404A48C4287
SHA-512:	F680AB9C3070F443C7359BB3F0C2032F5C58C88C7823E4592E8212CE8815EA5F463C86DF113F5320944C62D3CB4E8D45B9B4DCAADCCC1AC9BF203AE4BB52083C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ......Z......... .M......................................`u...........`A........................................M.k.8.....l.d....pt.......q.`O............t......wk......................uk.(.....Z.@.............l.....p.k.@....................text....Z.......Z................. ..`.rdata..$.....Z.......Z.............@..@.data.........m..\|....m.............@....pdata..`O....q..P....q.............@..@.00cfg..8.....t......Rs.............@..@.gxfg....+....t..,...Ts.............@..@.retplne.....@t.......s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\unrealgame\resources.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	5245561
Entropy (8bit):	7.99547773238381
Encrypted:	true
SSDEEP:	98304:9LYsbEcnNWz49PDq2Awkmqmcph1Dd42cjrwrbHw4o0DPelwG3RC:90WcMButpphpd4jkrU4oeelrRC
MD5:	31C7D4B11AD95DFE539DD098E0FAB736
SHA1:	5418682D939CE8485ECC9125B872C14FFEC662C2
SHA-256:	A251019EB08F1E695E935D224544BDA37C5AE092BA68A89FA1FE3BD19BDE4F5C
SHA-512:	F868A4AFA4E0D5C561873D2A728E267F98DA2DF3FB90966E5736D496B6A24E71769A02B0346B27B7DCCE11CBE07248E309F50A89977DC8E5BBC06D6CC31BF738
Malicious:	false
Preview:	............f.......P'....$.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5fJ...5.O...5.V...5.f...5.w...5.x...5.\|..n<(...x<....y<....z<....{<....\|<....<-....<t....<:....<1....<....V@....W@....X@z...Y@f...Z@....[@4...\@Q...]@....^@...._@jh..`@....<A ...=A.....P.~...Pg....PZ....P.....P.....Pv....P.....P5....Q.....QH....Q.....Q.....Q.....Q]....QC....Q.....Q.....QY....Q.....Qx....Q;!...Q.'...QH....Q.1..,Q.F..-QuL...QNN../Q.P..0Q.U..1Q0i..2Q.j..3Q.k..4QGm..5Q.o..6Q.r..7Q.t..8QGw..9Q#x..:Q.z..;Qj...<Q'...=Q~...>Q....?Q ....R....Rw....}.....}. ...}B`...}.a...}.h...}.i...}.j...}.o...}?....}{&...}(/...}.6...}.;...}i=...}.B...}.G...~vO...~>e...~wq...~_u...~.}...~.~..!~...."~....#~(...$~...&~ ...'~....(~$...)~Y...~.$..+~.5..,~_7..-~.8...~\|;../~.<..0~.=..1~.A..2~.I

C:\Users\user\AppData\Local\Programs\unrealgame\snapshot_blob.bin

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	273328
Entropy (8bit):	3.2521912102596153
Encrypted:	false
SSDEEP:	1536:HpeVehd7eASb6iAGm4hmWRSJTnBSki+TzUNp2Zg+TWJ0xEI2tWaw8MCZ72T04GO9:NdyNm4mWRSJTBSX4U1hJzbYB
MD5:	4EBD06BDF6CF8DACF6597586FD1704B5
SHA1:	E6819EF37F99F91468F4B94370A4AB467A075A6D
SHA-256:	148E4B85983F0D27ADECD9C6431B66379AC5538688F320E89D74FF6D48BB740B
SHA-512:	17ED5ABE702748B4626B3EE6DE4D0916738F095C913C2700EEE06B65A2BBCAF72AFC1F87AF7CE0FCCE8BD15FE6881508255D397A346C45A82C7791B9B9833DDF
Malicious:	false
Preview:	.........+.11.2.214.22-electron.0...........................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................

C:\Users\user\AppData\Local\Programs\unrealgame\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	588152
Entropy (8bit):	4.837375324466163
Encrypted:	false
SSDEEP:	6144:EFzofuYUahtcOm3A0Sg8zY6y4XrxXSIIBYgHi:6Mfu/f2Y6zrM9C7
MD5:	146E284750735EF4798527DC1CD0E741
SHA1:	6408985B7D05C768A62BCB912234F14E1898FFDB
SHA-256:	3820E8FA1077D02606FEA8E1B3A9CA4BF7F4A71D0569D9A8EA9EE7A009D0CE80
SHA-512:	46824DF5D20E02FB72C3EFD07BEE6D832B1AB78C0163688FA84EDB831CBFBEF2DDE12BA9DA01F9DD49C4008BD3862A95699A2F6D55B8D4B3165976D3851C7278
Malicious:	false
Preview:	........$c^X11.2.214.22-electron.0..........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................

C:\Users\user\AppData\Local\Programs\unrealgame\vk_swiftshader.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5334528
Entropy (8bit):	6.3349883465807055
Encrypted:	false
SSDEEP:	98304:5aTPSALpajr/PMMPTZTOWvYQ7klZz8Wd4iRk:Elajr/PMMPTZTOWvCJ4Z
MD5:	750CBDFB01943E28E08708183EC208B5
SHA1:	1BEE0CD3D0970834B2A47DAF384354F243FD1EE0
SHA-256:	A6D295DCC3AFCB55AA79EAC5F896BCEB15CCB2B798DB3BB076CEEEA78073791A
SHA-512:	DBFDF76F40558CE2F23CA315B8719E283F0F22F46E733F37C2AE237FDAFD23CF7962F36547BA1BB2D5B219DE11546C3DC06859FAC498A7DA97DF41018C0D80C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.P}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..P}...pR..~....P.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\unrealgame\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Programs\unrealgame\vulkan-1.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	928256
Entropy (8bit):	6.558001659108061
Encrypted:	false
SSDEEP:	24576:yGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7a:GwwvuziiV/iXxc6Z5WODYsHh6g3P0zAu
MD5:	6C70AAB071C4FEBC5921E0D39811937A
SHA1:	20D87B3A5333EA3F6D0D7B0333F2C30A281937AA
SHA-256:	2233FEF6788711089FC5C1A008BFFF6559CF2FC3E8363CD8A50196E90D1D9825
SHA-512:	7F786C44376B59BE7D7C51D3C40ECB80F30645551B582D042B641EA0A6464DAF367DDF7EAFAF00A1558E1F11570D99A699D33D224B01048D09F8F00EA501C4BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text...v~.......................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1bd4da8d-f36a-4f13-a1c0-aba9ad896553.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\4f0a42bb-d86e-444c-8773-2b3b8242b98f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\529dddfe-00fe-4c4f-bbf8-cbcfe5f3d926.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1717248
Entropy (8bit):	6.538491336907607
Encrypted:	false
SSDEEP:	24576:OEZW12n6pEWp9ql5068Tw/wtArUEnnBrKpneZTtX1Ky2IpDMXm:OMWp9ql/8k/MinnBGpSzlNDH
MD5:	31016F8CDD853E3AEDEED1090C2B8FED
SHA1:	632F26A63FD6D5E75516C84AB500623A275B9E76
SHA-256:	1A3968F0B0BB55709843FC9621C69CB578BEFD9FB4505DD003B1AED4451A0379
SHA-512:	9E0CB9B448CB5A36F7952BEF06CC54E434F1F206559B1AD2226B23515D316F05E728F9A8243F7A737DCFD0F647CD2C20A41550D1B8D5EEFEE240126C2DF3EFFF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............B..B..B..C..B..CZ..B..C...B.'.C..B.'.C..B.'.C.B..C..B..B...B.&.C..B.&BB..B.&.C..BRich..B........................PE..d.....3g.........." ...)............l]....................................................`.................................................P...(....`.......p...............p.. ... ...p........................... N..@...................d...@....................text...P........................... ..`.rdata...8.......:..................@..@.data....S.......<..................@....pdata.......p.......6..............@..@.rsrc........`......................@..@.reloc.. ....p....... ..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5999447d-fc8e-40d7-b3ca-dfeca4eb669f.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	140288
Entropy (8bit):	6.055411992765344
Encrypted:	false
SSDEEP:	3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
MD5:	04BFBFEC8DB966420FE4C7B85EBB506A
SHA1:	939BB742A354A92E1DCD3661A62D69E48030A335
SHA-256:	DA2172CE055FA47D6A0EA1C90654F530ABED33F69A74D52FAB06C4C7653B48FD
SHA-512:	4EA97A9A120ED5BEE8638E0A69561C2159FC3769062D7102167B0E92B4F1A5C002A761BD104282425F6CEE8D0E39DBE7E12AD4E4A38570C3F90F31B65072DD65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..............C.......C.....C................................"...C...............................................Rich............................PE..d....-!e.........." ...#.>..........XG....................................................`.............................................X.......<....`.......0..$............p..........p...............................@............P..........@....................text...`=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....pdata..$....0......................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\X7G8JQW9LFH3YD2KP6ZTQ4VMX5N8WB1RHFJQ.txt

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:eNKXBmLn:oKXsLn
MD5:	C4EFD9A7B61EBF43B608440BE5E33369
SHA1:	926418256C277F1B11B575EC6E92CE6A844612F7
SHA-256:	ED4280859199DA5A8F25C0C6D533D0873460AC63368C14A69BBD863EA4BFB30F
SHA-512:	9EA97363868D61D3D51BD3804D638B71BA8DC65260800B3A54051B4725CF08E9D9880A12422A549D94A339C7267E858A7FF5CA9428D64051657134B5C6C20745
Malicious:	false
Preview:	No passwords found.

C:\Users\user\AppData\Local\Temp\chrome_default_cookies.txt

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.101381529092886
Encrypted:	false
SSDEEP:	3:S/rG4qrFK3:S/rG4z3
MD5:	E90E9B350402FB53508BAB25E4B0CE46
SHA1:	653CEB716312AE286BE8804A95A101F70AF52DE3
SHA-256:	E7B12EC09E8B7E8786A7BF8BC3F159837D1E655E3660C5696E6E05AA3688D36C
SHA-512:	3BD4D592FA21CA48B03B2CF61763CE10AA90258F314A86D9CF1DEC17019CCAAD738E1F8FF7649360EA166925B1DDABE353E7DE66963D007F3069A6221A0B7452
Malicious:	false
Preview:	# Clean Cookies.# HEXON ON TOP!..

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.307734666035636
Encrypted:	false
SSDEEP:	6:YEbOMmMdmQGPEwL56s/ubOMmMbDVib3/QJjDrwv/ubOMmMEXS8P56s/C:YVSdmTPEwL56s/LSbDVibv0Dkv/LSEpe
MD5:	7992F84BD0786000BDCAFC7F2EDF2619
SHA1:	0C47FE1AB153812E2252975FB450F48FD7D8BCEA
SHA-256:	23DD650A10C2B56D8FFC8C7CF82C67AC18EAD69E387CAA31A3AA6595AAD0FAD4
SHA-512:	742689EEFF10DFCAF6925492DD2E37D8C9DC99FD3373CEAB263B0E4E7684309DEE807A411D2DDD360F5D30B3DFE71D4013C384D1283D77F098079D88EA455F32
Malicious:	false
Preview:	{"logTime": "1113/085336", "correlationVector":"ezGgGzyDn2TtclC73uqsRP","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1113/085336", "correlationVector":"129347B72A704499A9037BC394417305","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1113/085336", "correlationVector":"VtGnvanaK2Fhw8malthvST","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\LICENSE.electron.txt

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\LICENSES.chromium.html

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	8315859
Entropy (8bit):	4.706254155756507
Encrypted:	false
SSDEEP:	24576:dbTq6T06T5kJWSIRWnBIl70mfT76y6E65606F/HXpErpem:t4scj
MD5:	8303B3A19888F41062A614CD95B2E2D2
SHA1:	A112EE5559C27B01E3114CF10050531CAB3D98A6
SHA-256:	9C088CAAC76CF5BE69E0397D76FE9397017585CFFDBA327692FF1B3A6C00D68F
SHA-512:	281B2ECC99502A050EE69E31256DEC135E8CB877D1A6BA9F1C975FCFB11C062980EE6061D2368B62F91E392953AE6235DD726A9D98E6EFC1302F7ED713099179
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\Xeno Executor.exe

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162117120
Entropy (8bit):	6.733463302285596
Encrypted:	false
SSDEEP:	1572864:gTmw0ciLNpDPuAvHxJLkY2O6Ea3f9kwZXeT6EivLp1vUAtdjtZn+f4FnIvGaC9dU:Tv6E70+Mk
MD5:	1D932D5598C44D2BA24C72C7F58D3F37
SHA1:	2724B9BC5A48DA781CFA5DAB2DD55AE128AD3C5C
SHA-256:	7F6C1FD9DF66629E5845465B61B9E13924448788C222E70551C14EE9C1EEBF35
SHA-512:	04A7BD5F09A3D6C41833CE0EB8C8CB8C64B9ACA64E193E0A81E8894103D69F0AA596108263C50ACA585AE62259DB1BDFE8695EA16F0A5A212AE210032F7FD889
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e..........".................P..........@..........................................`...........................................I.. ....M.h....... ....p...f@..........`........?.......................?.(... !..@.............M.......I......................text............................... ..`.rdata..h.n.......n.................@..@.data....TB...Q.......P.............@....pdata...f@..p...h@...X.............@..@.00cfg..0............ ..............@..@.gxfg...pA.......B..."..............@..@.retplne.....@.......d...................rodata......P.......f.............. ..`.tls.........p.......x..............@...CPADinfo8............\|..............@...LZMADEC..............~.............. ..`_RDATA..\...........................@..@malloc_h+........................... ..`.rsrc... ...........................@..@.reloc.......`......................@..B................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	127125
Entropy (8bit):	7.915612661029362
Encrypted:	false
SSDEEP:	3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
MD5:	ACD0FA0A90B43CD1C87A55A991B4FAC3
SHA1:	17B84E8D24DA12501105B87452F86BFA5F9B1B3C
SHA-256:	CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
SHA-512:	3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
Malicious:	false
Preview:	..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	177406
Entropy (8bit):	7.939611912805236
Encrypted:	false
SSDEEP:	3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
MD5:	4610337E3332B7E65B73A6EA738B47DF
SHA1:	8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
SHA-256:	C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
SHA-512:	039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
Malicious:	false
Preview:	..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~...R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q......................................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916712
Entropy (8bit):	6.398049523846958
Encrypted:	false
SSDEEP:	49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5:	2191E768CC2E19009DAD20DC999135A3
SHA1:	F49A46BA0E954E657AAED1C9019A53D194272B6A
SHA-256:	7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
SHA-512:	5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2882560
Entropy (8bit):	6.699294130576871
Encrypted:	false
SSDEEP:	49152:WdTodIrn9wbFV6Ps2cA7SJ/W1C1fLPzhkE7hjU7gUxGJwDw3lCQTQY/N3lzl3heH:C79fe/CmP6w3lXQYef/3
MD5:	A007299C49FA50AEFF594655859780AE
SHA1:	D202F1F617023763A0E9418878E8ECAC96BE9FD4
SHA-256:	B78F0036621AD1D5833289F2AD509963EF78F1A89A3C7DF0F1370FD2D35A2804
SHA-512:	444C4BAA1E1D941BD04F78184CEC519C6EB53A83FBC3AA3EA30522BFFC9ECDE73EBE7B910C1A37C345429298ADA3C0FFCB3E3849E21B2009487B5CD1A02CB2A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ....."#..................................................@B...........`A..................................................(.............@...............B..3....).......................).(....R#.@............".P............................text....!#......"#................. ..`.rdata..D....@#......&#.............@..@.data...........".................@....pdata........@....................@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	10544880
Entropy (8bit):	6.276833777601164
Encrypted:	false
SSDEEP:	98304:GKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8j:GKPBhORjOhCliXUxiG9Ha93Whla6ZGr4
MD5:	2134E5DBC46FB1C46EAC0FE1AF710EC3
SHA1:	DBECF2D193AE575ABA4217194D4136BD9291D4DB
SHA-256:	EE3C8883EFFD90EDFB0FF5B758C560CBCA25D1598FCB55B80EF67E990DD19D41
SHA-512:	B9B50614D9BAEBF6378E5164D70BE7FE7EF3051CFFF38733FE3C7448C5DE292754BBBB8DA833E26115A185945BE419BE8DD1030FC230ED69F388479853BC0FCB
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@'..H..`.(..H...e).7H..0.).VH...).xH......H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	480768
Entropy (8bit):	6.335610382348666
Encrypted:	false
SSDEEP:	6144:afuE2DT96QHENooSYBjLkt4sasMHemPwlrX+nZiML7hn:afuE2DbkGoS2jLku/wWUiNn
MD5:	CA5BB0794B7700601E9438283D458665
SHA1:	7FCF090B19820B9450937BE800575C526448B581
SHA-256:	4A8BE3B4D9FE790EFDCE38CFF8F312A2F8276908D6703E0C6C37818E217CF1E3
SHA-512:	36EBAB858FE7E014837548575389E7DF2E86676888E4A9039C736D0F2E6463102E68989B794D949DDB16D9BCCE43CE55737FCF2A4B09B1667BF968A9540E9F32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ....."..........`.....................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....!.......".................. ..`.rdata......@.......&..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............<...................tls....!............>..............@..._RDATA..\............@..............@..@.rsrc...x............B..............@..@.reloc..0............H..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7626240
Entropy (8bit):	6.463446463154237
Encrypted:	false
SSDEEP:	98304:WJTPQhRQ4t2fzqJ3IZ155Rl5F/tpcAgsOMN:Wm2foIzRJosr
MD5:	05B585464F18FE0E3BDDB20527697D66
SHA1:	8BCEC2F0B409AFA9FF054E25F3CE85EB9BD50010
SHA-256:	0BB7C6C08B569C1D2DE90A40E6C142591E160A7C6CB15D21807F3404A48C4287
SHA-512:	F680AB9C3070F443C7359BB3F0C2032F5C58C88C7823E4592E8212CE8815EA5F463C86DF113F5320944C62D3CB4E8D45B9B4DCAADCCC1AC9BF203AE4BB52083C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ......Z......... .M......................................`u...........`A........................................M.k.8.....l.d....pt.......q.`O............t......wk......................uk.(.....Z.@.............l.....p.k.@....................text....Z.......Z................. ..`.rdata..$.....Z.......Z.............@..@.data.........m..\|....m.............@....pdata..`O....q..P....q.............@..@.00cfg..8.....t......Rs.............@..@.gxfg....+....t..,...Ts.............@..@.retplne.....@t.......s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\af.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	377708
Entropy (8bit):	5.4079285675542845
Encrypted:	false
SSDEEP:	6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
MD5:	7E51349EDC7E6AED122BFA00970FAB80
SHA1:	EB6DF68501ECCE2090E1AF5837B5F15AC3A775EB
SHA-256:	F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
SHA-512:	69DA19053EB95EEF7AB2A2D3F52CA765777BDF976E5862E8CEBBAA1D1CE84A7743F50695A3E82A296B2F610475ABB256844B6B9EB7A23A60B4A9FC4EAE40346D
Malicious:	false
Preview:	........E...h.....i.....j.....k.....l.....n."...o.'...p.4...r.:...s.K...t.T...v.i...w.v...y.\|...z.....\|.....}.....................................................................................-.....>.....E.....N.....g.....p.....{...................................................../.....?.....K.....X.....y...........................................................<.....R.....W.....].....l.....y.....}.....................................................+.....9.....A.....I.....P.....U.....c.....s...............................................%.....J.....d.....m.....y...........................................................+.....2.....5.....6.....B.....L.....V.....].....g.............................O.....^.....k.................................................................".....5.....Q.....z....................................... .....".....%.....(.$...*.D...+.G...,.e........./.....0.....1.....3.....4.....5.....6.D...7.U...8.j...9.y...<.....=.....>.....?.....@.....A.....C.$...D.+.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\am.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	613646
Entropy (8bit):	4.894866190630168
Encrypted:	false
SSDEEP:	12288:Jf6uKsr8xSTwVF/gsSP5R9F5AVqruvyP2x30jH8+I:Xr8xLVF4sSP5R9F5AVqWyPS
MD5:	C6EF9C40B48A069B70ED3335B52A9A9C
SHA1:	D4A5FB05C4B493ECBB6FC80689B955C30C5CBBB4
SHA-256:	73A1034BE12ABDA7401EB601819657CD7ADDF011BFD9CE39F115A442BCCBA995
SHA-512:	33C18B698040CD77162EB05658ECA82A08994455865B70D1C08819DFAC68F6DB6B27D7E818260CAA25310FF71CF128239A52C948FDE098E75D1A319F478A9854
Malicious:	false
Preview:	........W...h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...r.a...s.r...t.{...v.....w.....y.....z.....\|.....}.........................................................................7.....S.....i.........................................L.....k.....m.....q...................................1.....A.....`.............................".....4.....=.....\.....~...................................5.....Q.....W.....Z.....i.............................K.....z.....................................................8.....G.....`.............................".........................................>.....A.....s.............................@.....G.....J.....K.....W.....`.....\|.......................<............................./.....g.....w...............................................3.......................E.....j.....p.....x..................... .....".....%.6...(.c...*.....+.....,.........../.....0.....1.]...3.y...4.....5.....6.K...7.s...8.....9.....;.....<.....=.....>.?...?.I...@.i...A.....C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\ar.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	671212
Entropy (8bit):	4.903418230501937
Encrypted:	false
SSDEEP:	12288:2wnA/ktqm99pX8vYUxXrmhkH+95NNb++YTzgpPMgSENIg:XACPfuq5S+L
MD5:	56F6DC44CC50FC98314D0F88FCC2A962
SHA1:	B1740B05C66622B900E19E9F71E0FF1F3488A98E
SHA-256:	7018884D3C60A9C9D727B21545C7DBBCC7B57FA93A16FA97DECA0D35891E3465
SHA-512:	594E38739AF7351A6117B0659B15F4358BD363D42FFC19E9F5035B57E05E879170BBAFE51AECE62C13F2AE17C84EFB2AED2FC19D2EB9DCB95EBD34211D61674E
Malicious:	false
Preview:	........'...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.0...w.=...y.C...z.R...\|.X...}.j.....r.....w.................................................................!.....X.....h...................................!.....$.....(.....P.....r.........................................A.....W.....j...............................................i.....................................................).....K.....m.......................".....Y.....c.....k.....r...................................4.....g.......................#.....T.....e...............................................9.....O.....e...........................................................j.................1.....F.....b.............................+.....3.....?.....a....................... .....T............................................. .!...".>...%.r...(.....*.....+.....,.0.....G.../.x...0.....1.....3.....4.....5.&...6.....7.....8.....9.....;.....<.4...=.J...>.....?.....@.....A.....C.....D.....E.....F.Y.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\bg.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	701712
Entropy (8bit):	4.660949177773058
Encrypted:	false
SSDEEP:	12288:wQpKqVw2iILlY+dAs1aQUfjoaVV4FH2mFx0x35uKN3CuKb7szmV2Jfu64K+z5jSF:5pKqJi6lY+dAs1aQU7yCx35uK4XQzQIp
MD5:	945DE8A62865092B8100E93EA3E9828D
SHA1:	18D4C83510455CE12A6AC85F9F33AF46B0557E2E
SHA-256:	F0E39893A39CE6133C1B993F1792207830B8670A6EB3185B7E5826D50FEA7BA2
SHA-512:	5F61160FF64B9490A1AD5517D8C1BB81AF77D349541FED5045E7F6E5053B7D79B7E8F114630BFBE4D5AF30258F70A6569462BFA39CCB765F8CA191F82EE04F3F
Malicious:	false
Preview:	........P...h.....i.....j.....k.%...l.0...n.8...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....\|.....}.........................................................................F.....h...............................................[.........................................#.....Q.....x...................................[.........................................T...............................................'.....U......................./.....c...............................................>.....s.............................4.....^................. .....9.....V.....l...................................\...............................................&.....B.....S.....v...............................................O.....r...................................0.......................9.....z.......................-.....[............... .....".....%.....(.E...*.q...+.t...,.........../.....0.....1.....3.....4.....5.....6.....7.....8.....9.....;.3...<.G...=._...>.....?.....@.....A.....C.F.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\bn.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	904928
Entropy (8bit):	4.27317054663832
Encrypted:	false
SSDEEP:	3072:IGZVieUrnJssYEgp8S7cRySC/bYbkJBbdJ2DB5y0XlRr:7ZVlUrnzYEgp8S7cRySCDY0Bbd255lt
MD5:	8FEB4092426A0C2C167C0674114B014D
SHA1:	6FC9A1076723BFAF5301D8816543A05A82AD654D
SHA-256:	FB0656A687555801EDFB9442B9F3E7F2B009BE1126F901CF4DA82D67AC4AD954
SHA-512:	3DE40BDD18E9E7D3F2ECEEBF7C089E2250CE4D40412A18D718FACBA8F045E68B996978EF8B4D047B21D3424094056D16B5ABB81BD0507F446B805D6B889522A7
Malicious:	false
Preview:	........J...h.....i.....j.....k."...l.-...n.5...o.;...p.H...r.N...s._...t.h...v.}...w.....y.....z.....\|.....}.............................................................................................................5....._....................... .....".....&.....N.......................).....R.....n.......................F...................................K.....a...........3.....B.....].........................................?.....x.................@.......................................................................F....._.....q.................}.......................@.....e.............................1.....U.....y...............................................<...........h...................................4.....P.........................................e...........7.....s...........E...................................'... .<...".....%.....(.....*.K...,.N........./.....0.....1.O...3.o...4.....5.....6.....7.....8.4...9.S...;.....<.....=.....>.....?.$...@.Y...A.....C."...D.B.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\ca.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	426865
Entropy (8bit):	5.401183228931482
Encrypted:	false
SSDEEP:	12288:+S19cdrijIs3cSlFEYLCJBB43nbhjJSwmrwiwWzMw1dLbpuQ16BtryBBwIle3neq:t39V4GRsMNux1hnW5CptA
MD5:	01ACD6F7A4EA85D8E63099CE1262FBAD
SHA1:	F654870D442938385B99444C2CACD4D6B60D2A0D
SHA-256:	B48D1BAD676F2E718CBE548302127E0B3567913A2835522D6DD90279A6D2A56A
SHA-512:	2BD13ECA1A85C219E24A9DEB5B767FAA5DC7E6B3005D4EB772E3794233ED49CB94C4492538D18ACC98658C01D941E35C6F213C18AC5480DA151C7545EEDEB4AB
Malicious:	false
Preview:	........N...h.....i.....j.....k.!...l.,...n.4...o.9...p.F...r.L...s.]...t.f...v.{...w.....y.....z.....\|.....}...............................................................................6.....O.....o.....\|.....................................................2.....J.....j.....q...........................................................1.....;.....M.....].......................................................................D.....i.................................................................+.....2.....?.....u.........................................".....5.....F.....b.....e.....}.............................................................................&.....h......................./.....P.....s.....................................................4.....P.....\|...............................................:.....F... .Q...".g...%.....(.....*.....+.....,.........../.-...0.2...1.h...3.x...4.....5.....6.....7.....8.....9.(...;.6...<.D...=.R...>.l...?.v...@.....A.....C.....D.....E...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\cs.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	436203
Entropy (8bit):	5.843605854598268
Encrypted:	false
SSDEEP:	6144:U4Wm4h8qE2jv7SxUjBA59wjR558YAGKND9Gto8QV:U4WlvE2jjSxqywjR558YAbNDcI
MD5:	A934431D469D19A274243F88BB5AC6FB
SHA1:	146845EDC7442BF8641BC8B6C1A7E2C021FB01EB
SHA-256:	51C36A5ACDAD5930D8D4F1285315E66B2578F27534D37CD40F0625EE99852C51
SHA-512:	562F07151E5392CBFFB6B643C097A08045E9550E56712975D453A2EBAEE0745FBFBA99D69867EEC560D1D58B58DFF4F6035811B9D4F0B1B87547EFA98F94D55D
Malicious:	false
Preview:	......../...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...\|.e...}.w.........................................................................................#.....,.....9.....V.....d.........................................!.....?.....L.....X.....d.....o.....................................................".....4.....E.....{.......................................................................8.....O.....d.....{.................................................................H.....Z.....h.....................................................9.....<.....J.....X.....h.....w.................................................................!.....p.......................".....>.....s.....................................................&.....N.....n.........................................+.....5... .=...".N...%.u...(.....*.....+.....,.........../.....0.....1.H...3.V...4.s...5.....6.....7.....8.....9.....<."...=.,...>.A...?.I...@.[...A.....C.....D...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\da.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	396425
Entropy (8bit):	5.453683242581375
Encrypted:	false
SSDEEP:	6144:HWjRHz8SRl8o4mmwlGXaJwZnBEb1INv65h5aarXyzOeiphd4CTWwG:H+AoROBE55frxTe
MD5:	BB5252DC6F0F3C01CE3638138BF946C8
SHA1:	BFB584B67C8CA51D94BFF40809410553D54DA1CF
SHA-256:	C93F39D0AB9A2FAB26977AA729261633225879BA6DC5EA8D0CA89814B2DF9FA9
SHA-512:	E411FD3CC5285A6059C3FD80C3421253A4CE06B2D0CD1CD1EFC25E88191A58FED176452D852922137268BE2824E1E162CD4D4A6F8C695A50517A783D15B1C6E7
Malicious:	false
Preview:	........]...h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...r.s...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................C.....Q.....a.....u.....}.....................................................#.....8.....O.....V.....a.....q.....x...........................................................9.....J.....y.......................................................................#.....=.....X.....q.....{.....~.................................................................3.....I.....o............................................................................./.....6.....9.....:.....A.....J.....P.....W.....b.......................!.....\.....r................................................................. .....J....._................................................... .....".....%.0...(.X...*.....+.....,.........../.....0.....1.....3.....4.)...5.A...6.s...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.)...C.F...D.P.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\de.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	424275
Entropy (8bit):	5.503242835637318
Encrypted:	false
SSDEEP:	6144:Vn8S0lko9kj+QrKJgWqajUzUd8YI3iSEmhqYf51gHN8OIkCJD:V5oGyQWJgTaKcSEi5h9kCJD
MD5:	ED329B35D10E81F55D611FE8748876F8
SHA1:	0D998732BB4C4D1FAAD5A5BC0A21D6C5672418D3
SHA-256:	6FACD562ADD58C4684EF4A40DE9B63581FEA71C5B83049ED8A2C2A2C929C45CE
SHA-512:	BD713FF78E375FEC3A04AB0C9476C0379F87EFC6D18359C2A4D297303D78381081120C371848C8675F1F16DD4AB7284D81E5BFC9AE11AB33E12F96C12D89E764
Malicious:	false
Preview:	............h.R...i.c...j.o...k.~...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P........................................................... .....6.....8.....<.....d.....y.....................................................).....M.....`.....f.....o...............................................0.....G.....K.....N.....W.....p...................................@.....M.....W....._.....f.....l.....y...............................................,.....`.................................................................2.....K.....e.....l.....o.....p.....z...................................9...................................2.....;.....M.....W.....d.....i.....n...................................$.....U.....q.....w........................... .....".....%.....(.....*.+...+.....,.L.....].../.s...0.{...1.....3.....4.....5.....6.=...7.Q...8.e...9.s...;.....<.....=.....>.....?.....@.....A.....C.....D.!.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\el.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	769054
Entropy (8bit):	4.751354951226556
Encrypted:	false
SSDEEP:	12288:H/58iMx4BquNw2202pgtZSWjZ4LIbsJvaP5A3HKQiEQBR07391qf2utKMaBlS9Wb:Hgx4BquNw2202pgtsWjyLrJvaRA3Htic
MD5:	6922AAA87431699787C1489E89AF17B9
SHA1:	6FB7771C9271CA2EEEBE025A171BFA62DB3527F7
SHA-256:	800545F9134914649DA91B90E7DF65D8208014C3E12F2BE551DFD6722BF84719
SHA-512:	367EF8467631E17E0A71D682F5792A499E8578B6C22AF93D9A919D9E78709EC2501DF9599624F013B43F4C3E9FB825182193116DBEAD01874995D322B7A6E4D6
Malicious:	false
Preview:	........M...h.....i.....j.....k.....l.(...n.0...o.5...p.B...r.H...s.Y...t.b...v.w...w.....y.....z.....\|.....}.........................................................................P.....w.............................B.....N.....Z...................................+.....x...................................h.....y.............................&.....C.....a.................,.....4.....H.....o...................................!.....M.................8...............................................1....._.....w.................!.....2.....q.................J.....a.........................................,.....O.....\|.........................................!.....3.....F.....^.......................,.................<.............................(.....;.....I.......................M.................T.................................../... .B...".e...%.....(.....*.7...+.:...,.X........./.....0.....1.m...3.....4.....5.#...6.....7.....8.....9. ...;.a...<.w...=.....>.....?.....@.....A.B...C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\en-GB.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	344608
Entropy (8bit):	5.516692483052514
Encrypted:	false
SSDEEP:	6144:8esz1VquAhWG5J8C4MP9egFXwqfaYnT9Xa5alSeBNeg:8rz1sNZr4M1XwWT05YSxg
MD5:	0DB7F3A3BA228AA7F2457DB1AA58D002
SHA1:	BBF3469CAADFA3D2469DD7E0809352EF21A7476D
SHA-256:	CF5ACA381C888DE8AA6BBD1DCD609E389833CB5AF3F4E8AF5281FFD70CD65D98
SHA-512:	9C46C8D12579BD8C0BE230BBCDB31BDB537D2FEA38000CF700547CA59E3139C18CC7CB3E74053475605132404C4C4591F651D2DAD2CE7F413CCFFD6ACF7139E8
Malicious:	false
Preview:	..........h.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...\|.e...}.w...........................................................................................................3.....;.....E.....c.....t.....v.....z...........................................................+.....:.....T.....g.....k.....q...................................................................................,.....:.....S.....h.....{.......................................................................+.....5.....A.....X.....h.................................................................(.....=.....R.....f.....m.....p.....q.....x..................................................... .....P.....].....h.......................................................................-.....D.....l....................................... .....".....%.....(.....*.....+.....,./.....@.../.N...0.W...1.....3.....4.....5.....6.....7.....8.....9.(...;.9...<.A...=.L...>.a...?.i...@.x...A...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\en-US.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	347111
Entropy (8bit):	5.508989875739037
Encrypted:	false
SSDEEP:	6144:xiLqIY2MuZYLMMP9ecGmM8faYdY4K55TiSbn8vMwS:xiLqIp34MM+mM0Y55eSKMwS
MD5:	5E3813E616A101E4A169B05F40879A62
SHA1:	615E4D94F69625DDA81DFAEC7F14E9EE320A2884
SHA-256:	4D207C5C202C19C4DACA3FDDB2AE4F747F943A8FAF86A947EEF580E2F2AEE687
SHA-512:	764A271A9CFB674CCE41EE7AED0AD75F640CE869EFD3C865D1B2D046C9638F4E8D9863A386EBA098F5DCEDD20EA98BAD8BCA158B68EB4BDD606D683F31227594
Malicious:	false
Preview:	..........:.h.....i.....j....k.9...l.D...n.L...o.Q...p.^...r.d...s.u...t.~...v.....w.....y.....z.....\|.....}.........................................................................6.....C.....R.....b.....i.....r.................................................................#...........>.....E.....Q.....l.....~.................................................................2.....:.....F.....S.....W.....Z.....`.....p...................................................................................:.....A.....P...........................................................'.....5.....H.....K.....\.....l.....\|...................................................................................E.....m.....t.......................................................................0.....I.....m......................................................... .....".....%.3...(.J....c...+.f...,.........../.....0.....1.....3.....4.....5.....6.J...7.Z...8.o...9.\|...;.....<.....=.....>.....?.....@.....A...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\es-419.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	421247
Entropy (8bit):	5.378825024438884
Encrypted:	false
SSDEEP:	3072:EqEmmoO5Tkz+v9zjzVdY/tIyN9d8pizkGp2Ioiw5QbdOXV5blUB0GLF90RRIHKx1:EqFmoY9rYChpWq95wLF90oSdc4
MD5:	5321C1E88C5C6FA20BDBC16043C6D0F6
SHA1:	07B35ED8F22EDC77E543F28D36C5E4789E7723F4
SHA-256:	F7CAA691599C852AFB6C2D7B8921E6165418CC4B20D4211A92F69C877DA54592
SHA-512:	121B3547A8AF9E7360774C1BD6850755B849E3F2E2E10287C612CF88FB096EB4CF4EE56B428BA67AEB185F0CB08D34D4FA987C4B0797436EEA53F64358D2B989
Malicious:	false
Preview:	........c...h.(...i.1...j.=...k.L...l.W...n._...o.d...p.q...r.w...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................D.....V.....e.....z...........................................................0.....K.....e.....m.....{...............................................".....'...../.....A.....e.....v...........................................................4.....O.....f...............................................%.....8.....G.....Y.....q.....y...................................!.....D.....P.....c.....o...........................................................&.....)..........3.....<.....E.....L.....].................4.....<.........................................-.....8.....A.....F....._...................................B.....[.....a.....i.....w............... .....".....%.....(..........+. ...,.>.....d.../.....0.....1.....3.....4.....5.....6.]...7.o...8.....9.....;.....<.....=.....>.....?.....@.....A.3...C.Z...D.d.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\es.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	421381
Entropy (8bit):	5.350071187715506
Encrypted:	false
SSDEEP:	6144:LulovTVU/dglXU0+/oIgAClpG+v6Idj+I5Orj7FQoheL66PZqS:LbvTwdglCTupXv6gj+I5OrmohEGS
MD5:	E9FA4CADA447B507878A568F82266353
SHA1:	4A38F9D11E12376E4D13E1EE8C4E0D082D545701
SHA-256:	186C596D8555F8DB77B3495B7AD6B7AF616185CA6C74E5DFB6C39F368E3A12A4
SHA-512:	1E8F97FF3DAAD3D70C992F332D007F3DDB16206E2FF4CFFD3F2C5099DA92A7AD6FB122B48796F5758FE334D9FBF0BBAE5C552414DEBBB60FE5854AAA922E206E
Malicious:	false
Preview:	........Y...h.....i.....j.(...k.7...l.B...n.J...o.O...p.\...r.b...s.s...t.\|...v.....w.....y.....z.....\|.....}.........................................................................8.....K.....[.....p.....~.....................................................&.....E....._.....g.....u...........................................................'.....9.....L.....].................................................................1.....Q.....{.....................................................+.....<.....T.....\.....m...................................3.....>.....H.....T.....f.............................................................................%...........5.....F.................1.....9.........................................).....4.....@.....E.....]...................................,.....E.....K.....S.....a............... .....".....%.....(.....*.....+.....,.'.....A.../.[...0.b...1.....3.....4.....5.....6.4...7.E...8.Z...9.l...;.}...<.....=.....>.....?.....@.....A.....C./...D.9.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\et.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	380687
Entropy (8bit):	5.464870724176939
Encrypted:	false
SSDEEP:	6144:2Mg++J/xRN0JLnrC4HFJbT/RauiQ/G5LjR43f7LQkPQW:2MmJnq7DG5LjQ
MD5:	A94E1775F91EA8622F82AE5AB5BA6765
SHA1:	FF17ACCDD83AC7FCC630E9141E9114DA7DE16FDB
SHA-256:	1606B94AEF97047863481928624214B7E0EC2F1E34EC48A117965B928E009163
SHA-512:	A2575D2BD50494310E8EF9C77D6C1749420DFBE17A91D724984DF025C47601976AF7D971ECAE988C99723D53F240E1A6B3B7650A17F3B845E3DAEEFAAF9FE9B9
Malicious:	false
Preview:	........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....:.....l.....\|...............................................,.....B.....D.....H.....p.................................................................5.....B.....H.....P.....^.....m.....v.......................................................................-.....F.....Z.....o.......................................................................0.....=.....W.....e.................................................................-.....B.....V.....m.....t.....w.....x...............................................U.....[...............................................$.....).....,.....<.....b.....x.........................................$.....6.....O.....Z... .d...".w...%.....(.....*.....+.....,....... .../.8...0.E...1.n...3.y...4.....5.....6.....7.....8.....9.+...;.>...<.K...=.T...>.g...?.o...@.~...A.....C.....D...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\fa.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	622224
Entropy (8bit):	5.029280630090111
Encrypted:	false
SSDEEP:	12288:jje/X9nuyaXgfwHawNUWGOGfStQEvy1zeItDmNtua/1wMTAKzIxRAQiHedNu36XH:mxuyaXgfw6wNUWGOGfStQEvy1zeItDm8
MD5:	DCD3B982A52CDF8510A54830F270E391
SHA1:	3E0802460950512B98CD124FF9F1F53827E3437E
SHA-256:	E70DFA2D5F61AFE202778A3FAF5ED92B8D162C62525DB79D4EC82003D8773FA3
SHA-512:	3D5B7FA1A685FA623EC7183C393E50007912872E22CA37FDC094BADAEFDDEAC018CC043640814A4DF21BB429741DD295AA8719686461AFA362E130B8E1441A12
Malicious:	false
Preview:	............h.\|...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.$...}.6.....>.....C.....K.....S.....[.....b.....i.....p.....r.....w...................................7....._.....m.....w............................. .....C.....r.....x...................................G.....b.........................................V.....{.....................................................:.....Y.......................-.....H.....P.....X....._.....i.....z.............................-.....D.....a.............................5.....D.....^.....t........................................./.....L.....S.....V.....g.....x.....................................................u.............................1.....9.....L.....X.....d.......................&.....L.....y...................................I.....\... .o...".....%.....(.........+.-...,.K.....o.../.....0.....1.....3.....4.-...5.a...6.....7.....8.0...9.I...;.Y...<.k...=.....>.....?.....@.....A.....C.X...D.....E...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\fi.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	389054
Entropy (8bit):	5.4272126333674695
Encrypted:	false
SSDEEP:	6144:7Ji6mI/BcM0ohFpxGseSFOE/xaWEkLl5W5ucHiEi18OWUcrOShPGNgX1wA2:7Ji9CBPbpxaS5W5xHiEi18OWUs/2
MD5:	5518B51D4AF7F1B9D686CBEA28B69E71
SHA1:	DF7F70846F059826C792A831E32247B2294C8E52
SHA-256:	8FF1B08727C884D6B7B6C8B0A0B176706109AE7FE06323895E35325742FE5BD1
SHA-512:	B573050585C5E89A65FC45000F48A0F6AABCCD2937F33A0B3FCBD8A8C817BEAA2158F62A83C2CAE6FCFB655F4A4F9A0C2F6505B41A90BC9D8EDE74141EBC3266
Malicious:	false
Preview:	............h.~...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.&...\|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z...........................................................".....].....v.....x.....\|.....................................................5.....C.....P.....d.....t.....z.....~..................................................... ..........0.....O.....h.....~...........................................................$.....1.....F.....L.....T.....................................................+.....<.....M.....P.....^.....p.............................................................................7..................................=.....f.....u...........................................................3.....V............................................. .....".....%.....(.1...*.Q...+.T...,.r........./.....0.....1.....3.....4.....5.4...6.n...7.....8.....9.....;.....<.....=.....>.....?.!...@.@...A.x...C.....D.....E...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\fil.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	438088
Entropy (8bit):	5.195613019166525
Encrypted:	false
SSDEEP:	6144:2zHaVyEDQV5aZrU+5xeuhGjZ3ZmA58Pm+7JATvy8:2zNMdU4XA5Imb
MD5:	3165351C55E3408EAA7B661FA9DC8924
SHA1:	181BEE2A96D2F43D740B865F7E39A1BA06E2CA2B
SHA-256:	2630A9D5912C8EF023154C6A6FB5C56FAF610E1E960AF66ABEF533AF19B90CAA
SHA-512:	3B1944EA3CFCBE98D4CE390EA3A8FF1F6730EB8054E282869308EFE91A9DDCD118290568C1FC83BD80E8951C4E70A451E984C27B400F2BDE8053EA25B9620655
Malicious:	false
Preview:	..........].h.....i.....j.....k.....l.....n.....o.....p.&...r.,...s.=...t.F...v.[...w.h...y.n...z.}...\|.....}...........................................................................................5.....<.....E.....d.....l.....y...................................................../.....E.....O.....^.....................................................".....8.......................................................................%.....J.....d.....~.................................................................+.....h.....q.....}...................................&.....4.....I.....o.....r................................................................. ..........5.....>.....O.................(.....0.................................................................,.....R.....l.............................6.....=.....H.....Y............... .....".....%.....(..........+.....,.*.....B.../.W...0.`...1.....3.....4.....5.....6.....7.3...8.O...9.d...;.}...<.....=.....>.....?.....@.....A...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\fr.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	455097
Entropy (8bit):	5.3846988377077745
Encrypted:	false
SSDEEP:	12288:FaQ6+Dt6QuagV1Zz+zApZ4MYnYMArDBW5Mx0q20wC7KZL3wyLkCMg1fF5FEs6rYX:B6+cV37a5JB
MD5:	0445700799DE14382201F2B8B840C639
SHA1:	B2D2A03A981E6FF5B45BB29A594739B836F5518D
SHA-256:	9A57603F33CC1BE68973BDD2022B00D9D547727D2D4DC15E91CC05EBC7730965
SHA-512:	423F941EC35126A2015C5BB3BF963C8B4C71BE5EDFB6FC9765764409A562E028C91C952DA9BE8F250B25C82E8FACEC5CADA6A4AE1495479D6B6342A0AF9DDA5F
Malicious:	false
Preview:	........@...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....\|.....}.....................................................................................#.....5.....@.....I.....k.....w.....................................................!...../.....@.....M.....[...............................................&.....2.....n.......................................................................0.....Q.....t.......................................................................X.....f.....p..................................."...../.....>.....V.....Y.....p..................................................................................._.......................(.....=.....R...........................................................".....\.........................................(.....I.....S... ._...".x...%.....(.....*.....+.....,.........../.'...0.5...1.r...3.....4.....5.....6.....7. ...8.8...9.N...;.a...<.o...=.....>.....?.....@.....A.....C.,...D.>.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\gu.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	879149
Entropy (8bit):	4.32399215971305
Encrypted:	false
SSDEEP:	3072:Xz2UMY57hmdUoITsKMaWZKerbtsMhmksd4M+0+z20QmuOAl5VpvoxWnhygfZw/gQ:D2UMY57h9w4MSbsp5cLhdKE8
MD5:	7B5F52F72D3A93F76337D5CF3168EBD1
SHA1:	00D444B5A7F73F566E98ABADF867E6BB27433091
SHA-256:	798EA5D88A57D1D78FA518BF35C5098CBEB1453D2CB02EF98CD26CF85D927707
SHA-512:	10C6F4FAAB8CCB930228C1D9302472D0752BE19AF068EC5917249675B40F22AB24C3E29EC3264062826113B966C401046CFF70D91E7E05D8AADCC0B4E07FEC9B
Malicious:	false
Preview:	........N...h.....i.....j.$...k.3...l.>...n.F...o.K...p.X...r.^...s.o...t.x...v.....w.....y.....z.....\|.....}.............................................................................................................T.....l.................'.....).....5.....].......................4.....S.....i.............................l.................................................................'.....k.....t.....w.............................a.................;.....[.....n.....v.....}.......................+.....:.....f.......................X.....y...........].....s...................................6.....X.....w...............................................-.....L.....c....................... .....B.................Q.............................3.....?.....K.....}...................................o.............................3.....[... .a...".....%.....(.....*.g...+.j...,.........../.....0.....1.~...3.....4.....5.....6.[...7.....8.....9.....;.Q...<.h...=.....>.....?.....@.....A.D...C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\he.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	544212
Entropy (8bit):	4.626369079921645
Encrypted:	false
SSDEEP:	12288:EQ+K7r0rkgrlOUmTU2/C9iyBZ60DAf1X2VeQCap4M52QoLpMzu5tlmd9DnwWHQgZ:/+55Voi
MD5:	93D9261F91BCD80D7F33F87BAD35DDA4
SHA1:	A498434FD2339C5D6465A28D8BABB80607DB1B65
SHA-256:	31661709AB05E2C392A7FAEED5E863B718F6A5713D0D4BBDAB28BC5FB6565458
SHA-512:	F213FF20E45F260174CAA21EAE5A58E73777CD94E4D929326DEEFBEF01759D0200B2A14F427BE1BB270DFCD2C6FB2FCE789E60F668AC89ECF1849D7575302725
Malicious:	false
Preview:	...........h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.'...v.<...w.I...y.O...z.^...\|.d...}.v.....~.............................................................................4.....M.....`.....y.....................................................6.....Q.....h.....{.............................'.....<.....a.....t.....\|...................................;.....C.....M.....i...............................................E.....o...............................................".....>.....f.....p...................................4.........................................#.....&.....9.....P.....c.....{.................................................................a...........1.....;.............................$.....<.....B.....N....._.....g.............................&.....a.........................................!... .3...".N...%.....(..........+.....,.........../.....0.....1.Y...3.n...4.....5.....6.....7.....8.3...9.G...;.\...<.v...=.....>.....?.....@.....A.D...C.w.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\hi.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	921629
Entropy (8bit):	4.309424818801467
Encrypted:	false
SSDEEP:	3072:L+UfSs6ZQZmi1jk34lFOwG8bkFSvf4QAEm5dmGhsYK/GR3TX4kNMdpqdYnLsuFQ8:CUfSsDmilN6O5H5NJ6K
MD5:	B7E4892B2030E4F916364856B6CC470A
SHA1:	B08AD51E98E3B6949F61F0B9251F7281818CD23E
SHA-256:	093119A99F008AB15D0E5B34CD16EC6B4313554E6C3CFFE44502BFCE51470E3E
SHA-512:	CA453025D73228592A4BFE747A3EA08B86327F733032A64CED0FC0C9E2E00B02450F133E691B94BE13A3E69E22B43BCA512E5F77B0E490320F0BF8E65571BB46
Malicious:	false
Preview:	........ ...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w.....................................................2.....T.....y.............................".....<...................................).....W.....}..............................................+.....W.....g.....}.............................................../.....k.....t.....w.......................>.................&.....l...............................................\.....n.................7.....T...............................................$.....n.....q............................./.....b.....i.....l.....n.........................................R...................................Z.....z...................................5.................q.................\...................................0... .K...".k...%.....(......2...+.5...,.S........./.....0.....1.p...3.....4.....5.....6._...7.....8.....9.....;.^...<.r...=.....>.....?.....@.....A.;...C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\hr.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	423481
Entropy (8bit):	5.516218200944141
Encrypted:	false
SSDEEP:	3072:yL0fCmEZW/FhjNmvgVRTKBOS+/6ocIG0uPXuyAF6Wk6DkYAiKbeM/ogQbn7xjemW:QYCmNLjN31V5v5tE77ORS
MD5:	105472BC766A30BB71F13D86081DE68D
SHA1:	D014103AD930889239EFD92ECFDFCC669312AF6C
SHA-256:	A3A853A049735C7D474191DFF19550A15503ECD20BAFE44938EB12EA60E50B7C
SHA-512:	EE7479D459EFF8EC59206C2269DF4E9FC1CA143E9B94A908EB8A5A1E16180BCC88F0B24D73C387F5853EA0418E737641F23146676232C1A3AC794611F7880F11
Malicious:	false
Preview:	........h...h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................%.....,.....-...........0.....Y.....e.....q.................................................................A.....T.....p.....x..........................................................."..........8.....G.....X.............................................................................%.....B.....c.......................................................................G.....U.....a.....w.............................................../.....2.....B.....S.....f.....\|.................................................................(.....g.............................8.....l.....{.....................................................I.....h................................................... .....".0...%.U...(.r........+.....,.........../.....0.....1.....3.)...4.F...5.d...6.....7.....8.....9.....;.....<.....=.....>.4...?.=...@.N...A.....C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\hu.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	456792
Entropy (8bit):	5.643747395444093
Encrypted:	false
SSDEEP:	6144:SGudNK66hRyoSSfLOAYXky1MV5QgsZfGRAxY62E9PSam7EEOEeLvx5gR4RStG2rA:pkP6hRyosAhV5QgsiE4747vx5VL/
MD5:	B338DCB0E672FB7B2910CE2F561A8E38
SHA1:	CF18C82EC89F52753F7258CDB01203FBC49BED99
SHA-256:	BCDF39AA7004984CB6C13AAC655B2E43EFEB387CE7D61964B063D6CF37773F7A
SHA-512:	F95F6A8E36D99680FB3CDB439F09439782BCC325923EC54BDC4AEB8EC85CF31A3A2216E40E2B06C73A2F5E7439D8178D8BECAC72781A6D79808067E8CCF3CAC6
Malicious:	false
Preview:	........6...h.....i.....j.....k.....l.....n.....o.....p.....r.#...s.4...t.=...v.R...w._...y.e...z.t...\|.z...}.....................................................................................2.....G.....W.....q.....................................................9.....X.....d.....}...............................................0.....5.....;.....N.....^.....s.....................................................-.....G.....d.....z.......................#.....?.....H.....P.....W.....].....l...............................................(.....Q.....x...........................................................;.....`.....u.....\|...............................................1.......................b.....w...........................................................K.....l.......................5.....L.....T....._.....w............... .....".....%.....(.....*.8...+.;...,.Y.....j.../.....0.....1.....3.....4.....5.....6.P...7.k...8.....9.....;.....<.....=.....>.....?.....@.....A.0...C.U...D.b.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\id.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	373931
Entropy (8bit):	5.37912097047996
Encrypted:	false
SSDEEP:	6144:5ig8kAijuuv1p4UVWfjDVnjHFsRmP28Jvr5PdhpvtEHSVsEaOq:TfjuCpRgVnjHFCm+8dr5Pdhlq
MD5:	BD9636E9C7DC7BE4C7F53FB0B886BE04
SHA1:	55421D0E8EFCBEF8C3B72E00A623FB65D33C953E
SHA-256:	5761EE7DA9CA163E86E2023829D377A48AF6F59C27F07E820731192051343F40
SHA-512:	7C7E88FFD2B748E93122585B95850DED580E1136DB39386CED9F4DB0090E71394A1F9CEB937262C95969132C26BF6CE1684FBB97B6469ED10414171A2E8CC3A4
Malicious:	false
Preview:	........?...h.....i.....j.....k.....l.....n.....o.$...p.1...r.7...s.H...t.Q...v.f...w.s...y.y...z.....\|.....}...........................................................................................,.....3.....;.....R.....Y.....c.....~......................................................................H.....Y.....f.......................................................................,.....9.....=.....@.....E.....Y.....h.....\|.................................................................(.....D.....J....._.........................................4.....F.....O.....Z.....p...............................................................................................%.....1....._.........................................A.....K.....W.....^.....f.....m.....t.........................................<.....O.....T.....Z.....g............... .....".....%.....(..........+.....,.!.....1.../.@...0.D...1.x...3.....4.....5.....6.....7.....8.....9.%...;.3...<.<...=.I...>.^...?.f...@.w...A...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\it.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	414290
Entropy (8bit):	5.287464735635254
Encrypted:	false
SSDEEP:	6144:9ErNnm7VCctogSrqRrhsO1gRT9TeexAGT96+q2tKLV9fLwUQ2KKU3I8HrmwGWNBJ:eGVi3ZPS8KN1Lj+w5ZzoB
MD5:	7C981A25BE0E02FBA150E17D9669A536
SHA1:	3AF10FEB7CDC7BC091B80173301B1A3D4EF941D4
SHA-256:	EE2D2643AD7A8F97B7A6C070910866436CAE0267A6691A3D8A88ED0948D8AF49
SHA-512:	445EECFA83E7635BC3442937BDF3B9C4A38EF3FBB7F07CA90A1D4222E1A29639F3FDCE12B20E798888823F2D612E5972492B3786D37B256AEC5C1C96CDB96B28
Malicious:	false
Preview:	........R...h.....i.....j.#...k.2...l.=...n.E...o.J...p.W...r.]...s.n...t.w...v.....w.....y.....z.....\|.....}........................................................................./.....B.....Q.....j.....u.....~...........................................................=.....D.....T.....b.....n.....{.....................................................5.....i.......................................................................,.....M.....r.......................................................................<.....J.....W.....t...........................................................1.....F.....Y.....q.................................................................(.....s..................................P.....X.....l.....u...............................................1.....L.....}....................................... .....".....%.....(.&....B...+.E...,.c.....t.../.....0.....1.....3.....4.....5.,...6.{...7.....8.....9.....;.....<.....=.....>.....?.....@.-...A.[...C.~...D...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\ja.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	505348
Entropy (8bit):	5.70215508714318
Encrypted:	false
SSDEEP:	3072:Z41y9KfIBW57kXoT3r0x9pUV6tIz4ZKs24AMNA4oQPkwaIAOen1IUNH7bbeCYX5M:gy8f6+/iSVwm4ZKs2kowP/53/gxVX
MD5:	F47EFAA76F5200A6C0C23C33684D7BAD
SHA1:	9B24F6491A1171D3DFEAE329E1F45AB3E3D9CF22
SHA-256:	5B99D6A11D7B653681B2A2BB616CC1814451AD35C370D178B2EF6650465D4F2A
SHA-512:	67D130A66F03A4D1A0A30576B19FE44FA707CBA764C6DCD355CBE891A2BCC0B25823BA2106E9271E06ADA674F66824A5323B77D4984900516D2A8802AF87960E
Malicious:	false
Preview:	..........w.h.....i.....j.....k.....l.....m.....o.....p.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....T.....\.....k.....p.....x.....................................................(...........@.....h.....}...................................-.....W.....x...............................................+.....L.....g.....m.....\|.............................9.....?.....Q.....o...............................................I.....y...................................................../.....V.....b.............................U.....................................................'.....<.....h...........................................................Z...........0.....6...................................9.....B.....N.....T.....].....x.............................<............................................. .....".....%.M...(.....*.....+.....,.........../.....0.'...1.l...3.....4.....5.....6.....7.8...8.V...9.t...;.....<.....=.....>.....?.....@.....A.I...C.p...D.....E.....F.....G...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\kn.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1013161
Entropy (8bit):	4.228821100054137
Encrypted:	false
SSDEEP:	6144:VfJ86BOVXCMsEb7ytUGGGHPsj/lEmlPV01tqErthLVGkcVw2VzidmEHXy0r2Slih:VfG7VES7yv54EPh4ow7M5LrUf+w542Fv
MD5:	A603F3D899CCDCD9AF20DCD8F87D0ED8
SHA1:	F476355D6EA5C05B35AD74C08E2EDFE5FF2881AD
SHA-256:	3C11A589AAB0C5D9E5C18E6A95DCE7E613089D3598B8FE54E656A8D97E22A6FD
SHA-512:	F6B008080CAE44D680FAAAB02911F62E21D042C55FC5AF87E719E9BC4102B282E58E67F19F37F60FE8BA99F5B8CFD4E70A61AF9918A9EE8E3D8AE72555D31C15
Malicious:	false
Preview:	........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....=.................=.....}......................./.....A.............................:.......................&.....d.................-.....U.................6.....N.....j.................L.............................4.....C.....F.....d.................4.................e.........................................P.....o...............................................J...........,.....H.....v.................(.....+.....e.......................G.....................................................(...........V...................................H.....`.....................................................x.................z.......................E............... .....".....%.t...(.....*.....+.....,.!.....R.../.....0.....1.;...3.U...4.....5.....6.s...7.....8.....9.<...;.m...<.....=.....>.....?.....@.-...A.....C.....D.#.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\ko.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	425564
Entropy (8bit):	6.081749497168224
Encrypted:	false
SSDEEP:	12288:neS2i6I3l956t91zt8OhYJRFJCqj5T718I8MtWq7hUoBAA:efia6JH5D8iAA
MD5:	B83BC27C5BC2BB4D0FF7934DB87E12AD
SHA1:	050F004E82F46053B6566300C9A7B1A6A6E84209
SHA-256:	AB3060E7D16DE4D1536FF6DD4F82939A73388201AD7E2BE15F3AFEE6A5AAE0EF
SHA-512:	B56B211587FE93A254198CA617CDECD8DC01E4561151A53173721665111C4D2440535F5F6B8A5A69A31840EA60124F4AFD2C693D1FC4683FA2CF237C8EDE5F0A
Malicious:	false
Preview:	............h.\|...i.....j.....k.....l.....m.....o.....p.....r.....s.....t.....y.....z.....\|.....}.......&.....+.....3.....>.....F.....U.....Z.....a.....h.....j.....o...........................................................g.....w.....y.....}...............................................).....H.....U.....h.....\|...............................................&.....,.....5.....H.....[.....a.....d.....j.........................................:.....Q.....W....._.....f.....o.....\|..................................."...../.....Y.....v...............................................1.....>.....N.....[.....t.....................................................$.......................u.................................................................?.....V...................................#.....).....?.....Q.....^... .a...".k...%.....(.....*.....+.....,.-.....C.../.`...0.l...1.....3.....4.....5.....6.?...7.U...8.l...9.\|...;.....<.....=.....>.....?.....@.....A.....C.8...D.H...E.i...F.....G...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\lt.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	457229
Entropy (8bit):	5.6340316488356885
Encrypted:	false
SSDEEP:	6144:Ca5OWNr5w0tunX4nkokKgneIVUoCb1DD7U5R3zv9dFaL8tx9e2lJ2I96S2:Ca5JOIpg7e2UoC9c59zv9fx9eoP6S2
MD5:	96602A3F3B59FAA997A4D337889FA02B
SHA1:	94593A270B0D84C006E0959BC136B6C4987DFD3F
SHA-256:	51DB5311DE9DFF41FB4EADDA8BA7D5E492912F72C3754ADAF8E3DE23ABA46F8A
SHA-512:	DD45240494D09AD9A41BE9D4056ED274E78A50DC85E6BFF9438E707A84F65B77EBE522531370DA99E50A6887D6063C29E9728B49DF2B2B3C61362D774797FAC2
Malicious:	false
Preview:	........U...h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...r.c...s.t...t.}...v.....w.....y.....z.....\|.....}.........................................................................8.....F.....S.....g.....r.....................................................5.....T.....m.....v...............................................!.....6.....=.....F.....S.....a.....u.....................................................&.....<.....Z.....w.............................5.....>.....F.....M.....X.....j.....................................................-.....T.....m.....{.................................................................H.....O.....R.....S.....].....h.....o.....y.................).....x.............................G.....X.....v...............................................B.....d...............................................)... .>...".N...%.m...(.....*.....+.....,.........../.!...0.$...1.U...3.f...4.....5.....6.....7. ...8.@...9.T...;.b...<.s...=.....>.....?.....@.....A.....C.:.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\lv.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	455871
Entropy (8bit):	5.635474464056208
Encrypted:	false
SSDEEP:	6144:GOQDGtu4e+D8NHtVFHTPq7K4vHo4q3sb3755ZanXDEG9Aarl4zxmEA5QXls14:GOQUZ2Gu4vTqw75KEGGmEs14
MD5:	E4F7D9E385CB525E762ECE1AA243E818
SHA1:	689D784379BAC189742B74CD8700C687FEEEDED1
SHA-256:	523D141E59095DA71A41C14AEC8FE9EE667AE4B868E0477A46DD18A80B2007EF
SHA-512:	E4796134048CD12056D746F6B8F76D9EA743C61FEE5993167F607959F11FD3B496429C3E61ED5464551FD1931DE4878AB06F23A3788EE34BB56F53DB25BCB6DF
Malicious:	false
Preview:	........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................&.....'.....(..........O.....b.....u.....................................................!.....%.....M.....].....s.....z...............................................!.....2.....8.....>.....Q.....e.....{...........................................................%.....7.....I.....g.....}...........................................................3.....7.....P.........................................+.....<.....O.....d.....v...........................................................".....#.....-.....8.....@.....G.....Y.................-.....8...................................%.....,.....;.....>.....I....._.............................#.....T.....i.....p.....y..................... .....".....%.....(..........+.1...,.O.....r.../.....0.....1.....3.....4.....5.!...6.\...7.\|...8.....9.....<.....=.....>.....?.....@.....A.9...C.X...D.e.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\ml.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1056670
Entropy (8bit):	4.265027412218305
Encrypted:	false
SSDEEP:	12288:GoHap3rrLnsoR47/J7nUwmoMmWDcZubSA/doySi3ethK5G/7dxOY3ab:Gj3r0ofwvi3eG5G/7OY3c
MD5:	3B1305ECCA60FB5A7B3224A70398EAD9
SHA1:	04E28FCE93FC57360E9830E2F482028FFC58A0A2
SHA-256:	C10942F5333F0D710DE4D3DEF7AA410C4576FFE476B3EA84AAC736BFB9C40D67
SHA-512:	68FDD944A153C16D18E73DD2AA75593F6AC13B8E87DBFB5BFCCDD982A4F885BD9903C3ED1AF781581CD3C5D42DD2FF21CC780F54FD71AB04A3237D08ED5A1554
Malicious:	false
Preview:	........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................".....).....0.....1.....2.....7.................".....b.....}.......................N...........3.....5.....9.....a.......................M.....{.................@.....n...........!.....e.............................'.......................C.....}.............................H.................=.................P.....~.........................................v.................I.....j.........................................b...................................q.......................b.....i.....l.....n.............................1...........q.....'.....E...........N...........(.....`...................................;.............................Y.....4.............................;.....k... .....".....%.n...(.....*.....+.....,.M........./.....0.....1.}...3.....4.....5.>...6.....7.....8.....9.....;.....<.8...=.X...>.....?.....@.....A.....C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\mr.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	863832
Entropy (8bit):	4.294820073892162
Encrypted:	false
SSDEEP:	3072:mNmdqcjlxFxta+oFNkWt0qJASXspXi+zoF5MU9G3GRe3RQR3K5/knxi4nou4AmH1:mgqylx+Pkc0qO8o2D6WA0+te503pueVx
MD5:	25F2B9842E2C4C026E0FC4BC191A6915
SHA1:	7DE7F82BADB2183F1F294B63CA506322F4F2AAFA
SHA-256:	771EB119A20FCC5E742A932A9A8C360A65C90A5FE26AB7633419966BA3E7DB60
SHA-512:	AC6D2EEB439351EEE0CF1784B941F6DD2F4C8C496455479CA76919BF7767CCA48A04BA25FCCDE74751BAA7C90B907B347396235A3CE70F15C1B8E5388E5C6107
Malicious:	false
Preview:	........)...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.%...t.....v.C...w.P...y.V...z.e...\|.k...}.}.......................................................................;.....].........................................#...................................+.....^.............................A.......................(.....G.....c.....y.......................]...............................................6.....`.......................N.............................!.....(.....4.....W.....p.......................k.....................................................=.....Z.........................................<.....o.....v.....y.....{.........................................9.................................../.....H.....h.....q.............................$.....x.................Q.............................A.....v......... .....".....%.....(.d...*.....+.....,.........../.A...0.N...1.....3.....4.....5.I...6.....7.....8.3...9.[...;.....<.....=.....>.....?.....@.B...A.v...C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\ms.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	390303
Entropy (8bit):	5.258177538585681
Encrypted:	false
SSDEEP:	6144:zCsFFfyrvxoQuXkulRopY/5BI8T5sHAVHMM/k3y:tQxoNlR6K5v5vVsMZ
MD5:	9B3E2F3C49897228D51A324AB625EB45
SHA1:	8F3DAEC46E9A99C3B33E3D0E56C03402CCC52B9D
SHA-256:	61A3DAAE72558662851B49175C402E9FE6FD1B279E7B9028E49506D9444855C5
SHA-512:	409681829A861CD4E53069D54C80315E0C8B97E5DB4CD74985D06238BE434A0F0C387392E3F80916164898AF247D17E8747C6538F08C0EF1C5E92A7D1B14F539
Malicious:	false
Preview:	........c...h.(...i.0...j.<...k.K...l.V...n.^...o.c...p.p...r.v...s.....t.....v.....w.....y.....z.....\|.....}................................................................... .....J.....].....q.................................................................<.....R.....r.....{.......................................................................+.....;.....J.....y.............................................................................6.....S.....w.............................................................................:.....S....._.................................................................0.....I.....`.....s.....z.....}.....~.....................................................M.....T.................................................................2.....N.....f.....................................................,.....:... .=...".I...%.u...(.....*.....+.....,.........../.....0.....1.....3.;...4.Z...5.m...6.....7.....8.....9.....;.....<.....=.....>.:...?.B...@.W...A...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\nb.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	382997
Entropy (8bit):	5.424185417752492
Encrypted:	false
SSDEEP:	6144:Kf9KG0yIhGHby7Op7f21zg2mKP7s4UzUn5el4nYHOp1k:Kf7xHby7Op7f21vs4kY5el4Jp1k
MD5:	7576C2FA9199A4121BC4A50FF6C439C3
SHA1:	55E3E2E651353E7566ED4DBE082FFC834363752B
SHA-256:	2A3DFC6B41FA50FABED387CB8F05DEBBC530FA191366B30C9CB9EAAE50686BD5
SHA-512:	86C44E43609E6EB61273F23D2242AA3D4A0BFA0EA653A86C8B663FA833283CC85A4356F4DF653E85080F7437B81AE6201A3ECF898A63780B5CA67FAA26D669FE
Malicious:	false
Preview:	........S...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....\|.....}.........................................................................3.....>.....M.....`.....h.....r.....................................................$.....<.....A.....P.....a.....h.....t...........................................................).....\.....o.....v.....{...........................................................).....A.....Z.....e.....i.....q.....x.....~...........................................................5.....X.....n.....w.........................................................................................!.....).....4.....;.....F.....v.......................>.....X.....p...........................................................&.....?.....W................................................... .....".....%. ...(.@...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.L...7.c...8.....9.....;.....<.....=.....>.....?.....@.....A.....C.".

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\nl.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	395005
Entropy (8bit):	5.3648120313169505
Encrypted:	false
SSDEEP:	6144:9w7EkDj0crV7gSSO5S3HDpaQj3D+qnRVZ5qYx1Gp7KNWaPW:9wYkH04FgSSO5SUO7Z5qYx1Gp7KNrPW
MD5:	BC41967B2FF493E7F151C7721245739D
SHA1:	7606133DDBB58492DBBF02C03A975FB48DA1E26F
SHA-256:	3DBE5569F53D1314DCB1BC99540CF6A0FEA45B6D67576FD0D14C688107892F32
SHA-512:	9E395A3B5BBF64DE3E474C56C4FB39879F107A9DB246632CF6BB4B06160E05A82C0161D6496EDB2BC29FEBB4A8F67CA7EA904167B860FD6DA96636A6711CB593
Malicious:	false
Preview:	........E...h.....i.....j.....k.....l.#...n.+...o.0...p.=...r.C...s.T...t.]...v.r...w.....y.....z.....\|.....}...............................................................................$.....4.....E.....N.....W.....r.....z.....................................................'.....7.....I.....V.....c...........................................................!.....`.....u.....z...........................................................+.....G.....f.......................................................................9.....E.....].....v.....................................................2.....F.....Y.....t.................................................................'.....a...................................<.....I.....Y.....a.....j.....n.....r...................................".....O.....d.....m.....x..................... .....".....%.....(.....*.....+.....,.!.....2.../.I...0.S...1.....3.....4.....5.....6.....7.....8.;...9.J...;.Z...<.h...=.v...>.....?.....@.....A.....C.....D...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\pl.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	439993
Entropy (8bit):	5.767289703106541
Encrypted:	false
SSDEEP:	12288:nXFDujSoL/7+Xgv3iWSb1vPiCUdcUd3Imhz1QhjAB5cyE447e:XJg3d1Qhw5qe
MD5:	61C093FAC4021062E1838A32D79399C2
SHA1:	84A47537EF58D2507CF7697EA7E1E27B1F812EE8
SHA-256:	58067EC06973F5DD7AFEBBE57BFFCE3A3ED9F8E5093AF8FCEFDB6A65B2B68B22
SHA-512:	475D9D4F27CBC23EFD9ACF75024F993BCF7A8279E658CCBD84C8AC810E1C828DE4DAC4141298865FAF1BB8858A7A88A12D1A21C467E8C656533E364CEFF7E5DC
Malicious:	false
Preview:	........T...h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....\|.....}.........................................................................6.....E.....S.....h.....q...........................................................3.....M.....S.....g.....\|.................................................................).....;.....n.............................................................................2.....N.....i.....{.................................................................+.....6.....V.....c...........................................................(.....7.....M.....d.....{...........................................................T.............................,.....i.....r.....................................................7.....V.....r............................................. .....".)...%.K...(.c...*.....+.....,.........../.....0.....1.....3.,...4.K...5.i...6.....7.....8.....9.....;.....<.....=.....>.....?.$...@.7...A.{...C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\pt-BR.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	415490
Entropy (8bit):	5.425893789423815
Encrypted:	false
SSDEEP:	6144:Bmyk1sBD6ytNBXBLw1OGDcpryHF55NJNtYbsRklb2:Bk1EuBX5PJbssRwC
MD5:	A23C805EE4D3D67C811B50826CA25A51
SHA1:	C14FA8B9C7073FE88E188CFA4B34883FACCC2C09
SHA-256:	62BE4FB0BD3B8BE563516BFEA3F0848924BB7AFB0C563D02C1508608A4487E3B
SHA-512:	C478BD2234EEF73AA08085D29B916AD1471576FF213F972C9616757172D0CDEC6E5D6797A1F2635AC17A0BAC34964A298E4AB4336479456CE10330128CD68A53
Malicious:	false
Preview:	........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................".....).....0.....1.....2.....7....._.....q.....................................................#.....%.....).....T.....c.....\|...................................................../.....F.....P.....X.....h.....y...........................................................%.....:.....H.....Y.....r.................................................................+.....5.....F.....~...............................................).....;.....S.....V.....g.....y.............................................................................=.....y............................. .....H.....R.....i.....p.....z...............................................3.....f....................................... .....".....%.....(.....*.(...+.+...,.I.....Z.../.n...0.w...1.....3.....4.....5.....6.-...7.A...8.Y...9.l...;.\|...<.....=.....>.....?.....@.....A.....C.!...D.+.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\pt-PT.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	416968
Entropy (8bit):	5.40159614402729
Encrypted:	false
SSDEEP:	6144:Mg2vZhLwJeOMfieJVJJxhUOlxLu3yv5xKqSR0B:z2HLwx18dv5xKqSRW
MD5:	ACFFA29064F40A014BC7FE13E5FF58A9
SHA1:	5A0890C94084075446264469818753F699A3D154
SHA-256:	423E7CCB22D32276320ED72F07186188E095C577DB5BCE7309C8BD589A2A8858
SHA-512:	D4572C81FDD3B7B69D77544F68B23AE0B546158033BE503DBAAB736D3CA1188B18916688234FAE9EA29FA430258B2D2B95A93D0E8B74919A62040B84902D3B6E
Malicious:	false
Preview:	........s...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................%.....-.....4.....;.....B.....C.....D.....I.....r...........................................................&.....(.....,.....W.....f...........................................................!.....9.....C.....K.....\.....n.................................................................%.....3.....D.....b.................................................................#.....+.....<.....t.....~...............................................(.....:.....T.....W.....h.....\|.............................................................................N...................................0.....X.....b.....\|.....................................................;.....^............................................. .....".....%.....(.3...*.P...+.S...,.q........./.....0.....1.....3.....4.....5.8...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.+...A.a...C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\ro.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	430188
Entropy (8bit):	5.460211694476929
Encrypted:	false
SSDEEP:	6144:pqgw46K4aoFt3GgnSYJ0vLi5OU6ois2a/7ulqr:pqg16Ft3GgnSYuvLi5OXo3/5r
MD5:	19CFC7C8F1A2E4A2DE1F9F64475469BC
SHA1:	BF6C4F373C19B03E116D2593C64E1CECA47D79DC
SHA-256:	3E725F7A791AED1FBED57F075CA11CE389A5BD425CCCE3C00537DAD27E5A8DD6
SHA-512:	FF5254E3A3676B8F5E74CBA6661AE43D5739C7363C66CB17F74DCE158DC36CEE103885F055846DD320B932F2E7FBDC831BCEE6293D423FF9B842B68644F633BD
Malicious:	false
Preview:	........L...h.....i.....j.....k.$...l./...n.7...o.<...p.I...r.O...s.`...t.i...v.~...w.....y.....z.....\|.....}.........................................................................1.....@.....L.....Z.....e.....p...........................................................<.....E.....^.....n.....y...............................................+.....?.....T.................................................................M.....n...................................#.....+.....2.....8.....G.....Y.....n.....u...............................................T.....b.....t.....................................................,.....@.....G.....J.....K.....W.....c.....p.....y.................).....r.....z.............................9.....S.....d.....l.....r.....x.............................3.....V............................................. .....".....%.<...(.S...*.k...+.n...,.........../.....0.....1.....3.....4.'...5.G...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.&...A._...C.....D...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\ru.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	703434
Entropy (8bit):	4.837280329650102
Encrypted:	false
SSDEEP:	12288:y0MhY5eXN2hHO3j/jHwzvMBsWA2kkje8P/XyFGGJFsWPaZuLoUFC8WNcHWajf+6K:y0Cjc5w6pw
MD5:	FC0E2FC09AA9089C5DB75BAB7A0754A7
SHA1:	F3D1E3E1600AE188E801A81B6D233DB9903B82DF
SHA-256:	188B6405CB6C5B7C0B35050278A119C3CE41FB90883B9ADB39FEC15DA0A05550
SHA-512:	377E685D1D171D0A7158B56F356CA33D4493D07EFA58D3C384E272E1B6829933552C69AFF95215AE7D1A0F99616A20790708F5187EA10CFE46BAA2BB522FC18F
Malicious:	false
Preview:	..........S.h.....i.....j.....k.....l.....n.#...o.(...p.5...r.;...s.L...t.U...v.j...w.w...y.}...z.....\|.....}.........................................................................:.....W.....t.........................................E.....l.....n.....r...................................(.....A.....K.............................3.....?.....b.......................+.....5.....F.....[.....v.........................................8.....f..............................................K.....e...................................H.....i.............................7.....t.....w...................................B.....I.....L.....M.....].....q...................................>.....J.................#.....e.........................................6.....t.................:.......................#.....7.....G.....w......... .....".....%.....(..........+.....,.........../.....0.....1.]...3.t...4.....5.....6.N...7.r...8.....9.....;.....<.....=.....>.8...?.G...@.f...A.....C.!...D.2...E.j...F...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\sk.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	443083
Entropy (8bit):	5.818419643630632
Encrypted:	false
SSDEEP:	6144:o9fWTbKt/WJWyqiLJcPXPJ5ELALWaQlKDEmLFGR:uMKYkyqiWPXR5ELALWaQlwdLE
MD5:	793C442420F27D54410CDB8D8ECCE5FF
SHA1:	8995E9E29DBAAA737777E9C9449B67CA4C5B4066
SHA-256:	5A9D6B77CA43C8ED344416D854C2D945D8613E6C7936445D6FE35E410C7190BB
SHA-512:	291E3D2300C973966D85E15A1B270BA05C83696271A7C7D4063B91097A942590C9797A4D22DFBE154564B779DAC92FD12DB0D5B63F5F0406F818B956B126E7E9
Malicious:	false
Preview:	........U...h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...r.f...s.w...t.....v.....w.....y.....z.....\|.....}.........................................................................A.....U.....].....o.....z.....................................................9.....R.....q.....w...............................................!.....0.....6.....>.....N....._.....s.....................................................$.....:.....L.....h.......................................................................".....=.....\|....................................................9.....a.....d.....v...................................................................................d.......................t.........................................%.....0.....9.....P.....x.............................U.....r.....z........................... .....".....%.....(......6...+.9...,.W.....h.../.....0.....1.....3.....4.....5.....6.D...7.Y...8.p...9.....;.....<.....=.....>.....?.....@.....A.(...C.I...D.T...E.t.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\sl.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	427793
Entropy (8bit):	5.485228938958345
Encrypted:	false
SSDEEP:	12288:iyCex+3QRB21BPDwY5omcAVOlJgi/fzxzqg:iThgkDwY5omc0i/fzxt
MD5:	4D9D56EF0B176E7F7AA14270E964EC77
SHA1:	515AAC37E4F25CA50BD52EA73889B70B1E79863D
SHA-256:	6BA684A8F06F7EB175955B15D30C7162D92C7E7C48864DFB853238263E1BE8C7
SHA-512:	740ADBB7D8B039F98E187F45A1A87D0354136FB48B75262E508F720BFCBEB2746F04D31A57DCCD50E37DDB5A1B7C0AD79A01CAC6BA5FB98A9AF272AD99FCB169
Malicious:	false
Preview:	........A...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....\|.....}..........................................................................................:.....B.....R.....y...............................................,.....D.....N.....X.....b.....m.....{.................................................................M.....c.....h.....o...........................................................%.....C.....d.................................................................3.....=.....L.....c.....v.....................................................-.....@.....P.....e.....\|.................................................................Y.............................2.....m.....z.....................................................2.....H.....o............................................. .....".....%.....(.P....t...+.w...,.........../.....0.....1.....3. ...4.<...5.Q...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.,...A.....C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\sr.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	660184
Entropy (8bit):	4.762088583435569
Encrypted:	false
SSDEEP:	12288:FqLaALUKEuNI0I4Ki1pg82ATs+Hc549x4moW037LJzk/k/N:FWFLrSqJc5Axjw
MD5:	CF160983A86B51EC42845F4E60AC9123
SHA1:	4D3BD86A7EF1EAADB8BEC0B79ECC6C05B4273A48
SHA-256:	EF07512FB337005BB66696C69722A0D65BFB749B9D2F763F5B2FF2885CB247A4
SHA-512:	B909FC3614C3250856D2C502CBFED5EB6E398140B801669BF92427E7E8A5939B14052B9ABF2C94749F1AEA61946FF66BE4978C68064196458733BCFF0A963FFA
Malicious:	false
Preview:	........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................&.....'.....(..........y............................. .....b.........................................?.....c.........................................?.....V.....o...................................3.....R...................................'.....1.....A.....M.....l.............................J.....................................................4.....@.....c.............................-.....l...................................P.....S.....n.....................................................%.....1.....J.....Y.....o.......................%.................".....j...............................................c.......................D...................................,.....A... .U...".\|...%.....(..........+.....,.<.....d.../.....0.....1.....3.....4.N...5.....6.....7.....8.>...9.r...;.....<.....=.....>.....?.....@.....A.....C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\sv.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	385358
Entropy (8bit):	5.543864706629343
Encrypted:	false
SSDEEP:	6144:M4pIcHsEAjiwshcB7xopq/4LLXru9M9SOxDE/xUDvZv5pB5mEgb7:BpIcsV9Bxq5/5mz
MD5:	BBE0785C5F9591E8A1E7C4830FE949D6
SHA1:	DA4F3286079D50E1C04E923529E03E7D334C7FFF
SHA-256:	0AD84F6F95FD7505862278A7C1C92D00A7E7DD4A765569E9C3086F55C1D7059D
SHA-512:	38BAB6F3A6C9395D3B57E63168045AD2E8188B2F04751A15253E7226EC3043C9678A77BE1EB27A3B2E751934A024F3FFC89FFFD9F1E229E19638BE318B53E961
Malicious:	false
Preview:	........0...h.....i.....j.....k.....l.....n.....o.....p.....r.....s....t.3...v.H...w.U...y.[...z.j...\|.p...}...........................................................................................!.....).....2.....M.....U.....`...........................................................&.....-.....:.....c.....t.........................................................../.....;.....C.....U.....e.....i.....s.....z...................................%.....H.....S.....Y.....a.....h.....n.....{.....................................................).....R.....q.....y.................................................................$.....+.........../.....7.....?.....J.....R.....].................".....).....u.................................................................'.....?.....k..............................................."........ ./...".9...%.[...(.x...*.....+.....,.........../.....0.....1.....3.)...4.P...5.e...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.%...A.Q...C.p.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\sw.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	404454
Entropy (8bit):	5.342474055533773
Encrypted:	false
SSDEEP:	12288:iehLwLk65vqimUwbQuBndO8gJGgnATm5A1vZcsToe4t2ht:isLwZP5Ar
MD5:	EE8DA42FFE40FBB916C56390E2CD99E8
SHA1:	6D824F56AFE6B3605A881D2C26E69A46E6675347
SHA-256:	192E248C7AC4644F8712CF5032DA1C6063D70662216CCF084205F902253AA827
SHA-512:	7BEFE72B073000BC35A31323D666FD51D105A188D59C4A85D76EE72B6C8C83A39A1BEB935C1079DEF8E3FFA8C4BF6044CF4F3BEF0F1C850C789B57E1144FF714
Malicious:	false
Preview:	........Y...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....\|.....}.........................................................................3.....E.....U.....i.....u...........................................................+.....H.....N.....Z.....m.....z.....................................................$.....8.....E.....p.......................................................................8.....W.....{................................................................. .....[.....m.....{...................................(.....4.....K.....x.....{.........................................................................................+.....\...................................+.....P.....Z.....r.....x...............................................-.....L............................................. .....".....%.....(.7...*.S...+.V...,.t........./.....0.....1.....3.....4.....5.1...6.i...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.9.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\ta.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1043822
Entropy (8bit):	4.043942262405797
Encrypted:	false
SSDEEP:	6144:LXNxfybLQ4iFd2n1E+1lhfi5yzntRMcA2i:rffyblEd21Z13i5yzMcA2i
MD5:	A8BEAB6896018A6D37F9B2E5BDD7A78C
SHA1:	64310684247219A14AC3AC3B4C8EBAA602C5F03A
SHA-256:	C68B708BA61B3EEAB5AE81D9D85D6E9F92E416ECFAE92E8DE9965608732384DF
SHA-512:	73B0A31235BF4B7C5AD673F08717F3B4F03BCDF2A91440EE7228AA78C2D15DD2AED32498E23DED78EC35BC731DBE16B6A1C236A170F2A84123A464857686C7B5
Malicious:	false
Preview:	........(...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.#...v.8...w.E...y.K...z.Z...\|.`...}.r.....z.................................................................M.....{.............................v.......................n.....p.....t.................E.....c.......................;.......................0.....m...............................................$.....`...................................0.....y.................9.............................!.....(.....F.....n.......................3.............................F...........;.....`.......................7.....:.....n.................$.....Z.....................................................E.....#.......................Q.................c.............................#...../.....s.............................B......................?.....d............... .....".....%.}...(......O...+.R...,.p........./.....0.....1.u...3.....4.....5.....6.....7.]...8.....9.....;.'...<.G...=.j...>.....?.....@.....A.9...C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\te.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	965192
Entropy (8bit):	4.296319027025746
Encrypted:	false
SSDEEP:	12288:zqfk4UYABx3p1F9SviTlw2cTgCNFO9gr/p54JkQJgw4taJCb8+58XfX0Dxq9OyUn:eM4U4lp5WMfD
MD5:	02415DED02CC7AC25E8F8D0E83365061
SHA1:	5A25BF63EC97DBEB37E64AB3825CBBCE6326A5CF
SHA-256:	97024F0CFAC78E0C738E771BEEA1E35F5A8EB2B132B3043B59CE4ECD6C153523
SHA-512:	54E658C6D432B29B031BE278E5B4396AC14B0F85E1F772A0A76C0431D4CBE2370FF2898077837688E2FB9700DB1EAB7A19E4E350A280A2FFAD8176D861D93E45
Malicious:	false
Preview:	........m...h.<...i.V...j.b...k.q...l.\|...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}........................."..........1.....8.....?.....@.....A.....F.................1.....n...........................................................4.....z.......................P.....r......................t.................=....._.......................g.......................1.....{.............................J.................j...........2.....g.........................................\.....q.................@.....[.................b.............................W...................................F...............................................@.....g.....t..........._...................................%.............................5.....J.....Y.................f...........D...........2.............................I.....p... .....".....%.....(.e...*.....+.....,.........../.b...0.....1.....3.:...4.....5.....6.C...7.....8.....9.....;.E...<.b...=.....>.....?.....@.....A.N.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\th.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	812017
Entropy (8bit):	4.341302348376344
Encrypted:	false
SSDEEP:	12288:z0O3mMkgs3s5UW4HLRflsjj8sKGs1loIG0EeuLADh7Kle9dPu753ohP09XAyFHyW:Y69K5V5q
MD5:	293AD7C20C22D744E4DB0FB001EC45BB
SHA1:	486C9E0732306A45ACEB633DA2B3DED281197620
SHA-256:	D67D68F24D3347E244A7E8C3B63D47F18FCF37258256F48DAD785CF98BB560FA
SHA-512:	AC2B2DD82095925B3229958E89DCF5283BDCE0273734A0C338F5A1AA8B014644806CA517F0FC2003669910E58FEDF9C2CA7A009FA3F53D58C07BC5E9191F2E2F
Malicious:	false
Preview:	..........w.h.....i.....j.....k.....l.....o.....p.....r.....s.....t.....v.....w.....y.!...z.0...\|.6...}.H.....P.....U.....].....h.....p.....u.....}...............................................2.............................,.....;...................................$.....].....o.............................A.....`.....~.............................b.................h.....................................................N.....{.......................J.....}...............................................0.....N.....x.................&.....}.................I.....g........................................K.....h.....................................................?...........T.................r.................n.........................................=.......................G.................6.....?.....T..................... .....".....%.@...(..........+.....,.........../.V...0.i...1.....3.....4.W...5.....6.*...7.K...8.....9.....;.....<.....=.....>.Y...?.....@.....A.....C.!...D.=...E.p.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\tr.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	411446
Entropy (8bit):	5.612902230569552
Encrypted:	false
SSDEEP:	6144:TaT6Tj4rfG2a4l1kKJtkOq/7V56sA7WGgeh5X/0+gi1ZavXmAQwiBTVGI:2w0u27leaoy5775X/7
MD5:	9F24F44CAC0997E1D0A6A419520F3BFE
SHA1:	EDB61859CBB5D77C666AAC98379D4155188F4FF5
SHA-256:	3AFF7DCBFB1A244CC29B290376B52CFB3E1F844C98FACAFEA17B4A45CE064B8A
SHA-512:	65FBE2D7FEA37DB59B805D031F6AE85D628A51B254E76E8C2B4EF4B5153527B7E2412ED6A0961D174B8A5581B521B0436160FE5ED252F78303BCFDE815733D81
Malicious:	false
Preview:	........}...h.\...i.m...j.w...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......".....'...../.....7.....?.....F.....M.....T.....U.....V.....X...........................................................L.....f.....h.....l.....................................................4.....I.....U.....x...........................................................&.....3.....H.....J.....M.....T.....k...........................................................".....).....>.....R.....u.........................................-.....P....._.....k.....v.............................................................................#.....,.....3.....>.....F.....U.......................!.....i.....~...........................................................3.....R....................................................A.....G... .R...".g...%.....(..........+.....,.........../.....0.....1.T...3.a...4.w...5.....6.....7.....8.....9.,...;.<...<.G...=.T...>.g...?.p...@.~...A.....C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\uk.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	705044
Entropy (8bit):	4.868695926663652
Encrypted:	false
SSDEEP:	12288:FkzOqMnty/KiZswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:muGN35EEK
MD5:	E4C4E3700469704B936460CA1A90FCC0
SHA1:	E809990FC07A1D39FE623046382699E648E343C0
SHA-256:	29AF2ABC75A35BB9E3F9BC6E2904228BA651EA4E0CE8E9C7A2D7E272374B9EBB
SHA-512:	68E33F471C5BF2D4ED9CB00ACE3E094EF102A5F1566A6E2C8A3007EF7FBD8A24C36EB36B08745F3608E70940444E9FC7A36FABE1A9945D1F00B4F3F28C7BDAF6
Malicious:	false
Preview:	............h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.,...\|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...................................!.....K.....d.....m.............................P.....R.....V.....~...................................%.....F.........................................1.....S.....y.............................!.....8.....Q.....[.....k.....{.............................A.....n.........................................(.....H.....l.....x.......................&.....=.........................................A.....D.....i.............................'...........1.....2.....B.....T.....f.....y.............................+.................$.....~...................................$.....R.......................<.....w.............................E.....u......... .....".....%.....(.....*.{...+.~...,.........../.....0. ...1.....3.....4.....5.....6.Z...7.}...8.....9.....;.....<.....=.....>.I...?.X...@.y...A.....C.1...D.J.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\ur.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	617160
Entropy (8bit):	5.143464180285778
Encrypted:	false
SSDEEP:	12288:bXldbsPI8PzGSEHybOAXsA5yzTExbWW7mQYrjuUco/9NjjFpvhl:rLsK8t5bWx
MD5:	D7EC7D551DEE1E1EF11BE3E2820052F9
SHA1:	D7F2D35841883103C2773FC093A9A706B2FE5D36
SHA-256:	05E45371159075048DB688564B6BC707E0891303C40F490C3DB428B0EDD36102
SHA-512:	92E2D32FC106812E08163A26F202A5D0E7EB7028A871F3BC6CBC05EE6C7CE287032179322B19E396308968515BF214534A38D93AFC259A780AD7BA8432FAB56A
Malicious:	false
Preview:	........S...h.....i.....j.....k.+...l.6...n.>...o.C...p.P...r.V...s.g...t.p...v.....w.....y.....z.....\|.....}.........................................................................v...............................................$.....f...............................................6.....].....j.............................=.....d.....n..................................._.....i.....\|.........................................+.....M.....{.......................:.....I.....Q.....X.....l...................................S.....f.......................+.....[.....j...............................................$.....B.....`...........................................................Z...........3.....H.............................(.....D.....J.....X.....l.....r.......................e.......................2.....>.....S.....l............... .....".....%.....(.'...*.T...+.W...,.u........./.....0.....1. ...3.:...4.g...5.....6.....7.!...8.\...9.u...;.....<.....=.....>.....?.....@.....A.&...C.`.

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\vi.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	488307
Entropy (8bit):	5.797698606019311
Encrypted:	false
SSDEEP:	12288:JqiJKHugsHBM0P5ZwSQ3cXzIJ1758/UIi0+UG3Lzi8Tal:eugsHe0PTwSmezE5Iti0+UKfi8Tal
MD5:	9274866D7C6314F43DD63ED293293E25
SHA1:	4AF0E6EC1BCB99588810A9FB69C1DC2BBAD892FC
SHA-256:	DCBDC6D9E11DD10FC1364C10BE5438CE2697F61EC5F32997C43B87238087C4E3
SHA-512:	3C8C9E9960A49469AF83CAE31790A03E41846163C14D3DAE45FD92A1A412C82075BDEF3317BACA02399EB53DE0F9164C0A9A17B7CD63E0FA61C3E4617393C42E
Malicious:	false
Preview:	............h.j...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.!...}.3.....;.....@.....H.....P.....X....._.....f.....m.....n.....o.....q...............................................(.....2.....Y.....x.....z.....~................................... .....+.....D.....t...........................................................5.....L.....V.....a.....r...........................................................T.....q.................................................................o...................................<.....P.....[.....i.....\|.........................................#.....:.....A.....D.....E.....N.....W.....c.....m.......................4.....C.....................................................2.....=....._.............................4.....i....................................... .....".....%.....(.E....j...+.m...,.........../.....0.....1.....3.....4....5.?...6.y...7.....8.....9.....;.....<.....=.....>.....?.'...@.I...A.u...C...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\zh-CN.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	354098
Entropy (8bit):	6.681132543457813
Encrypted:	false
SSDEEP:	6144:ALU9jcaZx79+vKKS/+kTme5zBNCJ7AAmlv:nAaZ+vKKS/ye5zBNCJ7Y
MD5:	9D4F54EB5A12CF4C2F34F5F538DFF90B
SHA1:	C31B892CE78C733BDE0571B6236170103CC9FE7A
SHA-256:	58B934A09858F037F1966A495E73D44416180AFCDEBFAEFCEE1F5E3377DE63F7
SHA-512:	46BF6099C50F7959A6F0800EC679B61A78EFABE87985CAD8DC0D7D0006470A9C61E659BDE0258DA6CF7ED6104749A157F5AD133F324479C3460A19FC14E31C37
Malicious:	false
Preview:	..........>.h.....i.....j.....k.(...l./...m.7...o.=...p.B...r.H...s.Y...t.b...v.w...w.....\|.....}...............................................................................'.....3.....E.....K.....^.....u.....{.....................................................%.....1.....I.....U.....a.................................................................$.....3.....9.....B.....T.....f.....l.....r.....x...............................................)...../.....7.....>.....J.....V.....b.....}...............................................=.....[.....j.....p.........................................................................................7.....@.....F.....P.....Z.............................D.....V.....h.................................................................%.....7.....`............................................. .....".....%.....(."...*.7...+.:...,.g.....\|.../.....0.....1.....3.....4.....5.....6.G...7.\...8.q...9.}...;.....<.....=.....>.....?.....@.....A.I...C.p...D...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\locales\zh-TW.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	350092
Entropy (8bit):	6.694428887930931
Encrypted:	false
SSDEEP:	6144:gTRIoLBHxLFJkrCU28LulyMD94qz5MHzC5M8Z/9ybT1:ga4BRSxBMD94qz5MHzby/o
MD5:	8F67A9F38AD36D7D4A6B48E63852208D
SHA1:	F087C85C51BDBDEF5998CFC3790835DA95DA982A
SHA-256:	92F26E692DC1309558F90278425A7E83E56974B6AF84DBD8CC90324785EE71CA
SHA-512:	623034BBDFDF5D331DE78B630F403AEB9CEF27B1827E0D29EC66AD69310F56C7DB96C6775DF0E749F8112A4A8E75754BCF987903D415FC7AE360E3C39E6E18E0
Malicious:	false
Preview:	..........\.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.-...t.6...v.K...w.X...y.^...z.m...\|.s...}..................................................................................... .....8.....N.....Z.....m...........................................................!..........6.....S.....`.....l.....~.......................................................................#.....)...../.....5.....M.....\.....k.....}.............................................................................'.....T.....`.....l.....................................................,...../.....;.....M....._.....s.............................................................................I.....v.....\|...............................................!.....'.....-.....?.....i.....................................................$.....8.....A... .M..."._...%.z...(..........+.....,.........../.....0.....1.@...3.Q...4.i...5.....6.....7.....8.....9.....;.....<.....=.-...>.F...?.P...@.e...A.....C.....D...

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\resources.pak

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	5245561
Entropy (8bit):	7.99547773238381
Encrypted:	true
SSDEEP:	98304:9LYsbEcnNWz49PDq2Awkmqmcph1Dd42cjrwrbHw4o0DPelwG3RC:90WcMButpphpd4jkrU4oeelrRC
MD5:	31C7D4B11AD95DFE539DD098E0FAB736
SHA1:	5418682D939CE8485ECC9125B872C14FFEC662C2
SHA-256:	A251019EB08F1E695E935D224544BDA37C5AE092BA68A89FA1FE3BD19BDE4F5C
SHA-512:	F868A4AFA4E0D5C561873D2A728E267F98DA2DF3FB90966E5736D496B6A24E71769A02B0346B27B7DCCE11CBE07248E309F50A89977DC8E5BBC06D6CC31BF738
Malicious:	false
Preview:	............f.......P'....$.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5fJ...5.O...5.V...5.f...5.w...5.x...5.\|..n<(...x<....y<....z<....{<....\|<....<-....<t....<:....<1....<....V@....W@....X@z...Y@f...Z@....[@4...\@Q...]@....^@...._@jh..`@....<A ...=A.....P.~...Pg....PZ....P.....P.....Pv....P.....P5....Q.....QH....Q.....Q.....Q.....Q]....QC....Q.....Q.....QY....Q.....Qx....Q;!...Q.'...QH....Q.1..,Q.F..-QuL...QNN../Q.P..0Q.U..1Q0i..2Q.j..3Q.k..4QGm..5Q.o..6Q.r..7Q.t..8QGw..9Q#x..:Q.z..;Qj...<Q'...=Q~...>Q....?Q ....R....Rw....}.....}. ...}B`...}.a...}.h...}.i...}.j...}.o...}?....}{&...}(/...}.6...}.;...}i=...}.B...}.G...~vO...~>e...~wq...~_u...~.}...~.~..!~...."~....#~(...$~...&~ ...'~....(~$...)~Y...~.$..+~.5..,~_7..-~.8...~\|;../~.<..0~.=..1~.A..2~.I

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\resources\app.asar

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	67982696
Entropy (8bit):	6.193985938173086
Encrypted:	false
SSDEEP:	196608:N96KGcEK1x/gNzp/GIpKcYU+xozsBrpB3N/tg732aHd/gNh5soeSRdCi8F5+bVUF:WK/EKYtsSLToBFB9/qJH+PRoF5+bm
MD5:	5776FAA63DBFDCD253C6EC860151D889
SHA1:	298077EF4B0217AE6F2F9D272635DD609D68C45C
SHA-256:	CCF767DD9D6AE08F6296B7C6AC5BA42AA47207621741BFA912032B27CC91CC63
SHA-512:	A564E1B0F617CC30F829CC83EF36C95BE00804E0C1A32EB1063596A3A510CA8D81A57E3B40756D99F676265C2C0C977AF281015FEBF80F72012DEA7EC988E365
Malicious:	false
Preview:	................{"files":{"0ed36d1ac9d8ec99.js":{"size":2232083,"integrity":{"algorithm":"SHA256","hash":"a7f9d165fe702b8089124cf63ed243f81687ccd9b1baea190f27b00e9fcb8d35","blockSize":4194304,"blocks":["a7f9d165fe702b8089124cf63ed243f81687ccd9b1baea190f27b00e9fcb8d35"]},"offset":"0"},"package.json":{"size":643,"integrity":{"algorithm":"SHA256","hash":"f0c1d888b7172814c8e5cd09a9258bd59a12f2a43b09b1f579e1310d95ab3c3e","blockSize":4194304,"blocks":["f0c1d888b7172814c8e5cd09a9258bd59a12f2a43b09b1f579e1310d95ab3c3e"]},"offset":"2232083"},"node_modules":{"files":{"@isaacs":{"files":{"cliui":{"files":{"LICENSE.txt":{"size":731,"integrity":{"algorithm":"SHA256","hash":"2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149","blockSize":4194304,"blocks":["2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149"]},"offset":"7785802"},"index.mjs":{"size":299,"integrity":{"algorithm":"SHA256","hash":"b75d22297e1bd8992f86218f1749435d05921d2d765697e46a43f680b2edc859","blockSize":4

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\resources\elevate.exe

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.442687067441468
Encrypted:	false
SSDEEP:	3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
MD5:	792B92C8AD13C46F27C7CED0810694DF
SHA1:	D8D449B92DE20A57DF722DF46435BA4553ECC802
SHA-256:	9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
SHA-512:	6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\snapshot_blob.bin

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	273328
Entropy (8bit):	3.2521912102596153
Encrypted:	false
SSDEEP:	1536:HpeVehd7eASb6iAGm4hmWRSJTnBSki+TzUNp2Zg+TWJ0xEI2tWaw8MCZ72T04GO9:NdyNm4mWRSJTBSX4U1hJzbYB
MD5:	4EBD06BDF6CF8DACF6597586FD1704B5
SHA1:	E6819EF37F99F91468F4B94370A4AB467A075A6D
SHA-256:	148E4B85983F0D27ADECD9C6431B66379AC5538688F320E89D74FF6D48BB740B
SHA-512:	17ED5ABE702748B4626B3EE6DE4D0916738F095C913C2700EEE06B65A2BBCAF72AFC1F87AF7CE0FCCE8BD15FE6881508255D397A346C45A82C7791B9B9833DDF
Malicious:	false
Preview:	.........+.11.2.214.22-electron.0...........................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	588152
Entropy (8bit):	4.837375324466163
Encrypted:	false
SSDEEP:	6144:EFzofuYUahtcOm3A0Sg8zY6y4XrxXSIIBYgHi:6Mfu/f2Y6zrM9C7
MD5:	146E284750735EF4798527DC1CD0E741
SHA1:	6408985B7D05C768A62BCB912234F14E1898FFDB
SHA-256:	3820E8FA1077D02606FEA8E1B3A9CA4BF7F4A71D0569D9A8EA9EE7A009D0CE80
SHA-512:	46824DF5D20E02FB72C3EFD07BEE6D832B1AB78C0163688FA84EDB831CBFBEF2DDE12BA9DA01F9DD49C4008BD3862A95699A2F6D55B8D4B3165976D3851C7278
Malicious:	false
Preview:	........$c^X11.2.214.22-electron.0..........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\vk_swiftshader.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5334528
Entropy (8bit):	6.3349883465807055
Encrypted:	false
SSDEEP:	98304:5aTPSALpajr/PMMPTZTOWvYQ7klZz8Wd4iRk:Elajr/PMMPTZTOWvCJ4Z
MD5:	750CBDFB01943E28E08708183EC208B5
SHA1:	1BEE0CD3D0970834B2A47DAF384354F243FD1EE0
SHA-256:	A6D295DCC3AFCB55AA79EAC5F896BCEB15CCB2B798DB3BB076CEEEA78073791A
SHA-512:	DBFDF76F40558CE2F23CA315B8719E283F0F22F46E733F37C2AE237FDAFD23CF7962F36547BA1BB2D5B219DE11546C3DC06859FAC498A7DA97DF41018C0D80C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.P}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..P}...pR..~....P.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\7z-out\vulkan-1.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	928256
Entropy (8bit):	6.558001659108061
Encrypted:	false
SSDEEP:	24576:yGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7a:GwwvuziiV/iXxc6Z5WODYsHh6g3P0zAu
MD5:	6C70AAB071C4FEBC5921E0D39811937A
SHA1:	20D87B3A5333EA3F6D0D7B0333F2C30A281937AA
SHA-256:	2233FEF6788711089FC5C1A008BFFF6559CF2FC3E8363CD8A50196E90D1D9825
SHA-512:	7F786C44376B59BE7D7C51D3C40ECB80F30645551B582D042B641EA0A6464DAF367DDF7EAFAF00A1558E1F11570D99A699D33D224B01048D09F8F00EA501C4BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text...v~.......................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\SpiderBanner.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.5347224014600345
Encrypted:	false
SSDEEP:	192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
MD5:	17309E33B596BA3A5693B4D3E85CF8D7
SHA1:	7D361836CF53DF42021C7F2B148AEC9458818C01
SHA-256:	996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
SHA-512:	1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.729923587623207
Encrypted:	false
SSDEEP:	3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5:	C6A6E03F77C313B267498515488C5740
SHA1:	3D49FC2784B9450962ED6B82B46E9C3C957D7C15
SHA-256:	B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
SHA-512:	9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!........b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....)......................... ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\app-64.7z

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	85555966
Entropy (8bit):	7.999996068932209
Encrypted:	true
SSDEEP:	1572864:DJ39Kk9M1l9cNoUjrs5jB8ceyIS7nqYdd6hIEhSmn6nlN/KFu:Wk9MJcNop5j/vP7nMhJnUXKQ
MD5:	CEED31AC9868FCC237D3C8A09D4A2EBB
SHA1:	C2DBA580289694A4CEBC90CFAFDAB19A5BDD694B
SHA-256:	9E5D6A1E5CD17068CD4A2146868890D8565FC5E3BA4ABFF0B38BE9273D191F80
SHA-512:	037A33C135006EF564D64ADF60BC3C08B5659962F26D28DA8EFB17F51BF12EAEB7F32E048BAC37EF841F75D7FE4021E6373959A4AC8F7ECD949D5C6B1CBC5764
Malicious:	false
Preview:	7z..'....j...z......%.......F.....R..]...6...#k.![y.`.Gr#.f..F......./.t..C..8.^..k .....@..........ih..w*.`.c...I...;.R.A`../_.Q:..yn........6...a {.f_.....>..`..Nu.....q/..H...hsIhA.5..... .9.[...L./.(.^.+Vz@.Dt7OZI.z.N...~;].rW..k......s...^<i ...w.`3.}............T.Z.v.m..W8..m...........k..8..w+.8..9N.C......._; ..u.J........i43.d.......`....r."O.E...'.{h....'....$.M.$..Y....&.+.r\|T....aF.T.9...&..sh....I..;.qP.Y..........V..^..P.:...D.."..@Cw...%8.h.5....6V/0..]....%7.Z.P..w..J..].....M..^......+..BMZ..&..}.6l..hT..t).?2....1...F..H..+...0.s.}.S.-x;...f.b}....8.R.@.....r.....Ib......$(/^XdI..46G..Q....`......h..H.U......p..[.Sa-Q@G.......h!....Z....2$.^.IqZ...~~CUB..#.nAp5.k..K....O".G.(......N...>`.k.....;.~A.X.e.mzUq.L...o..PH..WxfRH..z..dT!."d.W.4...Tx... ..Y<..1.P.#.W..Z7.f.z.R...u6.......C.+?.....p.d........".<.../h.Y..`u<m.y.u.Lh.Fz...#...F).,..G.~..'..Mx.s:3..V..m..[%.B.V[...V.Id_.~i6..$...H.ywyg.D.lA.`.H..+..X..@H....

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.155286976455086
Encrypted:	false
SSDEEP:	96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
MD5:	EC0504E6B8A11D5AAD43B296BEEB84B2
SHA1:	91B5CE085130C8C7194D66B2439EC9E1C206497C
SHA-256:	5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
SHA-512:	3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\nsis7z.dll

Download File

Process:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434176
Entropy (8bit):	6.584811966667578
Encrypted:	false
SSDEEP:	6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5:	80E44CE4895304C6A3A831310FBF8CD0
SHA1:	36BD49AE21C460BE5753A904B4501F1ABCA53508
SHA-256:	B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
SHA-512:	C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\passwords_0.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\passwords_36.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\4f0a42bb-d86e-444c-8773-2b3b8242b98f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7620_1717346032\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\si8q5befaws3.zip

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	304
Entropy (8bit):	3.351987889007718
Encrypted:	false
SSDEEP:	3:vhjPU/Xas4K5jPU/X9lojm9PU/X3EWVArn3ts/XXXvK4KV3ts/X9l4CluRmNts/W:5j8SS5j8I08s0W2P/cV2wmIRKWSB8lC
MD5:	A8D98BEF70BA1B4A0599633C8837E89A
SHA1:	5C134FFAEAD057B1B3AF6DC9CA69B8466C7D46F8
SHA-256:	AB975448170B5ABF50637500AA1DC1A07BEA90DF547DD729DF3DF8F90875CEBF
SHA-512:	86A166E1CCF53A82D74F29B96179CD69281FFDDBB1691ACD296752E51565DD64C728CF9AE4FD1B241CBA63B06ED91C8EBC00F32066B7AFA7EC5AC189B2BDD83C
Malicious:	false
Preview:	PK..........mY................Autofill/PK..........mY................Cookies/PK..........mY................Passwords/PK............mY.........................A....Autofill/PK............mY.........................A'...Cookies/PK............mY.........................AM...Passwords/PK..............u.....

C:\Users\user\AppData\Roaming\All_Wallets.zip

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	Zip archive data (empty)
Category:	modified
Size (bytes):	22
Entropy (8bit):	1.0476747992754052
Encrypted:	false
SSDEEP:	3:pjt/l:Nt
MD5:	76CDB2BAD9582D23C1F6F4D868218D6C
SHA1:	B04F3EE8F5E43FA3B162981B50BB72FE1ACABB33
SHA-256:	8739C76E681F900923B900C9DF0EF75CF421D39CABB54650C4B9AD19B6A76D85
SHA-512:	5E2F959F36B66DF0580A94F384C5FC1CEEEC4B2A3925F062D7B68F21758B86581AC2ADCFDDE73A171A28496E758EF1B23CA4951C05455CDAE9357CC3B5A5825F
Malicious:	false
Preview:	PK....................

C:\Users\user\AppData\Roaming\unrealgame\0b4ee70a-a6d7-424f-8ed5-b15c7dc3a9f2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.588073332967388
Encrypted:	false
SSDEEP:	6:YKWCRgXt9RdrtybHCDf2mvkinVEjmlxtUjXCT04d7hshEUSbxg+vF5aHvoXKUlaT:YKWSg99rrt+Uz9Ll8CTj7hs3uxKuwjZ9
MD5:	4E4C72188DA790BF15BD97E6D27C2475
SHA1:	166652E91551582FAB3E6F7C7CFF235E2614F79D
SHA-256:	256C31721F338EC2BB16C490756A20D150D9EDF887F305BD4A82FFF873FA53B2
SHA-512:	0F44A7E331E95ED9C438FFA2276A93E45B9B2CFAF38C2C6EF98F4A4FC42530E90F8A9CC08425B1FD01DB548CD722D60E90C737828589FF9AEA137B3EBEE8EB05
Malicious:	false
Preview:	{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1GEC8P84bQaiSJnQSZc6wAAAAAAIAAAAAABBmAAAAAQAAIAAAACVjSt1zC0yao1BwSaUJChJnHIhTTSAlY9Abg2wu9QlfAAAAAA6AAAAAAgAAIAAAAJuDcq8NTg4chuGogKMLTsQb+ccN02su8HlSlpmx+PI2MAAAADl/1eLvtXTbVrjQL55up8KkL0FEnWXjhmc/GchdZlWxe4+m3ZpFP5MPVjcxjrzy50AAAAA/dQHsCJX+6ZgFJOeH2GDfXbiH806TOAht/bS5rwDlmY9TpFJyWnJdpAIumfjckeIgo0XecbAThwYStydoFh2Z"}}

C:\Users\user\AppData\Roaming\unrealgame\Local State (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.588073332967388
Encrypted:	false
SSDEEP:	6:YKWCRgXt9RdrtybHCDf2mvkinVEjmlxtUjXCT04d7hshEUSbxg+vF5aHvoXKUlaT:YKWSg99rrt+Uz9Ll8CTj7hs3uxKuwjZ9
MD5:	4E4C72188DA790BF15BD97E6D27C2475
SHA1:	166652E91551582FAB3E6F7C7CFF235E2614F79D
SHA-256:	256C31721F338EC2BB16C490756A20D150D9EDF887F305BD4A82FFF873FA53B2
SHA-512:	0F44A7E331E95ED9C438FFA2276A93E45B9B2CFAF38C2C6EF98F4A4FC42530E90F8A9CC08425B1FD01DB548CD722D60E90C737828589FF9AEA137B3EBEE8EB05
Malicious:	false
Preview:	{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1GEC8P84bQaiSJnQSZc6wAAAAAAIAAAAAABBmAAAAAQAAIAAAACVjSt1zC0yao1BwSaUJChJnHIhTTSAlY9Abg2wu9QlfAAAAAA6AAAAAAgAAIAAAAJuDcq8NTg4chuGogKMLTsQb+ccN02su8HlSlpmx+PI2MAAAADl/1eLvtXTbVrjQL55up8KkL0FEnWXjhmc/GchdZlWxe4+m3ZpFP5MPVjcxjrzy50AAAAA/dQHsCJX+6ZgFJOeH2GDfXbiH806TOAht/bS5rwDlmY9TpFJyWnJdpAIumfjckeIgo0XecbAThwYStydoFh2Z"}}

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4037)
Category:	downloaded
Size (bytes):	4042
Entropy (8bit):	5.841472571923388
Encrypted:	false
SSDEEP:	96:HYTli2nIN6666VeRkogikyqcaSFPMazfj11lD8k5200IHiuRT/mzM7EDZx9LQffY:gSN6666Ve8ybvz7LlD5200ItJYL9/
MD5:	04B12D8DE5D0DAC3816ABF8AC8FBFF8C
SHA1:	324B8BA1FECB8945940D522501B411A3E74B5F1D
SHA-256:	79D105C3C718CBE8895160674A6A669BEAAA0B2C1F9E6EC92D1A7980402C3D09
SHA-512:	858777E34E9F4E120761FECA4443B9324C447C73A75A45629CC3E6CBBA0F589F2EB0BC6512794E83937D6C519717D05FE22C26E90B7590597C11D66729518287
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["dogecoin price prediction","wwe raw","washington commanders injury report","social security medicare premiums 2025","black ops zombies easter eggs","tropical storms hurricanes","uranus voyager","verizon fios internet outages"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CgkvbS8wMjh0bWoSG0FtZXJpY2FuIHRlbGV2aXNpb24gcHJvZ3JhbTL7EWRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWFBQUFEQVFBREFBQUFBQUFBQUFBQUFBQUVCUVlEQUFJSC84UUFOQkFBQWdFQ0JBUUVCUVFBQndBQUFBQUFBUUlEQkJFQUJSSWhCaE14UVNKUllYRVVNb0dSb2JIUjhQRVZJMEpEWW5MQi84UUFHUUVBQWdNQkFBQUF

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999984013889225
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Xeno Executor Setup 1.0.0.exe
File size:	86'060'027 bytes
MD5:	3e16cbd302cb621239608ac3caf444cf
SHA1:	9fb50388df593182080dddc0e710aca82e9a9d8d
SHA256:	b95bfdd546145dc16df5684b0f808aa993e3f0fa6ac0b9364bd95d589e34a1b7
SHA512:	4a285e6bcae460852656cef0f5629ff5058584c8feccfc7066824d584c85c4f5cd6c17ca3b6554752ffdb54af7ae4b45efe0ce45c06a4b630da1185a6b87cbce
SSDEEP:	1572864:PtJ39Kk9M1l9cNoUjrs5jB8ceyIS7nqYdd6hIEhSmn6nlN/KF1:Psk9MJcNop5j/vP7nMhJnUXKP
TLSH:	C2183345F3525725CA0BBAF5FBB185B4C8D1A1857AE3D0F12F282E85AC1C712BF62487
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

File Icon


Icon Hash:	0771ccf8d84d2907

Static PE Info

General

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0047AEECh], eax
je 00007F89E8EC5E93h
push ebx
call 00007F89E8EC9145h
cmp eax, ebx
je 00007F89E8EC5E89h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F89E8EC90BFh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F89E8EC5E6Ch
push 0000000Ah
call 00007F89E8EC9118h
push 00000008h
call 00007F89E8EC9111h
push 00000006h
mov dword ptr [0047AEE4h], eax
call 00007F89E8EC9105h
cmp eax, ebx
je 00007F89E8EC5E91h
push 0000001Eh
call eax
test eax, eax
je 00007F89E8EC5E89h
or byte ptr [0047AEEFh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0047AFB8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 00440208h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19f000	0x5980	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	7618d4c0cd8bb67ea9595b4266b3a91f	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	db8f31a08a2242d80c29e1f9500c6527	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x124000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19f000	0x5980	0x5a00	4777b871f6ac0636f5ead492412c0b06	False	0.49605034722222224	data	5.4566484228624486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19f5c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7213883677298312
RT_ICON	0x1a0670	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.6751066098081023
RT_ICON	0x1a1518	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.7851985559566786
RT_ICON	0x1a1dc0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.6560693641618497
RT_ICON	0x1a2328	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8031914893617021
RT_ICON	0x1a2790	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3118279569892473
RT_ICON	0x1a2a78	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.36824324324324326
RT_DIALOG	0x1a2ba0	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x1a2da8	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x1a2ea0	0xee	data	English	United States	0.6260504201680672
RT_DIALOG	0x1a2f90	0x1fa	data	English	United States	0.40118577075098816
RT_DIALOG	0x1a3190	0xf0	data	English	United States	0.6666666666666666
RT_DIALOG	0x1a3280	0xe6	data	English	United States	0.6565217391304348
RT_DIALOG	0x1a3368	0x1ee	data	English	United States	0.38866396761133604
RT_DIALOG	0x1a3558	0xe4	data	English	United States	0.6447368421052632
RT_DIALOG	0x1a3640	0xda	data	English	United States	0.6422018348623854
RT_DIALOG	0x1a3720	0x1ee	data	English	United States	0.3866396761133603
RT_DIALOG	0x1a3910	0xe4	data	English	United States	0.6359649122807017
RT_DIALOG	0x1a39f8	0xda	data	English	United States	0.6376146788990825
RT_DIALOG	0x1a3ad8	0x1f2	data	English	United States	0.39759036144578314
RT_DIALOG	0x1a3cd0	0xe8	data	English	United States	0.6508620689655172
RT_DIALOG	0x1a3db8	0xde	data	English	United States	0.6486486486486487
RT_DIALOG	0x1a3e98	0x202	data	English	United States	0.42217898832684825
RT_DIALOG	0x1a40a0	0xf8	data	English	United States	0.6653225806451613
RT_DIALOG	0x1a4198	0xee	data	English	United States	0.6512605042016807
RT_GROUP_ICON	0x1a4288	0x68	data	English	United States	0.6634615384615384
RT_VERSION	0x1a42f0	0x264	data	English	United States	0.48856209150326796
RT_MANIFEST	0x1a4558	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T09:53:15.864670+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49730	TCP
2024-11-13T09:53:55.336645+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49861	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 09:53:00.158183098 CET	49675	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:13.740674019 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:13.740763903 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:13.740866899 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:13.743065119 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:13.743105888 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:14.508538961 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:14.508775949 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:14.512253046 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:14.512284994 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:14.512521029 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:14.564829111 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:15.611253977 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:15.651329994 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.777333021 CET	49723	80	192.168.2.4	93.184.221.240
Nov 13, 2024 09:53:15.782954931 CET	80	49723	93.184.221.240	192.168.2.4
Nov 13, 2024 09:53:15.783040047 CET	49723	80	192.168.2.4	93.184.221.240
Nov 13, 2024 09:53:15.863598108 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.863626003 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.863637924 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.863786936 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.863809109 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:15.863846064 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.863882065 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.863919020 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.863944054 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:15.863944054 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:15.863944054 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:15.863965988 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:15.864027023 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.864084959 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:15.864094973 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.864536047 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:15.864733934 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:16.921545029 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:16.921619892 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:16.921657085 CET	49730	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:16.921675920 CET	443	49730	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:25.102628946 CET	49738	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.102665901 CET	443	49738	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:25.102725983 CET	49738	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.179336071 CET	49738	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.179352999 CET	443	49738	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:25.925012112 CET	443	49738	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:25.926059008 CET	49738	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.926069021 CET	443	49738	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:25.926958084 CET	443	49738	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:25.927088976 CET	49738	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.929748058 CET	49738	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.929796934 CET	443	49738	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:25.929913998 CET	443	49738	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:25.929979086 CET	49738	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.929979086 CET	49738	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.940557003 CET	49739	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.940653086 CET	443	49739	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:25.941546917 CET	49739	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.941546917 CET	49739	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:25.941693068 CET	443	49739	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:26.637758970 CET	443	49739	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:26.683239937 CET	49739	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:26.683274984 CET	443	49739	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:26.685950041 CET	443	49739	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:26.685990095 CET	443	49739	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:26.686059952 CET	49739	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:26.702786922 CET	49739	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:26.702889919 CET	443	49739	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:26.702958107 CET	49739	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:26.751800060 CET	49741	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:26.751893997 CET	443	49741	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:26.752019882 CET	49741	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:26.835922003 CET	49741	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:26.835974932 CET	443	49741	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:27.541599989 CET	443	49741	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:27.542151928 CET	49741	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:27.542187929 CET	443	49741	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:27.543648005 CET	443	49741	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:27.543710947 CET	49741	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:27.548660040 CET	49741	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:27.548718929 CET	443	49741	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:27.548866034 CET	443	49741	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:27.548875093 CET	49741	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:27.549063921 CET	49741	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:27.602848053 CET	49742	443	192.168.2.4	108.181.20.35
Nov 13, 2024 09:53:27.602914095 CET	443	49742	108.181.20.35	192.168.2.4
Nov 13, 2024 09:53:27.603287935 CET	49742	443	192.168.2.4	108.181.20.35
Nov 13, 2024 09:53:27.603411913 CET	49742	443	192.168.2.4	108.181.20.35
Nov 13, 2024 09:53:27.603431940 CET	443	49742	108.181.20.35	192.168.2.4
Nov 13, 2024 09:53:28.455395937 CET	443	49742	108.181.20.35	192.168.2.4
Nov 13, 2024 09:53:28.455919027 CET	49742	443	192.168.2.4	108.181.20.35
Nov 13, 2024 09:53:28.455949068 CET	443	49742	108.181.20.35	192.168.2.4
Nov 13, 2024 09:53:28.457631111 CET	443	49742	108.181.20.35	192.168.2.4
Nov 13, 2024 09:53:28.457700968 CET	49742	443	192.168.2.4	108.181.20.35
Nov 13, 2024 09:53:28.458607912 CET	49742	443	192.168.2.4	108.181.20.35
Nov 13, 2024 09:53:28.458668947 CET	443	49742	108.181.20.35	192.168.2.4
Nov 13, 2024 09:53:28.458770990 CET	49742	443	192.168.2.4	108.181.20.35
Nov 13, 2024 09:53:28.540472984 CET	49743	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:28.540496111 CET	443	49743	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:28.540548086 CET	49743	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:28.541795969 CET	49743	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:28.541811943 CET	443	49743	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:29.386493921 CET	443	49743	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:29.386626959 CET	49743	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:29.659710884 CET	49743	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:29.659774065 CET	443	49743	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:29.660175085 CET	443	49743	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:29.706818104 CET	49743	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:29.796881914 CET	49743	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:29.839328051 CET	443	49743	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:30.038360119 CET	443	49743	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:30.038444996 CET	443	49743	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:30.039350033 CET	49743	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:30.039350033 CET	49743	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:30.040622950 CET	49743	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:30.040657997 CET	443	49743	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:30.128709078 CET	49744	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:30.128801107 CET	443	49744	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:30.129633904 CET	49744	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:30.130146027 CET	49744	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:30.130202055 CET	443	49744	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:30.971263885 CET	443	49744	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:30.971371889 CET	49744	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:30.972747087 CET	49744	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:30.972776890 CET	443	49744	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:30.973171949 CET	443	49744	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:30.974667072 CET	49744	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:31.015372992 CET	443	49744	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:31.054110050 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.054161072 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.054219007 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.054449081 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.054460049 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.216481924 CET	443	49744	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:31.216562033 CET	443	49744	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:31.216634989 CET	49744	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:31.217484951 CET	49744	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:31.217533112 CET	443	49744	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:31.217562914 CET	49744	443	192.168.2.4	184.28.90.27
Nov 13, 2024 09:53:31.217580080 CET	443	49744	184.28.90.27	192.168.2.4
Nov 13, 2024 09:53:31.461070061 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.461160898 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.461261988 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.461688042 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.461776972 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.503866911 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.503964901 CET	443	49750	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.504379988 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.504591942 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.504627943 CET	443	49750	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.535212040 CET	49751	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.535295963 CET	443	49751	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.535504103 CET	49751	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.535712004 CET	49751	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.535749912 CET	443	49751	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.911804914 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.912122011 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.912184954 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.913228989 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.913291931 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.914427996 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.914494991 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.914601088 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.955333948 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:31.970113039 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:31.970175982 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.031641006 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.189640045 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.189785957 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.192687035 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.192759037 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.209475994 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.210496902 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.210561037 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.214157104 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.214271069 CET	443	49748	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.214346886 CET	49748	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.309315920 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.318844080 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.318907976 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.320452929 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.320596933 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.326272964 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.326399088 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.334347963 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.334409952 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.373852015 CET	443	49750	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.374141932 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.374208927 CET	443	49750	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.375667095 CET	443	49750	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.375734091 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.375874043 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.382652998 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.382755041 CET	443	49750	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.385792971 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.385809898 CET	443	49750	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.415250063 CET	443	49751	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.419461966 CET	49751	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.419528008 CET	443	49751	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.420298100 CET	443	49751	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.420468092 CET	49751	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.437767029 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.438704014 CET	49751	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.438939095 CET	443	49751	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.484782934 CET	49751	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.484848022 CET	443	49751	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.531555891 CET	49751	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.613596916 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.613667965 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.613751888 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.613759041 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.613770962 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.613825083 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.613856077 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.613922119 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.622064114 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.622236967 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.622301102 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.672238111 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.672301054 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.676572084 CET	443	49750	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.730580091 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.730647087 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.730710983 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.733442068 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.733484030 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.733491898 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.733515978 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.733572960 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.734859943 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.734926939 CET	443	49750	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.737171888 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.737377882 CET	443	49750	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.737447023 CET	49750	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.737634897 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.746556044 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.746630907 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.746648073 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.755098104 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.755141020 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.755155087 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.797324896 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.847522974 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.850269079 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.850322008 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.850344896 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.850414038 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.850465059 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.854552984 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.863351107 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.863398075 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.863413095 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.872143030 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.872189045 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.872193098 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.872208118 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.872251987 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.872265100 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.922347069 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.964229107 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.967127085 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.967175961 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.967185020 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.967251062 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.967305899 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.971498013 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.980166912 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.980207920 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.980209112 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.980236053 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.980277061 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.988945007 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.989037991 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.989075899 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:32.989084005 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.989098072 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:32.989131927 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.081224918 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.084101915 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.084151030 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.084145069 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.084209919 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.084259987 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.088944912 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.097515106 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.097558022 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.097573996 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.106555939 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.106601000 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.106600046 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.106617928 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.106666088 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.106681108 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.156687021 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.156749010 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.203597069 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.208203077 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.208292007 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.208332062 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.208342075 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.208386898 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.208437920 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.208452940 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.214267969 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.214333057 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.214342117 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.214364052 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.214426994 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.223375082 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.223509073 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.223546028 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.223548889 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.223570108 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.223608971 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.223620892 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.266185045 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.408617973 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.408786058 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.408967018 CET	443	49749	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.409038067 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.409039021 CET	49749	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.420628071 CET	49751	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:33.420839071 CET	443	49751	216.58.206.68	192.168.2.4
Nov 13, 2024 09:53:33.420965910 CET	49751	443	192.168.2.4	216.58.206.68
Nov 13, 2024 09:53:34.239238977 CET	49755	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:34.244239092 CET	53	49755	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:34.247483015 CET	49755	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:34.251008034 CET	49755	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:34.251121998 CET	49755	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:34.255853891 CET	53	49755	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:34.255965948 CET	53	49755	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:34.819905996 CET	49760	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:34.819935083 CET	443	49760	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:34.819988012 CET	49760	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:34.820312023 CET	49760	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:34.820319891 CET	443	49760	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:34.852564096 CET	53	49755	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:34.855879068 CET	49755	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:34.862622976 CET	53	49755	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:34.862689972 CET	49755	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:35.725514889 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:35.725601912 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:35.725675106 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:35.725856066 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:35.725894928 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:35.989507914 CET	443	49760	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:35.989594936 CET	49760	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:35.999672890 CET	49766	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:35.999691010 CET	443	49766	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:35.999882936 CET	49766	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:36.000771999 CET	49766	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:36.000785112 CET	443	49766	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:36.005610943 CET	49760	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:36.005623102 CET	443	49760	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:36.005979061 CET	443	49760	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:36.006299019 CET	49760	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:36.006330967 CET	49760	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:36.006347895 CET	443	49760	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:36.436055899 CET	443	49760	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:36.560914040 CET	443	49760	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:36.560983896 CET	49760	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:36.561079979 CET	49760	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:36.561096907 CET	443	49760	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:36.561110020 CET	49760	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:36.561115980 CET	443	49760	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:36.624730110 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.625082970 CET	443	49766	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:36.625264883 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.625330925 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.625684023 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.625695944 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.625865936 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.625931978 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.625993013 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.626282930 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.627444983 CET	49766	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:36.627456903 CET	443	49766	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:36.627671003 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.627778053 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.627784967 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.629008055 CET	443	49766	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:36.629071951 CET	49766	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:36.636158943 CET	49766	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:36.636254072 CET	443	49766	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:36.637036085 CET	49766	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:36.637052059 CET	443	49766	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:36.671410084 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.677150965 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:36.677181959 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:36.677381039 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:36.677422047 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:36.677433014 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:36.756769896 CET	49766	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:36.756778955 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.756802082 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.769522905 CET	443	49766	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:36.769701004 CET	443	49766	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:36.769752979 CET	49766	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:36.776549101 CET	49766	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:36.776561975 CET	443	49766	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:36.889552116 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.889633894 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.889659882 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.893662930 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.893718004 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.893726110 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.903171062 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.903233051 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.903240919 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.910434008 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.910506010 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.910512924 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:36.955274105 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:36.955281019 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.009031057 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.009119034 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.009144068 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.013081074 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.013140917 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.013149023 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.022669077 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.022735119 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.022742033 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.032061100 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.032119989 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.032128096 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.083969116 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.084047079 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.084070921 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.130718946 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.130786896 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.130798101 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.137963057 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.138024092 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.138031006 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.144700050 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.144757986 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.144767046 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.153532028 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.153597116 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.153604984 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.154066086 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.154109955 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.154115915 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.211164951 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.211256027 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.211266041 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.252697945 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.252768040 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.252784014 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.259778976 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.259829044 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.259836912 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.269010067 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.269068956 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.269103050 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.275818110 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.275887966 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.275897980 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.327900887 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.327982903 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.328016996 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.374819040 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.374903917 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.374969006 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.379134893 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.379194021 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.379196882 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.379229069 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.379271030 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.382504940 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.391222954 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.391299963 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.391309023 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.397511959 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.397574902 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.397583008 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.449662924 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.449738979 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.449748039 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.496738911 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.496814013 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.496853113 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.500922918 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.500976086 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.500993013 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.504319906 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.504369974 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.504384041 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.513190985 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.513247013 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.513262033 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.519409895 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.519469976 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.519484997 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.559653997 CET	49784	443	192.168.2.4	18.244.18.122
Nov 13, 2024 09:53:37.559674025 CET	443	49784	18.244.18.122	192.168.2.4
Nov 13, 2024 09:53:37.559732914 CET	49784	443	192.168.2.4	18.244.18.122
Nov 13, 2024 09:53:37.560525894 CET	49784	443	192.168.2.4	18.244.18.122
Nov 13, 2024 09:53:37.560551882 CET	443	49784	18.244.18.122	192.168.2.4
Nov 13, 2024 09:53:37.571557999 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.571650982 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.571688890 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.618565083 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.618633986 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.618674994 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.623074055 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.623157978 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.623230934 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.623248100 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.623325109 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.625729084 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.632643938 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.632711887 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.632726908 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.640567064 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.640669107 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.640685081 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.640702009 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.641093016 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.687869072 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.693218946 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.693408012 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.693474054 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.740706921 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.744991064 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.745171070 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.746504068 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.746568918 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.747183084 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:37.747275114 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:37.747348070 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:37.747515917 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:37.747540951 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:37.747634888 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.747705936 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.747724056 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.754451036 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.754539013 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.754554033 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.762784004 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.762852907 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.762866974 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.788213968 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:37.790605068 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:37.790694952 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:37.791273117 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:37.791290045 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:37.791374922 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:37.791400909 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:37.815345049 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.815572023 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.815638065 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.860069990 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.861190081 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.861255884 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.862339020 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.862410069 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.862428904 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.867355108 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.867417097 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.867432117 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.869843960 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.869921923 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.869940042 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.869967937 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.870033026 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.870099068 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.870234966 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.870256901 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.870285034 CET	443	49764	142.250.186.97	192.168.2.4
Nov 13, 2024 09:53:37.870316029 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.870353937 CET	49764	443	192.168.2.4	142.250.186.97
Nov 13, 2024 09:53:37.872313023 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:37.872325897 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:37.872463942 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:37.872632027 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:37.872636080 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:37.886950970 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:37.887012005 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:37.887104988 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:37.887250900 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:37.887281895 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.401588917 CET	443	49784	18.244.18.122	192.168.2.4
Nov 13, 2024 09:53:38.404997110 CET	49784	443	192.168.2.4	18.244.18.122
Nov 13, 2024 09:53:38.405060053 CET	443	49784	18.244.18.122	192.168.2.4
Nov 13, 2024 09:53:38.406641006 CET	443	49784	18.244.18.122	192.168.2.4
Nov 13, 2024 09:53:38.406747103 CET	49784	443	192.168.2.4	18.244.18.122
Nov 13, 2024 09:53:38.410824060 CET	49784	443	192.168.2.4	18.244.18.122
Nov 13, 2024 09:53:38.410922050 CET	443	49784	18.244.18.122	192.168.2.4
Nov 13, 2024 09:53:38.478209972 CET	49784	443	192.168.2.4	18.244.18.122
Nov 13, 2024 09:53:38.478275061 CET	443	49784	18.244.18.122	192.168.2.4
Nov 13, 2024 09:53:38.483303070 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.483642101 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.483705044 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.485332966 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.485428095 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.486155987 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.486248016 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.486402035 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.486418009 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.611399889 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.611848116 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.611860037 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.612917900 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.612972975 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.613281012 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.613344908 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.613409042 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.613415956 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.615329981 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.615389109 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.615407944 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.615534067 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.615534067 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.615534067 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.616897106 CET	49787	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.616938114 CET	443	49787	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.617042065 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.617518902 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.617579937 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.619024992 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.619103909 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.625443935 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.625540018 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.625550032 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.667349100 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.667784929 CET	49791	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:38.667803049 CET	443	49791	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:38.667860031 CET	49791	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:38.668207884 CET	49792	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:38.668229103 CET	49791	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:38.668242931 CET	443	49791	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:38.668297052 CET	443	49792	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:38.668370962 CET	49792	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:38.668570995 CET	49792	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:38.668611050 CET	443	49792	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:38.673232079 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.673240900 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.673243999 CET	49784	443	192.168.2.4	18.244.18.122
Nov 13, 2024 09:53:38.673263073 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.730304003 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:38.730360031 CET	443	49793	162.159.61.3	192.168.2.4
Nov 13, 2024 09:53:38.730437994 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:38.730988979 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:38.731026888 CET	443	49793	162.159.61.3	192.168.2.4
Nov 13, 2024 09:53:38.782943010 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.863960981 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.863984108 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.863990068 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.864039898 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.864056110 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.864104986 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.864125967 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.864151001 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.864161015 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.864161015 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.864177942 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.864204884 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.869715929 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.869776964 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.869797945 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.869818926 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.869851112 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.869851112 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.869858027 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.869880915 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.869890928 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.869910002 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.869924068 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.869931936 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.869972944 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.982929945 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.982994080 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.983015060 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.983021975 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.983045101 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.983076096 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.986525059 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.986557007 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.986605883 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.986609936 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.986625910 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.986680031 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.986680031 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.986680031 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:38.986716032 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:38.986768007 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.101701021 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.101759911 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.101779938 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.101788998 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.101814985 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.101824999 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.103385925 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.103452921 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.103496075 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.103566885 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.103616953 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.103642941 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.220408916 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.220442057 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.220503092 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.220511913 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.220544100 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.220565081 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.220695019 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.220767975 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.220798969 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.220869064 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.220905066 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.220928907 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.221097946 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.221177101 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.221183062 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.221292973 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.221566916 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.222709894 CET	49789	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.222717047 CET	443	49789	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.274285078 CET	443	49792	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.274525881 CET	49792	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.274543047 CET	443	49792	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.275748968 CET	443	49792	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.275816917 CET	49792	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.277216911 CET	49792	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.277303934 CET	443	49792	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.277390003 CET	49792	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.286586046 CET	443	49791	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.286832094 CET	49791	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.286839962 CET	443	49791	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.288908005 CET	443	49791	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.288978100 CET	49791	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.289767027 CET	49791	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.289849997 CET	443	49791	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.289900064 CET	49791	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.289905071 CET	443	49791	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.319325924 CET	443	49792	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.333731890 CET	49791	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.337476969 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.337542057 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.337604046 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.337677002 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.337718010 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.337744951 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.338587046 CET	443	49793	162.159.61.3	192.168.2.4
Nov 13, 2024 09:53:39.338990927 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:39.339013100 CET	443	49793	162.159.61.3	192.168.2.4
Nov 13, 2024 09:53:39.342570066 CET	443	49793	162.159.61.3	192.168.2.4
Nov 13, 2024 09:53:39.342660904 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:39.343579054 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:39.343741894 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:39.343765974 CET	443	49793	162.159.61.3	192.168.2.4
Nov 13, 2024 09:53:39.392539024 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:39.392565966 CET	443	49793	162.159.61.3	192.168.2.4
Nov 13, 2024 09:53:39.403403997 CET	443	49792	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.403450966 CET	49792	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.403666019 CET	49792	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.403683901 CET	443	49792	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.417207956 CET	443	49791	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.417280912 CET	443	49791	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.417417049 CET	49791	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.417493105 CET	49791	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.417499065 CET	443	49791	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.439726114 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:39.454814911 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.454927921 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.454966068 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.455001116 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.455034018 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.455306053 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.476988077 CET	443	49793	162.159.61.3	192.168.2.4
Nov 13, 2024 09:53:39.477142096 CET	443	49793	162.159.61.3	192.168.2.4
Nov 13, 2024 09:53:39.477212906 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:39.477325916 CET	49793	443	192.168.2.4	162.159.61.3
Nov 13, 2024 09:53:39.477365017 CET	443	49793	162.159.61.3	192.168.2.4
Nov 13, 2024 09:53:39.571860075 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.571923971 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.571954012 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.572002888 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.572037935 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.572103024 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.576736927 CET	49796	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.576788902 CET	443	49796	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.576855898 CET	49796	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.577013969 CET	49797	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.577024937 CET	443	49797	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.577078104 CET	49797	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.577430964 CET	49796	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.577464104 CET	443	49796	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.577627897 CET	49797	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.577640057 CET	443	49797	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:39.688502073 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.688572884 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.688749075 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.688750029 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.688817978 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.688879967 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.799412012 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.799482107 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.799628019 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.799628019 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.799695969 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.799752951 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.849752903 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.849821091 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.849864960 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.849937916 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.849986076 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.850011110 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.923266888 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.923422098 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.923552990 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.923552990 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:39.923624039 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:39.923809052 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.372370005 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.372406006 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.372459888 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.372581959 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.372582912 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.372582912 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.372656107 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.372701883 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.372795105 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.374353886 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.374402046 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.374469042 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.374484062 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.374550104 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.374594927 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.376144886 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.376187086 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.376279116 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.376295090 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.376355886 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.376821041 CET	443	49797	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.378489017 CET	49797	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.378503084 CET	443	49797	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.378936052 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.378938913 CET	443	49797	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.378978968 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.379004002 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.379029036 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.379065037 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.379087925 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.380249977 CET	49797	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.380327940 CET	443	49797	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.383268118 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.383332968 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.383344889 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.383363008 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.383409023 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.383409023 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.384144068 CET	443	49796	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.384393930 CET	49796	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.384413958 CET	443	49796	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.385632992 CET	443	49796	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.385938883 CET	49796	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.386128902 CET	443	49796	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.395205975 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.395261049 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.395286083 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.395302057 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.395361900 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.395361900 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.431687117 CET	49796	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.477054119 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:40.477113008 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:40.477157116 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:40.477327108 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:40.477327108 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:40.477399111 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:40.477478981 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:40.477849007 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:40.477849007 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:40.477870941 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:40.478066921 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:40.478101969 CET	443	49771	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:40.478188992 CET	49771	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:40.493864059 CET	49797	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.509043932 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.509078979 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.509145975 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.509217978 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.509263039 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.509536982 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.512372017 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.512408018 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.512444019 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.512484074 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.512522936 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.512525082 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.512577057 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.514416933 CET	49790	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:40.514447927 CET	443	49790	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:40.518096924 CET	49799	443	192.168.2.4	142.250.114.95
Nov 13, 2024 09:53:40.518141031 CET	443	49799	142.250.114.95	192.168.2.4
Nov 13, 2024 09:53:40.518309116 CET	49799	443	192.168.2.4	142.250.114.95
Nov 13, 2024 09:53:40.518630981 CET	49799	443	192.168.2.4	142.250.114.95
Nov 13, 2024 09:53:40.518673897 CET	443	49799	142.250.114.95	192.168.2.4
Nov 13, 2024 09:53:40.539344072 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:40.539431095 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:40.539546967 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:40.539817095 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:40.539855957 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:40.883275032 CET	49801	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.883362055 CET	443	49801	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.883383036 CET	49802	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.883455038 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.883488894 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.883521080 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.883546114 CET	49801	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.883564949 CET	49802	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.883611917 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.883819103 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.883835077 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.883910894 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.884040117 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.884125948 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.884207010 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.884316921 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.884322882 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.884370089 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.884984016 CET	49801	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.885024071 CET	443	49801	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.885154963 CET	49802	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.885193110 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.885514975 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.885544062 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.885729074 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.885742903 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.885915041 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.885951042 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:40.886086941 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:40.886101961 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.144105911 CET	443	49799	142.250.114.95	192.168.2.4
Nov 13, 2024 09:53:41.144426107 CET	49799	443	192.168.2.4	142.250.114.95
Nov 13, 2024 09:53:41.144464016 CET	443	49799	142.250.114.95	192.168.2.4
Nov 13, 2024 09:53:41.146116018 CET	443	49799	142.250.114.95	192.168.2.4
Nov 13, 2024 09:53:41.146209002 CET	49799	443	192.168.2.4	142.250.114.95
Nov 13, 2024 09:53:41.147300005 CET	49799	443	192.168.2.4	142.250.114.95
Nov 13, 2024 09:53:41.147408962 CET	443	49799	142.250.114.95	192.168.2.4
Nov 13, 2024 09:53:41.147488117 CET	49799	443	192.168.2.4	142.250.114.95
Nov 13, 2024 09:53:41.191423893 CET	443	49799	142.250.114.95	192.168.2.4
Nov 13, 2024 09:53:41.282864094 CET	49799	443	192.168.2.4	142.250.114.95
Nov 13, 2024 09:53:41.282888889 CET	443	49799	142.250.114.95	192.168.2.4
Nov 13, 2024 09:53:41.306910038 CET	443	49799	142.250.114.95	192.168.2.4
Nov 13, 2024 09:53:41.306993961 CET	49799	443	192.168.2.4	142.250.114.95
Nov 13, 2024 09:53:41.307769060 CET	49799	443	192.168.2.4	142.250.114.95
Nov 13, 2024 09:53:41.307810068 CET	443	49799	142.250.114.95	192.168.2.4
Nov 13, 2024 09:53:41.352893114 CET	49807	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.352992058 CET	443	49807	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.353082895 CET	49807	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.353251934 CET	49808	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.353281021 CET	443	49808	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.353368044 CET	49807	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.353403091 CET	443	49807	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.353445053 CET	49808	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.353856087 CET	49808	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.353868961 CET	443	49808	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.382497072 CET	49672	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:41.394361973 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:41.394449949 CET	443	49809	173.222.162.32	192.168.2.4
Nov 13, 2024 09:53:41.396359921 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:41.396727085 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:41.396768093 CET	443	49809	173.222.162.32	192.168.2.4
Nov 13, 2024 09:53:41.617470026 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.617583036 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.617873907 CET	49802	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.617886066 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.618410110 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.619000912 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.619067907 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.619972944 CET	49802	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.620074987 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.620404005 CET	49802	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.620635986 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.620719910 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.621597052 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.621711016 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.621763945 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.625103951 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.626336098 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.627468109 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.627481937 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.627582073 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.627648115 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.629110098 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.629134893 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.629179955 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.629206896 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.629488945 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.629579067 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.629709005 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.629796028 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.629821062 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.629838943 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.629872084 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.629880905 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.651379108 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:41.652777910 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:41.652869940 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:41.653238058 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:41.653255939 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:41.653318882 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:41.653337955 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:41.656183958 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.656615019 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.656624079 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.658256054 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.658324957 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.658963919 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.659041882 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.659497023 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.663331985 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.663351059 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.672713995 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.672805071 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.672883987 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.672946930 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.691488028 CET	49672	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:41.703336954 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.746499062 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.746556997 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.746702909 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.746777058 CET	49802	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.746777058 CET	49802	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.748780966 CET	49802	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.748822927 CET	443	49802	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.749224901 CET	49810	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.749311924 CET	443	49810	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.751652002 CET	49810	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.752032995 CET	49810	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.752072096 CET	443	49810	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.761847019 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.761904001 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.761979103 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.761989117 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.762444973 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.762515068 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.763324976 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.763331890 CET	443	49804	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.763360023 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.763386011 CET	49804	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.863415003 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.863744020 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.878355026 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.914197922 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.914258957 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.914382935 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.914417028 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.914612055 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.914832115 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.915333033 CET	49803	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.915373087 CET	443	49803	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.925899982 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.925976992 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.926112890 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.926135063 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.926214933 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.926944971 CET	49805	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.926981926 CET	443	49805	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.953274965 CET	443	49808	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.953722954 CET	49808	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.953737974 CET	443	49808	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.954025984 CET	443	49808	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.954293013 CET	49808	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.954345942 CET	443	49808	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.961590052 CET	443	49801	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.961782932 CET	49801	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.961805105 CET	443	49801	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.962428093 CET	443	49801	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.962625027 CET	443	49807	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.962702990 CET	49801	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.962811947 CET	443	49801	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.962847948 CET	49807	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.962910891 CET	443	49807	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.962939978 CET	49801	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.964032888 CET	443	49807	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.964319944 CET	49807	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.964502096 CET	443	49807	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.996582031 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.996644020 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.996795893 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.996803045 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.996855021 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:41.997104883 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.997374058 CET	49806	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:41.997379065 CET	443	49806	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.002370119 CET	49808	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:42.003351927 CET	443	49801	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.018050909 CET	49807	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:42.071038961 CET	443	49809	173.222.162.32	192.168.2.4
Nov 13, 2024 09:53:42.071264982 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:42.092256069 CET	443	49801	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.092428923 CET	443	49801	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.092622042 CET	49801	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:42.093226910 CET	49801	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:42.093267918 CET	443	49801	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.103394032 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:42.103476048 CET	443	49809	173.222.162.32	192.168.2.4
Nov 13, 2024 09:53:42.104240894 CET	443	49809	173.222.162.32	192.168.2.4
Nov 13, 2024 09:53:42.104309082 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:42.104722977 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:42.104798079 CET	443	49809	173.222.162.32	192.168.2.4
Nov 13, 2024 09:53:42.104844093 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:42.104860067 CET	443	49809	173.222.162.32	192.168.2.4
Nov 13, 2024 09:53:42.108273983 CET	49812	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:42.108361006 CET	443	49812	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:42.108443975 CET	49812	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:42.108618021 CET	49812	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:42.108638048 CET	443	49812	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:42.296569109 CET	49672	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:42.336631060 CET	443	49809	173.222.162.32	192.168.2.4
Nov 13, 2024 09:53:42.336740971 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:42.336807966 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:42.336920023 CET	443	49809	173.222.162.32	192.168.2.4
Nov 13, 2024 09:53:42.337148905 CET	49809	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:42.376705885 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:42.376769066 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:42.376904964 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:42.376976967 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:42.376976967 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:42.377047062 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:42.378185034 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:42.378185034 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:42.378233910 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:42.378552914 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:42.378637075 CET	443	49800	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:42.378731012 CET	49800	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:42.409650087 CET	49813	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:42.409738064 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:42.409905910 CET	49813	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:42.410058022 CET	49813	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:42.410083055 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:42.514111042 CET	443	49810	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.514475107 CET	49810	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:42.514540911 CET	443	49810	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.515691996 CET	443	49810	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.515983105 CET	49810	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:42.516118050 CET	49810	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:42.516163111 CET	443	49810	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.647105932 CET	443	49810	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.647257090 CET	443	49810	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.647288084 CET	49810	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:42.647386074 CET	49810	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:42.648076057 CET	49810	443	192.168.2.4	13.107.246.57
Nov 13, 2024 09:53:42.648113966 CET	443	49810	13.107.246.57	192.168.2.4
Nov 13, 2024 09:53:42.763137102 CET	443	49812	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:42.763416052 CET	49812	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:42.763439894 CET	443	49812	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:42.763945103 CET	443	49812	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:42.764251947 CET	49812	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:42.764338017 CET	443	49812	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:42.764429092 CET	49812	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:42.764456034 CET	49812	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:42.764465094 CET	443	49812	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:42.916544914 CET	443	49812	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:42.939224005 CET	443	49812	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:42.939301968 CET	49812	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:42.939624071 CET	49812	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:42.939665079 CET	443	49812	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:43.361489058 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:43.361532927 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:43.361630917 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:43.361812115 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:43.361828089 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:43.501624107 CET	49672	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:43.534010887 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.534754038 CET	49813	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.534784079 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.535533905 CET	49813	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.535542965 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.535645962 CET	49813	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.535657883 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.788932085 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:43.789021015 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:43.789118052 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:43.789479971 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:43.789505005 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:43.917299032 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.917352915 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.920624971 CET	49813	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.920689106 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.920793056 CET	49813	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.920793056 CET	49813	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.920836926 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.921169043 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.921248913 CET	443	49813	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.921320915 CET	49813	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.929939032 CET	49817	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.930006981 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.930270910 CET	49817	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.930486917 CET	49817	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.930521011 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.932776928 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.932806015 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.933423996 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.933549881 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:43.933559895 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:43.989872932 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:43.991555929 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:43.991621971 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:43.992805958 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:43.996944904 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:43.997041941 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:43.997041941 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:43.997073889 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:43.997226000 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.052335978 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.238964081 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.239026070 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.239044905 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.239124060 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.239149094 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.239211082 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.239238977 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.239291906 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.239365101 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.239365101 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.239365101 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.239365101 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.354213953 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.354281902 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.354382992 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.354383945 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.354418039 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.354648113 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.417366028 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.417409897 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.417536020 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.417536974 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.417571068 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.417634010 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.488744020 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.488810062 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.488928080 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.488928080 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.488961935 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.489021063 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.603759050 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.603872061 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.603984118 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.603985071 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.604018927 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.604070902 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.718877077 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.718935966 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.719050884 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.719050884 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.719085932 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.719134092 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.815541983 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.815606117 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.815632105 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.815677881 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.815707922 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.815840960 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.834794044 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.834983110 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.835010052 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.835042000 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.835064888 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.835088015 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.835130930 CET	443	49814	4.150.155.223	192.168.2.4
Nov 13, 2024 09:53:44.835239887 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:44.835261106 CET	49814	443	192.168.2.4	4.150.155.223
Nov 13, 2024 09:53:45.029161930 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.029656887 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:45.029697895 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.030199051 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:45.030208111 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.030232906 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:45.030246019 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.037873030 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.038188934 CET	49817	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:45.038220882 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.038645029 CET	49817	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:45.038645029 CET	49817	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:45.038659096 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.038681984 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.410181046 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.410197973 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.410310030 CET	49817	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:45.410335064 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.410541058 CET	49817	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:45.410542011 CET	49817	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:45.410564899 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.410715103 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.410749912 CET	443	49817	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:45.411073923 CET	49817	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:45.569904089 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:45.570144892 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:45.572599888 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:45.572659016 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:45.572993994 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:45.582472086 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:45.623406887 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:45.815237045 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:45.815256119 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:45.815399885 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:45.815598011 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:45.815598011 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:45.815666914 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:45.815979958 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:45.906640053 CET	49672	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:45.962507963 CET	49819	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:45.962542057 CET	443	49819	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:45.962680101 CET	49819	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:45.962918997 CET	49819	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:45.962929010 CET	443	49819	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:46.085678101 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.085716963 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.085774899 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.085867882 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.085867882 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.085897923 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.085906029 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.086111069 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.087793112 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.087853909 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.088015079 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.088015079 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.088083029 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.088478088 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.173913956 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.173976898 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.174138069 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.174202919 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.174251080 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.174470901 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.377381086 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.377451897 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.377578974 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.377579927 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.377646923 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.377707005 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.496876001 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.496946096 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.497087955 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.497088909 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.497158051 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.497219086 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.616092920 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.616158962 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.616292953 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.616292953 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.616292953 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.616370916 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.616573095 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.651639938 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.651710987 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.651799917 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.651799917 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.651823044 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.651990891 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.660367012 CET	443	49819	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:46.660759926 CET	49819	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:46.660774946 CET	443	49819	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:46.662194967 CET	443	49819	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:46.662257910 CET	49819	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:46.662838936 CET	49819	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:46.662879944 CET	443	49819	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:46.663032055 CET	443	49819	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:46.663078070 CET	49819	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:46.663096905 CET	49819	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:46.770628929 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.770697117 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.770832062 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.770832062 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.770901918 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.770960093 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.808032036 CET	49820	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:46.808125973 CET	443	49820	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:46.808233976 CET	49820	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:46.810009003 CET	49820	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:46.810050011 CET	443	49820	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:46.889647961 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.889723063 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.889892101 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.889892101 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:46.889959097 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:46.890785933 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.008455038 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.008531094 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.008694887 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.008696079 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.008764029 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.008821011 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.127491951 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.127553940 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.127696037 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.127696037 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.127764940 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.127831936 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.246717930 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.246783972 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.246823072 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.246846914 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.246860981 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.247050047 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.247076035 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.247100115 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.247114897 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.247199059 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.247245073 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.251266003 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.251280069 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.251306057 CET	49815	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.251312017 CET	443	49815	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.319988012 CET	49821	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.320034027 CET	443	49821	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.320200920 CET	49821	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.320533991 CET	49822	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.320559025 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.320625067 CET	49822	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.320663929 CET	49823	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.320676088 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.320729017 CET	49823	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.325874090 CET	49821	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.325895071 CET	443	49821	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.326021910 CET	49822	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.326035976 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.326194048 CET	49823	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.326210022 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.326603889 CET	49824	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.326642990 CET	443	49824	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.326961040 CET	49825	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.326987028 CET	49824	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.326987028 CET	49824	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.326996088 CET	443	49825	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.327029943 CET	443	49824	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.327044964 CET	49825	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.327136993 CET	49825	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:47.327147961 CET	443	49825	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:47.497220993 CET	443	49820	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:47.497951031 CET	49820	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:47.498014927 CET	443	49820	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:47.501616001 CET	443	49820	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:47.501701117 CET	49820	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:47.502542019 CET	49820	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:47.502702951 CET	443	49820	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:47.502787113 CET	49820	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:48.060622931 CET	443	49824	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.061247110 CET	443	49821	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.063168049 CET	49821	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.063211918 CET	443	49821	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.063256025 CET	49824	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.063256025 CET	49824	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.063277960 CET	443	49824	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.063290119 CET	443	49824	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.063977957 CET	49821	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.063987017 CET	443	49821	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.065068960 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.065372944 CET	49822	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.065397024 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.065706015 CET	49822	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.065711975 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.067728996 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.068011045 CET	49823	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.068030119 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.068335056 CET	49823	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.068341970 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.079062939 CET	443	49825	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.079438925 CET	49825	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.079526901 CET	443	49825	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.079808950 CET	49825	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.079829931 CET	443	49825	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.189197063 CET	443	49824	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.189353943 CET	443	49824	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.189641953 CET	49824	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.197649002 CET	49824	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.197649956 CET	49824	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.197673082 CET	443	49824	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.197685957 CET	443	49824	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.201476097 CET	49826	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.201504946 CET	443	49826	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.201694965 CET	49826	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.203882933 CET	49826	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.203897953 CET	443	49826	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.212152958 CET	443	49821	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.212313890 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.212368965 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.212400913 CET	443	49821	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.212474108 CET	49823	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.212474108 CET	49821	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.212507963 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.212536097 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.212554932 CET	49821	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.212573051 CET	443	49821	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.212589025 CET	49821	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.212589025 CET	49823	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.212598085 CET	443	49821	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.212660074 CET	49823	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.212665081 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.212697029 CET	49823	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.212701082 CET	443	49823	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213063955 CET	443	49825	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213119030 CET	443	49825	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213224888 CET	49825	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.213249922 CET	443	49825	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213325977 CET	49825	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.213380098 CET	49825	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.213382006 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213423967 CET	443	49825	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213437080 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213457108 CET	49825	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.213474035 CET	443	49825	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213496923 CET	49822	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.213520050 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213577032 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213623047 CET	49822	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.213911057 CET	49822	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.213920116 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.213931084 CET	49822	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.213936090 CET	443	49822	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.215548038 CET	49827	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.215588093 CET	443	49827	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.215672016 CET	49827	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.215935946 CET	49828	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.215985060 CET	443	49828	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.216051102 CET	49828	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.216145039 CET	49827	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.216147900 CET	49828	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.216164112 CET	443	49827	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.216166019 CET	443	49828	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.216721058 CET	49829	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.216808081 CET	443	49829	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.216896057 CET	49829	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.217030048 CET	49829	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.217047930 CET	49830	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.217057943 CET	443	49830	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.217067957 CET	443	49829	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.217123985 CET	49830	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.217195988 CET	49830	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.217206001 CET	443	49830	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.480154991 CET	49831	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:48.480186939 CET	443	49831	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:48.480257034 CET	49831	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:48.480757952 CET	49831	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:48.480776072 CET	443	49831	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:48.641721010 CET	49807	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:48.641741037 CET	49796	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:48.641922951 CET	49784	443	192.168.2.4	18.244.18.122
Nov 13, 2024 09:53:48.663945913 CET	49797	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:48.664053917 CET	49808	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:48.942295074 CET	443	49826	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.943089008 CET	49826	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.943109035 CET	443	49826	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.943553925 CET	49826	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.943558931 CET	443	49826	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.943980932 CET	443	49828	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.944305897 CET	49828	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.944369078 CET	443	49828	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.944653034 CET	49828	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.944669008 CET	443	49828	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.953805923 CET	443	49829	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.954116106 CET	49829	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.954200983 CET	443	49829	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.954461098 CET	49829	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.954478025 CET	443	49829	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.957843065 CET	443	49827	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.958240032 CET	49827	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.958272934 CET	443	49827	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:48.958450079 CET	49827	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:48.958458900 CET	443	49827	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.071408987 CET	443	49826	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.071831942 CET	443	49826	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.071970940 CET	49826	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.072175026 CET	49826	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.072196007 CET	443	49826	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.072202921 CET	49826	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.072206974 CET	443	49826	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.075447083 CET	49832	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.075540066 CET	443	49832	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.075655937 CET	49832	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.075782061 CET	49832	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.075808048 CET	443	49832	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.077334881 CET	443	49828	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.077487946 CET	443	49828	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.077562094 CET	49828	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.077717066 CET	49828	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.077754974 CET	443	49828	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.077780962 CET	49828	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.077795982 CET	443	49828	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.079529047 CET	49833	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.079570055 CET	443	49833	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.079807997 CET	49833	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.079930067 CET	49833	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.079950094 CET	443	49833	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.083584070 CET	443	49829	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.083733082 CET	443	49829	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.083813906 CET	49829	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.083899975 CET	49829	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.083899975 CET	49829	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.083941936 CET	443	49829	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.083971977 CET	443	49829	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.087187052 CET	49834	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.087210894 CET	443	49834	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.087603092 CET	49834	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.087739944 CET	49834	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.087765932 CET	443	49834	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.091856003 CET	443	49827	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.092008114 CET	443	49827	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.092263937 CET	49827	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.092324018 CET	49827	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.092340946 CET	443	49827	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.092359066 CET	49827	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.092365980 CET	443	49827	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.093981028 CET	49835	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.093991995 CET	443	49835	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.094058990 CET	49835	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.094202995 CET	49835	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.094218016 CET	443	49835	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.167768955 CET	443	49831	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:49.168179989 CET	49831	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:49.168195963 CET	443	49831	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:49.169759035 CET	443	49831	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:49.169821024 CET	49831	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:49.170495987 CET	49831	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:49.170538902 CET	443	49831	20.151.152.98	192.168.2.4
Nov 13, 2024 09:53:49.170640945 CET	49831	443	192.168.2.4	20.151.152.98
Nov 13, 2024 09:53:49.614780903 CET	443	49830	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.615855932 CET	49830	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.615855932 CET	49830	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.615921974 CET	443	49830	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.615972996 CET	443	49830	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.744055986 CET	443	49830	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.744108915 CET	443	49830	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.744750977 CET	49830	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.744750977 CET	49830	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.744750977 CET	49830	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.751411915 CET	49836	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.751441956 CET	443	49836	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.753268957 CET	49836	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.753268957 CET	49836	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.753314972 CET	443	49836	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.992825031 CET	443	49834	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.993819952 CET	443	49835	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.993841887 CET	443	49833	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.994187117 CET	49834	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.994251013 CET	443	49834	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.994313955 CET	49835	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.994379044 CET	443	49835	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.994685888 CET	49834	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.994699955 CET	443	49834	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.994858980 CET	49835	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.994875908 CET	443	49835	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.995569944 CET	49833	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.995570898 CET	49833	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.995590925 CET	443	49833	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.995630980 CET	443	49833	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.996268034 CET	443	49832	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:49.996830940 CET	49832	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:49.996845961 CET	443	49832	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.000554085 CET	49832	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.000565052 CET	443	49832	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.052499056 CET	49830	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.052565098 CET	443	49830	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.130279064 CET	443	49835	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.130295992 CET	443	49834	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.130445004 CET	443	49835	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.130456924 CET	443	49834	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.130714893 CET	49834	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.130781889 CET	49835	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.131167889 CET	49834	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.131167889 CET	49834	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.131201982 CET	443	49834	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.131217957 CET	443	49834	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.131253004 CET	49835	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.131253958 CET	49835	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.131326914 CET	443	49835	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.131364107 CET	443	49835	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.134111881 CET	443	49832	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.134252071 CET	443	49833	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.134284973 CET	443	49832	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.134466887 CET	443	49833	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.134516001 CET	49832	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.134802103 CET	49837	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.134852886 CET	49832	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.134869099 CET	49838	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.134890079 CET	443	49832	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.134891987 CET	443	49837	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.134901047 CET	443	49838	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.134906054 CET	49832	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.134917021 CET	443	49832	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.134968042 CET	49833	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.134991884 CET	49837	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.135344982 CET	49838	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.135406971 CET	49833	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.135447979 CET	443	49833	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.135492086 CET	49833	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.135509014 CET	443	49833	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.136542082 CET	49838	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.136548042 CET	49837	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.136558056 CET	443	49838	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.136588097 CET	443	49837	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.137615919 CET	49839	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.137639046 CET	443	49839	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.137875080 CET	49839	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.137875080 CET	49839	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.137931108 CET	443	49839	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.138597012 CET	49840	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.138642073 CET	443	49840	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.140019894 CET	49840	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.140549898 CET	49840	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.140584946 CET	443	49840	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.708617926 CET	49672	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:53:50.734515905 CET	443	49836	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.735127926 CET	49836	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.735146999 CET	443	49836	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.735827923 CET	49836	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.735833883 CET	443	49836	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.859340906 CET	443	49838	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.859776974 CET	49838	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.859793901 CET	443	49838	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.860302925 CET	49838	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.860307932 CET	443	49838	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.865221977 CET	443	49839	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.865602016 CET	49839	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.865628004 CET	443	49839	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.865973949 CET	49839	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.865979910 CET	443	49839	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.866494894 CET	443	49836	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.866569042 CET	443	49836	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.866615057 CET	49836	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.866827965 CET	49836	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.866837025 CET	443	49836	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.866847992 CET	49836	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.866852999 CET	443	49836	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.870066881 CET	49841	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.870105028 CET	443	49841	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.870161057 CET	49841	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.870291948 CET	49841	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.870306015 CET	443	49841	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.873522043 CET	443	49837	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.873888969 CET	49837	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.873898029 CET	443	49837	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.874399900 CET	49837	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.874404907 CET	443	49837	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.910437107 CET	443	49840	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.910902023 CET	49840	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.910965919 CET	443	49840	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.911166906 CET	49840	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.911183119 CET	443	49840	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.986943960 CET	443	49838	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.987122059 CET	443	49838	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.987186909 CET	49838	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.987310886 CET	49838	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.987318039 CET	443	49838	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.987345934 CET	49838	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.987349033 CET	443	49838	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.990976095 CET	49842	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.991064072 CET	443	49842	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.991153002 CET	49842	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.991534948 CET	49842	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.991574049 CET	443	49842	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.994553089 CET	443	49839	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.994708061 CET	443	49839	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.994774103 CET	49839	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.994867086 CET	49839	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.994868040 CET	49839	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.994910002 CET	443	49839	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.994939089 CET	443	49839	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.997282028 CET	49843	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.997358084 CET	443	49843	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:50.997427940 CET	49843	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.997617960 CET	49843	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:50.997648954 CET	443	49843	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.003520966 CET	443	49837	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.003923893 CET	443	49837	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.003985882 CET	49837	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.004046917 CET	49837	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.004065990 CET	443	49837	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.004091024 CET	49837	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.004105091 CET	443	49837	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.007168055 CET	49844	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.007208109 CET	443	49844	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.007272959 CET	49844	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.007401943 CET	49844	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.007435083 CET	443	49844	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.049539089 CET	443	49840	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.049704075 CET	443	49840	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.049917936 CET	49840	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.049917936 CET	49840	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.049917936 CET	49840	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.053288937 CET	49845	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.053306103 CET	443	49845	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.053349018 CET	49845	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.054356098 CET	49845	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.054368973 CET	443	49845	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.364991903 CET	49840	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.365056038 CET	443	49840	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.587234020 CET	443	49841	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.587908030 CET	49841	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.587960005 CET	443	49841	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.588320971 CET	49841	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.588336945 CET	443	49841	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.713804960 CET	443	49841	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.713956118 CET	443	49841	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.714293957 CET	49841	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.714294910 CET	49841	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.714294910 CET	49841	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.715713978 CET	443	49842	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.717401028 CET	49846	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.717431068 CET	443	49846	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.717535973 CET	49842	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.717598915 CET	443	49842	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.718693018 CET	49842	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.718708992 CET	443	49842	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.718729973 CET	49846	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.718894005 CET	49846	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.718902111 CET	443	49846	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.731791019 CET	443	49844	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.732561111 CET	49844	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.732570887 CET	443	49844	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.732592106 CET	49844	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.732594967 CET	443	49844	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.775540113 CET	443	49843	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.776281118 CET	49843	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.776281118 CET	49843	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.776328087 CET	443	49843	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.776344061 CET	443	49843	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.790163994 CET	443	49845	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.790719032 CET	49845	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.790738106 CET	443	49845	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.790757895 CET	49845	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.790762901 CET	443	49845	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.845170021 CET	443	49842	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.845328093 CET	443	49842	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.845587015 CET	49842	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.845587015 CET	49842	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.845587969 CET	49842	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.847609997 CET	49847	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.847625017 CET	443	49847	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.847728968 CET	49847	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.847790956 CET	49847	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.847795010 CET	443	49847	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.859411001 CET	443	49844	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.859607935 CET	443	49844	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.859729052 CET	49844	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.859730005 CET	49844	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.859952927 CET	49844	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.859965086 CET	443	49844	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.861475945 CET	49848	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.861516953 CET	443	49848	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.861614943 CET	49848	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.861670971 CET	49848	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.861680031 CET	443	49848	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.911379099 CET	443	49843	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.911530018 CET	443	49843	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.911751986 CET	49843	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.911751986 CET	49843	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.912251949 CET	49843	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.912272930 CET	443	49843	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.914064884 CET	49849	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.914098978 CET	443	49849	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.914299965 CET	49849	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.914423943 CET	49849	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.914434910 CET	443	49849	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.920314074 CET	443	49845	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.920449972 CET	443	49845	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.920552015 CET	49845	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.920552015 CET	49845	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.920552015 CET	49845	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.922184944 CET	49850	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.922220945 CET	443	49850	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:51.922297001 CET	49850	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.922394037 CET	49850	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:51.922405958 CET	443	49850	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.021353006 CET	49841	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.021435976 CET	443	49841	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.146275997 CET	49842	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.146341085 CET	443	49842	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.224234104 CET	49845	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.224248886 CET	443	49845	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.475507975 CET	443	49846	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.476155043 CET	49846	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.476180077 CET	443	49846	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.476620913 CET	49846	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.476627111 CET	443	49846	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.592627048 CET	443	49847	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.593139887 CET	49847	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.593154907 CET	443	49847	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.593590021 CET	49847	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.593595028 CET	443	49847	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.611238003 CET	443	49846	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.611310005 CET	443	49846	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.611515999 CET	49846	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.611552954 CET	49846	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.611552954 CET	49846	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.611569881 CET	443	49846	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.611577988 CET	443	49846	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.614084005 CET	49851	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.614113092 CET	443	49851	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.614181995 CET	49851	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.614350080 CET	49851	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.614360094 CET	443	49851	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.654186010 CET	443	49849	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.654599905 CET	49849	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.654607058 CET	443	49849	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.655035019 CET	49849	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.655038118 CET	443	49849	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.674236059 CET	443	49850	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.674680948 CET	49850	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.674711943 CET	443	49850	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.675159931 CET	49850	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.675167084 CET	443	49850	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.729336023 CET	443	49847	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.729403973 CET	443	49847	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.729584932 CET	49847	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.729619026 CET	49847	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.729631901 CET	443	49847	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.729641914 CET	49847	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.729648113 CET	443	49847	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.732520103 CET	49852	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.732564926 CET	443	49852	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.732675076 CET	49852	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.732841015 CET	49852	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.732860088 CET	443	49852	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.787811041 CET	443	49849	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.787962914 CET	443	49849	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.788079977 CET	49849	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.788119078 CET	49849	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.788135052 CET	443	49849	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.788142920 CET	49849	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.788147926 CET	443	49849	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.790182114 CET	49853	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.790272951 CET	443	49853	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.790349007 CET	49853	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.790474892 CET	49853	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.790501118 CET	443	49853	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.792330027 CET	443	49848	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.792772055 CET	49848	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.792817116 CET	443	49848	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.793113947 CET	49848	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.793123007 CET	443	49848	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.807847977 CET	443	49850	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.807991028 CET	443	49850	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.808048964 CET	49850	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.808075905 CET	49850	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.808090925 CET	443	49850	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.808104992 CET	49850	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.808110952 CET	443	49850	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.809721947 CET	49854	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.809753895 CET	443	49854	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.809885025 CET	49854	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.810023069 CET	49854	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.810039997 CET	443	49854	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.920728922 CET	443	49848	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.920890093 CET	443	49848	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.921029091 CET	49848	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.921029091 CET	49848	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.921030045 CET	49848	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.922955036 CET	49855	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.922987938 CET	443	49855	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:52.923158884 CET	49855	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.923311949 CET	49855	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:52.923335075 CET	443	49855	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.224324942 CET	49848	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.224355936 CET	443	49848	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.575982094 CET	443	49851	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.576471090 CET	49851	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.576482058 CET	443	49851	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.576910019 CET	49851	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.576925039 CET	443	49851	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.710016966 CET	443	49855	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.710462093 CET	49855	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.710500956 CET	443	49855	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.710932016 CET	49855	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.710942984 CET	443	49855	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.711592913 CET	443	49853	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.712109089 CET	443	49851	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.712131023 CET	49853	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.712145090 CET	443	49853	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.712256908 CET	443	49851	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.712336063 CET	49851	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.712687969 CET	49853	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.712697983 CET	443	49853	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.712961912 CET	49851	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.712975979 CET	443	49851	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.712985039 CET	49851	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.712989092 CET	443	49851	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.713202953 CET	443	49852	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.714010000 CET	49852	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.714070082 CET	443	49852	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.714533091 CET	49852	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.714548111 CET	443	49852	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.715487957 CET	443	49854	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.716783047 CET	49856	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.716824055 CET	443	49856	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.716845036 CET	49854	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.716860056 CET	443	49854	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.716924906 CET	49856	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.717334032 CET	49854	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.717345953 CET	443	49854	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.717565060 CET	49856	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.717591047 CET	443	49856	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.838099957 CET	443	49855	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.838732004 CET	443	49855	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.838809013 CET	49855	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.838891983 CET	49855	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.838892937 CET	49855	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.838934898 CET	443	49855	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.838967085 CET	443	49855	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.841686010 CET	49857	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.841757059 CET	443	49857	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.841805935 CET	443	49852	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.841958046 CET	49857	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.842034101 CET	443	49852	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.842106104 CET	49852	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.842106104 CET	49857	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.842164993 CET	443	49857	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.842191935 CET	49852	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.842191935 CET	49852	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.842216015 CET	443	49852	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.842238903 CET	443	49852	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.844085932 CET	443	49853	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.844393969 CET	49858	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.844444036 CET	443	49858	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.844527960 CET	49858	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.844702005 CET	49858	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.844733953 CET	443	49858	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.844749928 CET	443	49853	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.844861031 CET	49853	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.844888926 CET	49853	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.844906092 CET	443	49853	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.844928980 CET	49853	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.844940901 CET	443	49853	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.845107079 CET	443	49854	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.845314026 CET	443	49854	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.845383883 CET	49854	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.845416069 CET	49854	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.845416069 CET	49854	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.845429897 CET	443	49854	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.845449924 CET	443	49854	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.847233057 CET	49859	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.847256899 CET	443	49859	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.847346067 CET	49859	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.847424030 CET	49859	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.847439051 CET	443	49859	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.847537041 CET	49860	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.847559929 CET	443	49860	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:53.847642899 CET	49860	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.847719908 CET	49860	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:53.847724915 CET	443	49860	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.195462942 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:54.195504904 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:54.195636988 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:54.196074009 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:54.196095943 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:54.465676069 CET	443	49856	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.466332912 CET	49856	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.466398954 CET	443	49856	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.466927052 CET	49856	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.466943979 CET	443	49856	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.579210043 CET	443	49860	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.579518080 CET	443	49857	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.579641104 CET	49860	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.579653978 CET	443	49860	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.579982996 CET	49857	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.580015898 CET	443	49857	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.580046892 CET	49860	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.580049992 CET	443	49860	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.580663919 CET	49857	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.580672026 CET	443	49857	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.590178013 CET	443	49859	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.590576887 CET	49859	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.590588093 CET	443	49859	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.590895891 CET	49859	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.590903044 CET	443	49859	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.598512888 CET	443	49856	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.599740982 CET	443	49856	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.599953890 CET	49856	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.599953890 CET	49856	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.599953890 CET	49856	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.602827072 CET	49862	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.602848053 CET	443	49862	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.603055954 CET	49862	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.603055954 CET	49862	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.603091002 CET	443	49862	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.619772911 CET	443	49858	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.620152950 CET	49858	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.620187044 CET	443	49858	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.620481968 CET	49858	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.620495081 CET	443	49858	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.707882881 CET	443	49860	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.708044052 CET	443	49860	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.708112001 CET	49860	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.708264112 CET	49860	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.708275080 CET	443	49860	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.708282948 CET	49860	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.708290100 CET	443	49860	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.719711065 CET	443	49859	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.719854116 CET	443	49859	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.721889973 CET	49859	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.722163916 CET	49863	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.722208977 CET	443	49863	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.722302914 CET	49863	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.722424030 CET	49859	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.722424984 CET	49859	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.722469091 CET	443	49859	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.722505093 CET	443	49859	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.723872900 CET	49863	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.723893881 CET	443	49863	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.725862980 CET	49864	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.725886106 CET	443	49864	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.725974083 CET	49864	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.726084948 CET	49864	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.726098061 CET	443	49864	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.727498055 CET	443	49857	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.727650881 CET	443	49857	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.727730989 CET	49857	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.727766991 CET	49857	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.727766991 CET	49857	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.727782011 CET	443	49857	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.727802038 CET	443	49857	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.730051994 CET	49865	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.730093956 CET	443	49865	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.731256008 CET	49865	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.731450081 CET	49865	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.731467962 CET	443	49865	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.806189060 CET	443	49858	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.806561947 CET	443	49858	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.806648970 CET	49858	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.806730032 CET	49858	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.806730032 CET	49858	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.806773901 CET	443	49858	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.806802034 CET	443	49858	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.808835983 CET	49866	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.808847904 CET	443	49866	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.808914900 CET	49866	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.809108019 CET	49866	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.809113026 CET	443	49866	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.911752939 CET	49856	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:54.911777020 CET	443	49856	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:54.960875034 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:54.960958004 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:54.963087082 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:54.963110924 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:54.963526964 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:54.970840931 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:55.011357069 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.219351053 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.219412088 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.219506025 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.219516993 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:55.219558954 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.219599009 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:55.219626904 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:55.336179972 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.336251974 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.336281061 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:55.336329937 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.336361885 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:55.336381912 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.336440086 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:55.336668015 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:55.336702108 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.336728096 CET	49861	443	192.168.2.4	172.202.163.200
Nov 13, 2024 09:53:55.336743116 CET	443	49861	172.202.163.200	192.168.2.4
Nov 13, 2024 09:53:55.337627888 CET	443	49862	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.338265896 CET	49862	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.338275909 CET	443	49862	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.338917971 CET	49862	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.338922024 CET	443	49862	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.459988117 CET	443	49863	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.460597038 CET	49863	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.460659981 CET	443	49863	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.460881948 CET	49863	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.460897923 CET	443	49863	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.464168072 CET	443	49862	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.464310884 CET	443	49862	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.464366913 CET	49862	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.464478970 CET	49862	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.464495897 CET	443	49862	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.464507103 CET	49862	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.464512110 CET	443	49862	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.466434956 CET	443	49864	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.466869116 CET	49864	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.466891050 CET	443	49864	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.467008114 CET	49867	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.467094898 CET	443	49867	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.467221022 CET	49867	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.467335939 CET	49864	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.467341900 CET	443	49864	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.467366934 CET	49867	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.467405081 CET	443	49867	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.492180109 CET	443	49865	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.492477894 CET	49865	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.492512941 CET	443	49865	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.492816925 CET	49865	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.492835045 CET	443	49865	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.545577049 CET	443	49866	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.545907974 CET	49866	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.545919895 CET	443	49866	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.546253920 CET	49866	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.546260118 CET	443	49866	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.588608027 CET	443	49863	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.588741064 CET	443	49863	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.588895082 CET	49863	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.588895082 CET	49863	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.588895082 CET	49863	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.590763092 CET	49868	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.590811014 CET	443	49868	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.590928078 CET	49868	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.591042042 CET	49868	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.591062069 CET	443	49868	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.594557047 CET	443	49864	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.594703913 CET	443	49864	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.594757080 CET	49864	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.594783068 CET	49864	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.594790936 CET	443	49864	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.594811916 CET	49864	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.594815969 CET	443	49864	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.596621990 CET	49869	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.596710920 CET	443	49869	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.596787930 CET	49869	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.596899033 CET	49869	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.596925974 CET	443	49869	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.624506950 CET	443	49865	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.625027895 CET	443	49865	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.625083923 CET	49865	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.625133991 CET	49865	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.625133991 CET	49865	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.625155926 CET	443	49865	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.625169039 CET	443	49865	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.626835108 CET	49870	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.626920938 CET	443	49870	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.627005100 CET	49870	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.627146959 CET	49870	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.627182961 CET	443	49870	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.660132885 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:55.660196066 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:55.660237074 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:55.660254002 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:55.660267115 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:55.660307884 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:55.660485029 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:55.660489082 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:55.660502911 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:55.660815001 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:55.660895109 CET	443	49818	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:55.660937071 CET	49818	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:55.675945997 CET	443	49866	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.676143885 CET	443	49866	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.676207066 CET	49866	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.676374912 CET	49866	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.676378965 CET	443	49866	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.676387072 CET	49866	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.676389933 CET	443	49866	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.678591967 CET	49871	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.678678989 CET	443	49871	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.678864002 CET	49871	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.679253101 CET	49871	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.679289103 CET	443	49871	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:55.680052996 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:55.680077076 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:55.680279970 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:55.680419922 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:55.680448055 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:55.802448034 CET	49863	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:55.802512884 CET	443	49863	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.115019083 CET	49724	80	192.168.2.4	93.184.221.240
Nov 13, 2024 09:53:56.121845007 CET	80	49724	93.184.221.240	192.168.2.4
Nov 13, 2024 09:53:56.121959925 CET	49724	80	192.168.2.4	93.184.221.240
Nov 13, 2024 09:53:56.187588930 CET	443	49867	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.188069105 CET	49867	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.188091040 CET	443	49867	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.188472986 CET	49867	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.188477039 CET	443	49867	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.336380959 CET	443	49867	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.336551905 CET	443	49867	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.336617947 CET	49867	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.336870909 CET	49867	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.336883068 CET	443	49867	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.336893082 CET	49867	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.336898088 CET	443	49867	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.339799881 CET	49873	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.339823008 CET	443	49873	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.339921951 CET	49873	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.340058088 CET	49873	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.340075016 CET	443	49873	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.350438118 CET	443	49869	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.350769043 CET	49869	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.350807905 CET	443	49869	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.351129055 CET	49869	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.351142883 CET	443	49869	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.366113901 CET	443	49868	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.366513014 CET	49868	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.366547108 CET	443	49868	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.366745949 CET	49868	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.366754055 CET	443	49868	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.394717932 CET	443	49870	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.394989014 CET	49870	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.395006895 CET	443	49870	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.395344973 CET	49870	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.395402908 CET	443	49870	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.420895100 CET	443	49871	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.421346903 CET	49871	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.421410084 CET	443	49871	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.421520948 CET	49871	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.421538115 CET	443	49871	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.478368998 CET	443	49869	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.478552103 CET	443	49869	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.478635073 CET	49869	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.478734016 CET	49869	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.478764057 CET	443	49869	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.478820086 CET	49869	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.478835106 CET	443	49869	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.481437922 CET	49874	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.481467962 CET	443	49874	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.481692076 CET	49874	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.481853008 CET	49874	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.481859922 CET	443	49874	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.502793074 CET	443	49868	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.502846956 CET	443	49868	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.503098011 CET	49868	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.503098965 CET	49868	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.503098965 CET	49868	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.505238056 CET	49875	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.505250931 CET	443	49875	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.505300999 CET	49875	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.505587101 CET	49875	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.505598068 CET	443	49875	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.527509928 CET	443	49870	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.527710915 CET	443	49870	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.527894020 CET	49870	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.527894974 CET	49870	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.527894974 CET	49870	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.530483961 CET	49876	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.530529022 CET	443	49876	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.530625105 CET	49876	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.530725956 CET	49876	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.530745029 CET	443	49876	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.548556089 CET	443	49871	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.548705101 CET	443	49871	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.548780918 CET	49871	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.548816919 CET	49871	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.548836946 CET	443	49871	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.548861027 CET	49871	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.548872948 CET	443	49871	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.551058054 CET	49877	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.551095009 CET	443	49877	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.551162958 CET	49877	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.551280022 CET	49877	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.551287889 CET	443	49877	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.741699934 CET	49870	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.741767883 CET	443	49870	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.802437067 CET	49868	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:56.802484035 CET	443	49868	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:56.804738998 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:56.805294037 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:56.805336952 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:56.805964947 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:56.805977106 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:56.806025028 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:56.806054115 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:57.077549934 CET	443	49873	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.077950954 CET	49873	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.077972889 CET	443	49873	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.078347921 CET	49873	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.078355074 CET	443	49873	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.166414022 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:57.166474104 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:57.166541100 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:57.166560888 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:57.166590929 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:57.166625023 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:57.166857958 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:57.166892052 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:57.166913033 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:57.167186975 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:57.167223930 CET	443	49872	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:57.167304039 CET	49872	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:57.185602903 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:57.185692072 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:57.185947895 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:57.186084032 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:57.186104059 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:57.214164972 CET	443	49873	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.214323997 CET	443	49873	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.214385033 CET	49873	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.214483976 CET	49873	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.214483976 CET	49873	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.214499950 CET	443	49873	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.214505911 CET	443	49873	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.216631889 CET	49879	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.216684103 CET	443	49879	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.216744900 CET	49879	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.216854095 CET	49879	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.216866016 CET	443	49879	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.238688946 CET	443	49875	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.239053965 CET	49875	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.239063978 CET	443	49875	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.239449024 CET	49875	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.239454985 CET	443	49875	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.268069983 CET	443	49876	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.268440008 CET	49876	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.268465996 CET	443	49876	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.268740892 CET	49876	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.268753052 CET	443	49876	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.319813967 CET	443	49877	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.320374012 CET	49877	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.320406914 CET	443	49877	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.320988894 CET	49877	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.320996046 CET	443	49877	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.368038893 CET	443	49875	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.368165016 CET	443	49875	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.368474007 CET	49875	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.368474007 CET	49875	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.368514061 CET	49875	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.368531942 CET	443	49875	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.371582985 CET	49880	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.371670008 CET	443	49880	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.371803999 CET	49880	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.372085094 CET	49880	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.372133017 CET	443	49880	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.398859978 CET	443	49876	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.399043083 CET	443	49876	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.399213076 CET	49876	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.399214029 CET	49876	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.399214029 CET	49876	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.407486916 CET	49881	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.407584906 CET	443	49881	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.407768965 CET	49881	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.408519030 CET	49881	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.408555984 CET	443	49881	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.477560043 CET	443	49877	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.477710962 CET	443	49877	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.478164911 CET	49877	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.478213072 CET	49877	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.478213072 CET	49877	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.478234053 CET	443	49877	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.478262901 CET	443	49877	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.483357906 CET	49882	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.483398914 CET	443	49882	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.488743067 CET	49882	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.488744020 CET	49882	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.488826036 CET	443	49882	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.613435030 CET	443	49874	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.621098042 CET	49874	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.621141911 CET	443	49874	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.623388052 CET	49874	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.623403072 CET	443	49874	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.710800886 CET	49876	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.710865021 CET	443	49876	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.749280930 CET	443	49874	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.749535084 CET	443	49874	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.751725912 CET	49874	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.804796934 CET	49874	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.804796934 CET	49874	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.804858923 CET	443	49874	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.804876089 CET	443	49874	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.807634115 CET	49883	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.807686090 CET	443	49883	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.807805061 CET	49883	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.807982922 CET	49883	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:57.807997942 CET	443	49883	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:57.954917908 CET	443	49879	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.007303953 CET	49879	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.009309053 CET	49879	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.009324074 CET	443	49879	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.010121107 CET	49879	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.010128021 CET	443	49879	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.098311901 CET	443	49880	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.098773956 CET	49880	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.098836899 CET	443	49880	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.099440098 CET	49880	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.099458933 CET	443	49880	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.135994911 CET	443	49879	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.136146069 CET	443	49879	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.136553049 CET	49879	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.137022018 CET	49879	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.137044907 CET	443	49879	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.137079000 CET	49879	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.137088060 CET	443	49879	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.140213013 CET	49884	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.140300989 CET	443	49884	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.140491009 CET	49884	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.141216040 CET	49884	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.141253948 CET	443	49884	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.141326904 CET	443	49881	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.142088890 CET	49881	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.142088890 CET	49881	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.142123938 CET	443	49881	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.142158985 CET	443	49881	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.227118969 CET	443	49880	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.227262974 CET	443	49880	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.227349997 CET	49880	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.227684975 CET	49880	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.227684975 CET	49880	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.227701902 CET	443	49880	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.227714062 CET	443	49880	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.230892897 CET	49885	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.230938911 CET	443	49885	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.231086016 CET	49885	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.231246948 CET	49885	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.231266975 CET	443	49885	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.269320011 CET	443	49881	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.269529104 CET	443	49881	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.269805908 CET	49881	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.269805908 CET	49881	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.269841909 CET	49881	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.269857883 CET	443	49881	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.271580935 CET	49886	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.271622896 CET	443	49886	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.271732092 CET	49886	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.276506901 CET	49886	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.276534081 CET	443	49886	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.321197987 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.322561026 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.322561026 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.322629929 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.322654009 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.322693110 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.322715044 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.383894920 CET	443	49882	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.384181023 CET	49882	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.384243965 CET	443	49882	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.384522915 CET	49882	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.384537935 CET	443	49882	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.515253067 CET	443	49882	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.515434980 CET	443	49882	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.515602112 CET	49882	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.515602112 CET	49882	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.515645981 CET	49882	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.515662909 CET	443	49882	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.518548012 CET	49887	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.518584013 CET	443	49887	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.518641949 CET	49887	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.518848896 CET	49887	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.518857956 CET	443	49887	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.541816950 CET	443	49883	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.542304993 CET	49883	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.542368889 CET	443	49883	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.542671919 CET	49883	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.542687893 CET	443	49883	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.682483912 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.682598114 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.682673931 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.682686090 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.682740927 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.682761908 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.682790041 CET	443	49883	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.682955980 CET	443	49883	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.683007002 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.683028936 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.683041096 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.683128119 CET	49883	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.683129072 CET	49883	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.683129072 CET	49883	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.683367968 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.683443069 CET	443	49878	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.683485985 CET	49878	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.686043024 CET	49888	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.686072111 CET	443	49888	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.686137915 CET	49888	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.686239004 CET	49888	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.686247110 CET	443	49888	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.701909065 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.701955080 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.702034950 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.702147961 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:58.702162027 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:58.893976927 CET	443	49884	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.894692898 CET	49884	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.894762039 CET	443	49884	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.894990921 CET	49884	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.895008087 CET	443	49884	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.957458019 CET	443	49885	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.957842112 CET	49885	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.957863092 CET	443	49885	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.958235025 CET	49885	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.958241940 CET	443	49885	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:58.989847898 CET	49883	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:58.989916086 CET	443	49883	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.009460926 CET	443	49886	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.009773970 CET	49886	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.009859085 CET	443	49886	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.010174036 CET	49886	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.010188103 CET	443	49886	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.024892092 CET	443	49884	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.025038958 CET	443	49884	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.025094032 CET	49884	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.025177956 CET	49884	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.025177956 CET	49884	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.025211096 CET	443	49884	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.025233984 CET	443	49884	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.027841091 CET	49890	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.027873993 CET	443	49890	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.027924061 CET	49890	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.028053045 CET	49890	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.028060913 CET	443	49890	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.090167999 CET	443	49885	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.090826035 CET	443	49885	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.090879917 CET	49885	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.090900898 CET	49885	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.090918064 CET	443	49885	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.090929031 CET	49885	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.090934992 CET	443	49885	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.092705011 CET	49891	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.092727900 CET	443	49891	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.092782021 CET	49891	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.092876911 CET	49891	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.092881918 CET	443	49891	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.140064001 CET	443	49886	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.140263081 CET	443	49886	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.140322924 CET	49886	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.140399933 CET	49886	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.140399933 CET	49886	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.140441895 CET	443	49886	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.140472889 CET	443	49886	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.141983032 CET	49892	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.142057896 CET	443	49892	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.142132998 CET	49892	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.142225981 CET	49892	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.142247915 CET	443	49892	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.254368067 CET	443	49887	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.254808903 CET	49887	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.254827976 CET	443	49887	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.255237103 CET	49887	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.255243063 CET	443	49887	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.387871981 CET	443	49887	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.388026953 CET	443	49887	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.388319016 CET	49887	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.388319016 CET	49887	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.388319016 CET	49887	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.392529011 CET	49893	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.392580986 CET	443	49893	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.392719030 CET	49893	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.392957926 CET	49893	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.392975092 CET	443	49893	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.414484024 CET	443	49888	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.414913893 CET	49888	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.414946079 CET	443	49888	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.415498972 CET	49888	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.415508986 CET	443	49888	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.541239977 CET	443	49888	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.541404009 CET	443	49888	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.544548988 CET	49888	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.546900988 CET	49888	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.546919107 CET	443	49888	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.549770117 CET	49894	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.549855947 CET	443	49894	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.550093889 CET	49894	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.550093889 CET	49894	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.550179958 CET	443	49894	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.693001032 CET	49887	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.693022966 CET	443	49887	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.768378973 CET	443	49890	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.769335032 CET	49890	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.769335032 CET	49890	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.769368887 CET	443	49890	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.769392967 CET	443	49890	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.801331997 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:59.802630901 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:59.802630901 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:59.802676916 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:59.802692890 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:59.802722931 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:53:59.802733898 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:53:59.821819067 CET	443	49891	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.822103977 CET	49891	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.822127104 CET	443	49891	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.824496031 CET	49891	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.824506044 CET	443	49891	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.881356955 CET	443	49892	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.882087946 CET	49892	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.882118940 CET	443	49892	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.882999897 CET	49892	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.883008003 CET	443	49892	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.897610903 CET	443	49890	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.897819996 CET	443	49890	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.897916079 CET	49890	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.897916079 CET	49890	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.897999048 CET	49890	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.898016930 CET	443	49890	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.900527000 CET	49895	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.900580883 CET	443	49895	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.900960922 CET	49895	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.900960922 CET	49895	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.901009083 CET	443	49895	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.951030970 CET	443	49891	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.951181889 CET	443	49891	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.951277971 CET	49891	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.951277971 CET	49891	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.951551914 CET	49891	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.951560020 CET	443	49891	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.952929974 CET	49896	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.953017950 CET	443	49896	13.107.246.45	192.168.2.4
Nov 13, 2024 09:53:59.953152895 CET	49896	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.953222036 CET	49896	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:53:59.953241110 CET	443	49896	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.010005951 CET	443	49892	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.010205984 CET	443	49892	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.010276079 CET	49892	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.010394096 CET	49892	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.010412931 CET	443	49892	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.010536909 CET	49892	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.010544062 CET	443	49892	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.012108088 CET	49897	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.012198925 CET	443	49897	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.012454987 CET	49897	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.012454987 CET	49897	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.012545109 CET	443	49897	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.135818005 CET	443	49893	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.136297941 CET	49893	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.136332035 CET	443	49893	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.136698008 CET	49893	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.136704922 CET	443	49893	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.194787025 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:00.194849968 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:00.194917917 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:00.194938898 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:00.194988966 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:00.195019007 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:00.195528030 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:00.195528030 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:00.195547104 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:00.195868015 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:00.195951939 CET	443	49889	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:00.199510098 CET	49889	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:00.218556881 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:00.218646049 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:00.219472885 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:00.220732927 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:00.220772028 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:00.264933109 CET	443	49893	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.265070915 CET	443	49893	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.265711069 CET	49893	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.265815020 CET	49893	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.265830040 CET	443	49893	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.265860081 CET	49893	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.265866995 CET	443	49893	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.268583059 CET	49899	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.268687010 CET	443	49899	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.268800974 CET	49899	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.269227028 CET	49899	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.269264936 CET	443	49899	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.318069935 CET	49672	443	192.168.2.4	173.222.162.32
Nov 13, 2024 09:54:00.326603889 CET	443	49894	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.376211882 CET	49894	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.376244068 CET	443	49894	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.376652956 CET	49894	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.376681089 CET	443	49894	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.510334969 CET	443	49894	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.510487080 CET	443	49894	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.510572910 CET	49894	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.516249895 CET	49894	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.516290903 CET	443	49894	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.516340971 CET	49894	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.516357899 CET	443	49894	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.559482098 CET	49900	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.559568882 CET	443	49900	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.559642076 CET	49900	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.560286999 CET	49900	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.560323954 CET	443	49900	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.626374960 CET	443	49895	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.652756929 CET	49895	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.652792931 CET	443	49895	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.669287920 CET	49895	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.669315100 CET	443	49895	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.706670046 CET	443	49896	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.707266092 CET	49896	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.707345963 CET	443	49896	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.707514048 CET	49896	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.707530975 CET	443	49896	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.749090910 CET	443	49897	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.757041931 CET	49897	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.757103920 CET	443	49897	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.759212017 CET	49897	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.759226084 CET	443	49897	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.794836998 CET	443	49895	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.795054913 CET	443	49895	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.795540094 CET	49895	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.795574903 CET	49895	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.795574903 CET	49895	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.795594931 CET	443	49895	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.795607090 CET	443	49895	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.798172951 CET	49901	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.798202991 CET	443	49901	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.798280001 CET	49901	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.798381090 CET	49901	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.798388004 CET	443	49901	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.838413954 CET	443	49896	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.838634014 CET	443	49896	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.838819027 CET	49896	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.838819981 CET	49896	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.838819981 CET	49896	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.841280937 CET	49902	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.841368914 CET	443	49902	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.841562986 CET	49902	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.841777086 CET	49902	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.841814041 CET	443	49902	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.885026932 CET	443	49897	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.885595083 CET	443	49897	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.885660887 CET	49897	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.885744095 CET	49897	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.885744095 CET	49897	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.885787010 CET	443	49897	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.885814905 CET	443	49897	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.887423038 CET	49903	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.887439013 CET	443	49903	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:00.887553930 CET	49903	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.887651920 CET	49903	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:00.887656927 CET	443	49903	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.005321026 CET	443	49899	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.005810976 CET	49899	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.005898952 CET	443	49899	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.006182909 CET	49899	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.006198883 CET	443	49899	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.144737959 CET	443	49899	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.144808054 CET	443	49899	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.144929886 CET	49899	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.145286083 CET	49899	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.145286083 CET	49899	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.145329952 CET	443	49899	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.145358086 CET	443	49899	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.146188974 CET	49896	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.146254063 CET	443	49896	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.148001909 CET	49904	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.148050070 CET	443	49904	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.148170948 CET	49904	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.148318052 CET	49904	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.148348093 CET	443	49904	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.298286915 CET	443	49900	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.298835993 CET	49900	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.298922062 CET	443	49900	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.299271107 CET	49900	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.299285889 CET	443	49900	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.341625929 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.342120886 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:01.342185974 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.342483997 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:01.342506886 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.342564106 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:01.342585087 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.428311110 CET	443	49900	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.428455114 CET	443	49900	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.428530931 CET	49900	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.428610086 CET	49900	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.428610086 CET	49900	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.428653955 CET	443	49900	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.428683996 CET	443	49900	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.431431055 CET	49905	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.431516886 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.431606054 CET	49905	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.431737900 CET	49905	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.431757927 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.534446955 CET	443	49901	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.534787893 CET	49901	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.534801960 CET	443	49901	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.535200119 CET	49901	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.535203934 CET	443	49901	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.590017080 CET	443	49902	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.590537071 CET	49902	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.590619087 CET	443	49902	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.590965033 CET	49902	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.590980053 CET	443	49902	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.615422964 CET	443	49903	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.615967989 CET	49903	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.615976095 CET	443	49903	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.616206884 CET	49903	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.616209984 CET	443	49903	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.664534092 CET	443	49901	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.665596008 CET	443	49901	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.665672064 CET	49901	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.665764093 CET	49901	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.665779114 CET	443	49901	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.665787935 CET	49901	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.665792942 CET	443	49901	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.668833971 CET	49906	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.668931961 CET	443	49906	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.669018984 CET	49906	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.669132948 CET	49906	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.669157982 CET	443	49906	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.721348047 CET	443	49902	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.721405983 CET	443	49902	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.721539974 CET	443	49902	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.721709967 CET	49902	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.721710920 CET	49902	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.721710920 CET	49902	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.721710920 CET	49902	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.725164890 CET	49907	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.725203037 CET	443	49907	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.725258112 CET	49907	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.725548029 CET	49907	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.725568056 CET	443	49907	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.733418941 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.733480930 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.733532906 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.733563900 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:01.733607054 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.733643055 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:01.734348059 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:01.734385967 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.734503984 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:01.734690905 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.734772921 CET	443	49898	40.126.32.74	192.168.2.4
Nov 13, 2024 09:54:01.734968901 CET	49898	443	192.168.2.4	40.126.32.74
Nov 13, 2024 09:54:01.857274055 CET	443	49903	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.857661009 CET	443	49903	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.857722044 CET	49903	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.858268023 CET	49903	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.858289003 CET	443	49903	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.860966921 CET	49908	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.860994101 CET	443	49908	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.861074924 CET	49908	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.861371994 CET	49908	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.861387014 CET	443	49908	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.893177986 CET	443	49904	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.893533945 CET	49904	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.893599987 CET	443	49904	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:01.893959999 CET	49904	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:01.893975019 CET	443	49904	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.021197081 CET	49902	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.021261930 CET	443	49902	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.145260096 CET	443	49904	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.145530939 CET	443	49904	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.145611048 CET	49904	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.145695925 CET	49904	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.145697117 CET	49904	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.145740986 CET	443	49904	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.145775080 CET	443	49904	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.148631096 CET	49909	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.148720026 CET	443	49909	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.148816109 CET	49909	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.148962975 CET	49909	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.148987055 CET	443	49909	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.281024933 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.281725883 CET	49905	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.281773090 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.282062054 CET	49905	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.282071114 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.397253990 CET	443	49906	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.397768021 CET	49906	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.397854090 CET	443	49906	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.398266077 CET	49906	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.398282051 CET	443	49906	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.411638975 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.411684990 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.411755085 CET	49905	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.411767960 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.411811113 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.411943913 CET	49905	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.411992073 CET	49905	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.412007093 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.412019014 CET	49905	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.412024975 CET	443	49905	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.414587975 CET	49910	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.414627075 CET	443	49910	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.414700985 CET	49910	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.414820910 CET	49910	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.414828062 CET	443	49910	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.470341921 CET	443	49907	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.470658064 CET	49907	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.470680952 CET	443	49907	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.470952988 CET	49907	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.470958948 CET	443	49907	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.524601936 CET	443	49906	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.524672031 CET	443	49906	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.524852991 CET	443	49906	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.524868965 CET	49906	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.524940014 CET	49906	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.524983883 CET	49906	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.524983883 CET	49906	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.525024891 CET	443	49906	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.525060892 CET	443	49906	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.527015924 CET	49911	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.527103901 CET	443	49911	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.527188063 CET	49911	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.527313948 CET	49911	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.527333021 CET	443	49911	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.601135015 CET	443	49907	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.601157904 CET	443	49907	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.601212025 CET	443	49907	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.601214886 CET	49907	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.601315022 CET	49907	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.601645947 CET	49907	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.601655006 CET	443	49907	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.601757050 CET	49907	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.601762056 CET	443	49907	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.603857040 CET	49912	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.603879929 CET	443	49912	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.604010105 CET	49912	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.604140043 CET	49912	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.604144096 CET	443	49912	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.613763094 CET	443	49908	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.614074945 CET	49908	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.614089012 CET	443	49908	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.614499092 CET	49908	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.614502907 CET	443	49908	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.744443893 CET	443	49908	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.744868040 CET	443	49908	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.744923115 CET	49908	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.745316982 CET	49908	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.745330095 CET	443	49908	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.749109030 CET	49913	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.749150038 CET	443	49913	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.749222994 CET	49913	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.749346972 CET	49913	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.749360085 CET	443	49913	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.876174927 CET	443	49909	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.893615961 CET	49909	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.893678904 CET	443	49909	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:02.894049883 CET	49909	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:02.894109011 CET	443	49909	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.019548893 CET	443	49909	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.019720078 CET	443	49909	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.024545908 CET	49909	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.025722027 CET	49909	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.025722027 CET	49909	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.025794029 CET	443	49909	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.025830030 CET	443	49909	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.078314066 CET	49914	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.078346968 CET	443	49914	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.078412056 CET	49914	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.078919888 CET	49914	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.078933954 CET	443	49914	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.153775930 CET	443	49910	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.160980940 CET	49910	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.160991907 CET	443	49910	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.167370081 CET	49910	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.167372942 CET	443	49910	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.263375998 CET	443	49911	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.264070034 CET	49911	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.264134884 CET	443	49911	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.264349937 CET	49911	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.264365911 CET	443	49911	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.295279026 CET	443	49910	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.295717001 CET	443	49910	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.295809031 CET	49910	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.295896053 CET	49910	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.295906067 CET	443	49910	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.295917034 CET	49910	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.295921087 CET	443	49910	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.299498081 CET	49915	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.299534082 CET	443	49915	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.299798965 CET	49915	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.300143003 CET	49915	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.300164938 CET	443	49915	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.349632025 CET	443	49912	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.371191025 CET	49912	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.371205091 CET	443	49912	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.378307104 CET	49912	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.378312111 CET	443	49912	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.393855095 CET	443	49911	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.394748926 CET	443	49911	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.394958019 CET	49911	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.397876024 CET	49911	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.397876024 CET	49911	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.397921085 CET	443	49911	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.397953033 CET	443	49911	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.408382893 CET	49916	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.408490896 CET	443	49916	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.408586025 CET	49916	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.409203053 CET	49916	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.409240961 CET	443	49916	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.490144968 CET	443	49913	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.490536928 CET	49913	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.490559101 CET	443	49913	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.490988016 CET	49913	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.490995884 CET	443	49913	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.515166998 CET	443	49912	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.515367985 CET	443	49912	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.515422106 CET	49912	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.515486956 CET	49912	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.515502930 CET	443	49912	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.515515089 CET	49912	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.515520096 CET	443	49912	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.518002987 CET	49917	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.518044949 CET	443	49917	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.518106937 CET	49917	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.518255949 CET	49917	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.518268108 CET	443	49917	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.629158974 CET	443	49913	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.629563093 CET	443	49913	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.629623890 CET	49913	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.629693985 CET	49913	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.629714966 CET	443	49913	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.629730940 CET	49913	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.629740953 CET	443	49913	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.633505106 CET	49918	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.633599043 CET	443	49918	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.633685112 CET	49918	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.633837938 CET	49918	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.633861065 CET	443	49918	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.826986074 CET	443	49914	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.827497959 CET	49914	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.827513933 CET	443	49914	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.828249931 CET	49914	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.828254938 CET	443	49914	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.956619978 CET	443	49914	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.956705093 CET	443	49914	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.956748009 CET	49914	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.956952095 CET	49914	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.956959963 CET	443	49914	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.956991911 CET	49914	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.956995010 CET	443	49914	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.960402012 CET	49919	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.960490942 CET	443	49919	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:03.960601091 CET	49919	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.960732937 CET	49919	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:03.960758924 CET	443	49919	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.035027981 CET	443	49915	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.035487890 CET	49915	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.035509109 CET	443	49915	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.035955906 CET	49915	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.035964012 CET	443	49915	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.164022923 CET	443	49916	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.164573908 CET	49916	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.164638996 CET	443	49916	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.164997101 CET	49916	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.165011883 CET	443	49916	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.167433023 CET	443	49915	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.167669058 CET	443	49915	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.167726040 CET	49915	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.167778015 CET	49915	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.167793989 CET	443	49915	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.167805910 CET	49915	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.167813063 CET	443	49915	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.170633078 CET	49920	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.170686007 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.170763016 CET	49920	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.170902967 CET	49920	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.170917034 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.252896070 CET	443	49917	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.253360987 CET	49917	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.253423929 CET	443	49917	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.253637075 CET	49917	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.253652096 CET	443	49917	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.297029018 CET	443	49916	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.297173023 CET	443	49916	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.297240973 CET	49916	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.297369003 CET	49916	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.297369003 CET	49916	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.297416925 CET	443	49916	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.297446966 CET	443	49916	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.299524069 CET	49921	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.299613953 CET	443	49921	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.299700022 CET	49921	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.299799919 CET	49921	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.299824953 CET	443	49921	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.368254900 CET	443	49918	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.372750044 CET	49918	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.372837067 CET	443	49918	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.373410940 CET	49918	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.373426914 CET	443	49918	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.382328987 CET	443	49917	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.382489920 CET	443	49917	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.382786036 CET	49917	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.382786036 CET	49917	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.382786036 CET	49917	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.385200024 CET	49922	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.385299921 CET	443	49922	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.385386944 CET	49922	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.385498047 CET	49922	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.385519028 CET	443	49922	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.599199057 CET	49917	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.599263906 CET	443	49917	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.647656918 CET	443	49918	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.647689104 CET	443	49918	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.647732019 CET	443	49918	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.647819042 CET	49918	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.647819996 CET	49918	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.647962093 CET	49918	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.647962093 CET	49918	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.648005962 CET	443	49918	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.648036957 CET	443	49918	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.650165081 CET	49923	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.650207043 CET	443	49923	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.650275946 CET	49923	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.650412083 CET	49923	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.650425911 CET	443	49923	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.783824921 CET	443	49919	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.784661055 CET	49919	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.784723997 CET	443	49919	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.785147905 CET	49919	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.785164118 CET	443	49919	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.915668964 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.916038990 CET	49920	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.916102886 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.916414022 CET	49920	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.916426897 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.921988964 CET	443	49919	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.922075033 CET	443	49919	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.922141075 CET	49919	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.922238111 CET	49919	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.922238111 CET	49919	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.922280073 CET	443	49919	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.922307968 CET	443	49919	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.926112890 CET	49924	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.926141024 CET	443	49924	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:04.926435947 CET	49924	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.926543951 CET	49924	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:04.926551104 CET	443	49924	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.033027887 CET	443	49921	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.033361912 CET	49921	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.033396959 CET	443	49921	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.033727884 CET	49921	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.033737898 CET	443	49921	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.059555054 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.059629917 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.059839964 CET	49920	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.059910059 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.060144901 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.060338020 CET	49920	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.060631990 CET	49920	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.060669899 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.060697079 CET	49920	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.060712099 CET	443	49920	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.063493013 CET	49925	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.063539028 CET	443	49925	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.063608885 CET	49925	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.063755989 CET	49925	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.063770056 CET	443	49925	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.108895063 CET	443	49922	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.109246969 CET	49922	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.109308958 CET	443	49922	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.109641075 CET	49922	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.109654903 CET	443	49922	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.166448116 CET	443	49921	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.166599989 CET	443	49921	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.166784048 CET	49921	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.166784048 CET	49921	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.166784048 CET	49921	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.168745995 CET	49926	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.168776989 CET	443	49926	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.168832064 CET	49926	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.168970108 CET	49926	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.168979883 CET	443	49926	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.241142035 CET	443	49922	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.241293907 CET	443	49922	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.241657019 CET	49922	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.251064062 CET	49922	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.251111984 CET	443	49922	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.251142979 CET	49922	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.251158953 CET	443	49922	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.253319979 CET	49927	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.253362894 CET	443	49927	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.253539085 CET	49927	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.253634930 CET	49927	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.253645897 CET	443	49927	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.380520105 CET	49921	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.380552053 CET	443	49921	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.399735928 CET	443	49923	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.404859066 CET	49923	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.404877901 CET	443	49923	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.405308962 CET	49923	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.405317068 CET	443	49923	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.534154892 CET	443	49923	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.534321070 CET	443	49923	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.534837961 CET	49923	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.535398006 CET	49923	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.535398006 CET	49923	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.535439014 CET	443	49923	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.535470009 CET	443	49923	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.539490938 CET	49928	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.539515972 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.539753914 CET	49928	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.539899111 CET	49928	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.539912939 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.669198990 CET	443	49924	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.669629097 CET	49924	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.669648886 CET	443	49924	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.670197964 CET	49924	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.670202971 CET	443	49924	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.804935932 CET	443	49924	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.804965019 CET	443	49924	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.805016041 CET	443	49924	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.805183887 CET	49924	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.809739113 CET	443	49925	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.817462921 CET	49924	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.817483902 CET	443	49924	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.817495108 CET	49924	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.817501068 CET	443	49924	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.819677114 CET	49925	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.819721937 CET	443	49925	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.821537971 CET	49925	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.821547031 CET	443	49925	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.850409031 CET	49929	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.850451946 CET	443	49929	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.852510929 CET	49929	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.853305101 CET	49929	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.853326082 CET	443	49929	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.916420937 CET	443	49926	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.923109055 CET	49926	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.923121929 CET	443	49926	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.925816059 CET	49926	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:05.925821066 CET	443	49926	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.948556900 CET	443	49925	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.948704958 CET	443	49925	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:05.952640057 CET	49925	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.001759052 CET	49925	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.001794100 CET	443	49925	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.001811028 CET	49925	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.001820087 CET	443	49925	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.004375935 CET	49930	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.004406929 CET	443	49930	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.004564047 CET	49930	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.004715919 CET	49930	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.004725933 CET	443	49930	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.035904884 CET	443	49927	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.036376953 CET	49927	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.036391973 CET	443	49927	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.042401075 CET	49927	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.042407990 CET	443	49927	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.053150892 CET	443	49926	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.053306103 CET	443	49926	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.054558992 CET	49926	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.085256100 CET	49926	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.085285902 CET	443	49926	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.085299015 CET	49926	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.085305929 CET	443	49926	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.143342972 CET	49931	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.143397093 CET	443	49931	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.143657923 CET	49931	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.146915913 CET	49931	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.146959066 CET	443	49931	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.184391975 CET	443	49927	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.184473038 CET	443	49927	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.188658953 CET	49927	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.190571070 CET	49927	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.190571070 CET	49927	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.190604925 CET	443	49927	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.190623999 CET	443	49927	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.202055931 CET	49932	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.202157021 CET	443	49932	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.202250957 CET	49932	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.202440977 CET	49932	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.202461958 CET	443	49932	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.267616034 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.268172026 CET	49928	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.268187046 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.268606901 CET	49928	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.268611908 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.395039082 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.395111084 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.395159006 CET	49928	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.395180941 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.395219088 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.395308018 CET	49928	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.395328045 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.395339966 CET	49928	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.395339966 CET	49928	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.395344973 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.395350933 CET	443	49928	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.397504091 CET	49933	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.397547007 CET	443	49933	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.397681952 CET	49933	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.397833109 CET	49933	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.397846937 CET	443	49933	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.576095104 CET	443	49929	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.576581955 CET	49929	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.576611996 CET	443	49929	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.576978922 CET	49929	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.576987028 CET	443	49929	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.703238964 CET	443	49929	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.703295946 CET	443	49929	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.703458071 CET	49929	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.703501940 CET	49929	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.703522921 CET	443	49929	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.703537941 CET	49929	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.703545094 CET	443	49929	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.706043959 CET	49934	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.706139088 CET	443	49934	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.706222057 CET	49934	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.706325054 CET	49934	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.706343889 CET	443	49934	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.782001972 CET	443	49930	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.782569885 CET	49930	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.782598019 CET	443	49930	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.782975912 CET	49930	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.782982111 CET	443	49930	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.883879900 CET	443	49931	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.884326935 CET	49931	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.884357929 CET	443	49931	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.885108948 CET	49931	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.885117054 CET	443	49931	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.917048931 CET	443	49930	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.917118073 CET	443	49930	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.917222977 CET	443	49930	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.917258024 CET	49930	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.917308092 CET	49930	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.917500019 CET	49930	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.917509079 CET	443	49930	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.917522907 CET	49930	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.917527914 CET	443	49930	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.920800924 CET	49935	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.920840979 CET	443	49935	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.920950890 CET	49935	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.921180010 CET	49935	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.921199083 CET	443	49935	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.944785118 CET	443	49932	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.945348024 CET	49932	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.945439100 CET	443	49932	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:06.945856094 CET	49932	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:06.945872068 CET	443	49932	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.012892962 CET	443	49931	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.013046980 CET	443	49931	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.013169050 CET	49931	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.013343096 CET	49931	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.013365030 CET	443	49931	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.013381958 CET	49931	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.013389111 CET	443	49931	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.016767025 CET	49936	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.016786098 CET	443	49936	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.017115116 CET	49936	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.017359972 CET	49936	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.017376900 CET	443	49936	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.073849916 CET	443	49932	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.074073076 CET	443	49932	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.074333906 CET	49932	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.074333906 CET	49932	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.074333906 CET	49932	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.076359987 CET	49937	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.076385975 CET	443	49937	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.076503992 CET	49937	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.076724052 CET	49937	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.076738119 CET	443	49937	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.136007071 CET	443	49933	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.136550903 CET	49933	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.136612892 CET	443	49933	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.137023926 CET	49933	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.137038946 CET	443	49933	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.264020920 CET	443	49933	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.264169931 CET	443	49933	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.264259100 CET	49933	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.264386892 CET	49933	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.264420033 CET	443	49933	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.264451027 CET	49933	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.264466047 CET	443	49933	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.266859055 CET	49938	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.266900063 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.267116070 CET	49938	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.267220974 CET	49938	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.267231941 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.380475998 CET	49932	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.380543947 CET	443	49932	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.467171907 CET	443	49934	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.469696045 CET	49934	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.469696999 CET	49934	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.469772100 CET	443	49934	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.469830036 CET	443	49934	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.597479105 CET	443	49934	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.597507954 CET	443	49934	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.597549915 CET	443	49934	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.597704887 CET	49934	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.597779036 CET	49934	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.597779036 CET	49934	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.597882032 CET	49934	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.597920895 CET	443	49934	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.600470066 CET	49939	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.600513935 CET	443	49939	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.600627899 CET	49939	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.602323055 CET	49939	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.602341890 CET	443	49939	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.675651073 CET	443	49935	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.676822901 CET	49935	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.676887035 CET	443	49935	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.677308083 CET	49935	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.677366018 CET	443	49935	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.812272072 CET	443	49935	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.812927008 CET	443	49935	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.813134909 CET	49935	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.813136101 CET	49935	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.813323975 CET	49935	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.813363075 CET	443	49935	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.816694975 CET	49940	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.816741943 CET	443	49940	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.816879034 CET	49940	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.816967964 CET	49940	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.816983938 CET	443	49940	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.828572989 CET	443	49937	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.828938007 CET	49937	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.828958988 CET	443	49937	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.829390049 CET	49937	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.829399109 CET	443	49937	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.960802078 CET	443	49937	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.960946083 CET	443	49937	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.961026907 CET	49937	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.961026907 CET	49937	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.961054087 CET	49937	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.961065054 CET	443	49937	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.962996006 CET	49941	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.963088989 CET	443	49941	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.963295937 CET	49941	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.963295937 CET	49941	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.963382006 CET	443	49941	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.993727922 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.994148970 CET	49938	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.994180918 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:07.994716883 CET	49938	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:07.994724035 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.121581078 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.121654034 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.121758938 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.127347946 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.127441883 CET	49938	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.128081083 CET	49938	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.144043922 CET	49938	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.144058943 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.144097090 CET	49938	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.144107103 CET	443	49938	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.148042917 CET	49942	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.148137093 CET	443	49942	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.148492098 CET	49942	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.148642063 CET	49942	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.148662090 CET	443	49942	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.345336914 CET	443	49939	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.346015930 CET	49939	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.346048117 CET	443	49939	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.346709013 CET	49939	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.346718073 CET	443	49939	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.474389076 CET	443	49939	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.474508047 CET	443	49939	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.474725008 CET	49939	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.491413116 CET	49939	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.491446972 CET	443	49939	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.491467953 CET	49939	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.491476059 CET	443	49939	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.496108055 CET	49943	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.496229887 CET	443	49943	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.496329069 CET	49943	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.496556997 CET	49943	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.496577978 CET	443	49943	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.540981054 CET	443	49940	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.599307060 CET	49940	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.601746082 CET	49940	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.601803064 CET	443	49940	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.602492094 CET	49940	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.602508068 CET	443	49940	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.714869022 CET	443	49941	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.722887993 CET	49941	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.722976923 CET	443	49941	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.729578018 CET	443	49940	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.729684114 CET	443	49940	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.729875088 CET	49940	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.730978966 CET	49941	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.730994940 CET	443	49941	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.734466076 CET	49940	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.734466076 CET	49940	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.734512091 CET	443	49940	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.734546900 CET	443	49940	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.748581886 CET	49944	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.748668909 CET	443	49944	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.748764992 CET	49944	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.748876095 CET	49944	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.748895884 CET	443	49944	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.861036062 CET	443	49941	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.861227036 CET	443	49941	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.861424923 CET	49941	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.861994982 CET	49941	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.861994982 CET	49941	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.862042904 CET	443	49941	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.862072945 CET	443	49941	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.869679928 CET	49945	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.869776964 CET	443	49945	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.869980097 CET	49945	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.870122910 CET	49945	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.870146036 CET	443	49945	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.883897066 CET	443	49942	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.884953022 CET	49942	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.885019064 CET	443	49942	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:08.885334015 CET	49942	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:08.885349989 CET	443	49942	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.014617920 CET	443	49942	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.014647961 CET	443	49942	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.014718056 CET	443	49942	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.014739990 CET	49942	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.016483068 CET	49942	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.027719021 CET	49942	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.027719021 CET	49942	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.027786970 CET	443	49942	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.027825117 CET	443	49942	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.032632113 CET	49946	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.032720089 CET	443	49946	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.032794952 CET	49946	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.033013105 CET	49946	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.033034086 CET	443	49946	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.369611025 CET	443	49943	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.370212078 CET	49943	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.370301008 CET	443	49943	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.370548010 CET	49943	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.370564938 CET	443	49943	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.375005960 CET	443	49936	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.375325918 CET	49936	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.375346899 CET	443	49936	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.375701904 CET	49936	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.375708103 CET	443	49936	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.497137070 CET	443	49943	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.497189999 CET	443	49943	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.497384071 CET	49943	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.497554064 CET	49943	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.497554064 CET	49943	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.497600079 CET	443	49943	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.497629881 CET	443	49943	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.501415014 CET	49947	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.501461029 CET	443	49947	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.501578093 CET	49947	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.501939058 CET	49947	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.501959085 CET	443	49947	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.505028963 CET	443	49936	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.505120993 CET	443	49936	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.505294085 CET	49936	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.506019115 CET	49936	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.506019115 CET	49936	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.506032944 CET	443	49936	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.506042004 CET	443	49936	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.513356924 CET	443	49944	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.513797998 CET	49944	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.513861895 CET	443	49944	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.514296055 CET	49944	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.514312029 CET	443	49944	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.514436007 CET	49948	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.514461040 CET	443	49948	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.514574051 CET	49948	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.514683008 CET	49948	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.514700890 CET	443	49948	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.638407946 CET	443	49945	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.638748884 CET	49945	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.638761997 CET	443	49945	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.639182091 CET	49945	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.639187098 CET	443	49945	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.648505926 CET	443	49944	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.648652077 CET	443	49944	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.648736000 CET	49944	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.648765087 CET	49944	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.648765087 CET	49944	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.648777962 CET	443	49944	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.648785114 CET	443	49944	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.650868893 CET	49949	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.650902033 CET	443	49949	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.650969982 CET	49949	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.651058912 CET	49949	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.651067019 CET	443	49949	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.777606964 CET	443	49946	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.778012991 CET	49946	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.778053045 CET	443	49946	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.778311968 CET	49946	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.778328896 CET	443	49946	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.907625914 CET	443	49946	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.907700062 CET	443	49946	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.907809019 CET	443	49946	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.907877922 CET	49946	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.907877922 CET	49946	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.907972097 CET	49946	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.907972097 CET	49946	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.908013105 CET	443	49946	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.908042908 CET	443	49946	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.910696030 CET	49950	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.910718918 CET	443	49950	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.910804033 CET	49950	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.910989046 CET	49950	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.911004066 CET	443	49950	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.925975084 CET	443	49945	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.926135063 CET	443	49945	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.926317930 CET	49945	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.926403999 CET	49945	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.926404953 CET	49945	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.926449060 CET	443	49945	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.926484108 CET	443	49945	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.928515911 CET	49951	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.928545952 CET	443	49951	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:09.928654909 CET	49951	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.928812981 CET	49951	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:09.928826094 CET	443	49951	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.233283997 CET	443	49947	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.233999968 CET	49947	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.234081984 CET	443	49947	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.234319925 CET	49947	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.234334946 CET	443	49947	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.248878956 CET	443	49948	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.249409914 CET	49948	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.249432087 CET	443	49948	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.249725103 CET	49948	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.249732018 CET	443	49948	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.364142895 CET	443	49947	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.364242077 CET	443	49947	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.364423990 CET	49947	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.364552021 CET	49947	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.364552021 CET	49947	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.364598989 CET	443	49947	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.364629030 CET	443	49947	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.367914915 CET	49952	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.367959023 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.368093967 CET	49952	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.368290901 CET	49952	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.368309975 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.386079073 CET	443	49948	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.386111021 CET	443	49948	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.386168003 CET	443	49948	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.386179924 CET	49948	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.386219978 CET	49948	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.386478901 CET	49948	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.386488914 CET	443	49948	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.386506081 CET	49948	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.386508942 CET	443	49948	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.389841080 CET	49953	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.389874935 CET	443	49953	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.390047073 CET	49953	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.390182972 CET	49953	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.390199900 CET	443	49953	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.398482084 CET	443	49949	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.398993969 CET	49949	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.399014950 CET	443	49949	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.399394989 CET	49949	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.399400949 CET	443	49949	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.529104948 CET	443	49949	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.529262066 CET	443	49949	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.529649019 CET	49949	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.529649019 CET	49949	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.529704094 CET	49949	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.529733896 CET	443	49949	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.532434940 CET	49954	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.532474995 CET	443	49954	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.532663107 CET	49954	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.532663107 CET	49954	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.532701015 CET	443	49954	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.665153027 CET	443	49951	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.666007996 CET	49951	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.666038036 CET	443	49951	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.668452978 CET	49951	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.668458939 CET	443	49951	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.687685966 CET	443	49950	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.689075947 CET	49950	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.689076900 CET	49950	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.689100027 CET	443	49950	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.689120054 CET	443	49950	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.796155930 CET	443	49951	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.796320915 CET	443	49951	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.796489954 CET	49951	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.796489954 CET	49951	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.796605110 CET	49951	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.796622038 CET	443	49951	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.798959970 CET	49955	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.798993111 CET	443	49955	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.799350023 CET	49955	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.799567938 CET	49955	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.799585104 CET	443	49955	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.824053049 CET	443	49950	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.824127913 CET	443	49950	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.824229956 CET	443	49950	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.824321985 CET	49950	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.824321985 CET	49950	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.824389935 CET	49950	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.824398041 CET	443	49950	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.826589108 CET	49956	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.826675892 CET	443	49956	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:10.826826096 CET	49956	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.827043056 CET	49956	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:10.827084064 CET	443	49956	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.102478981 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.112468004 CET	49952	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.112498999 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.112634897 CET	49952	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.112643003 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.121866941 CET	443	49953	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.122472048 CET	49953	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.122493982 CET	443	49953	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.122952938 CET	49953	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.122961044 CET	443	49953	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.250616074 CET	443	49953	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.250780106 CET	443	49953	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.250896931 CET	49953	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.251185894 CET	49953	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.251185894 CET	49953	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.251219988 CET	443	49953	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.251250982 CET	443	49953	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.253756046 CET	49957	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.253858089 CET	443	49957	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.254051924 CET	49957	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.254159927 CET	49957	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.254184961 CET	443	49957	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.277851105 CET	443	49954	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.278203964 CET	49954	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.278266907 CET	443	49954	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.280457973 CET	49954	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.280474901 CET	443	49954	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.393666983 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.393737078 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.393815041 CET	49952	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.393848896 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.393927097 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.393951893 CET	49952	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.393979073 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.393995047 CET	49952	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.394005060 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.394016981 CET	49952	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.394021988 CET	443	49952	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.396550894 CET	49958	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.396639109 CET	443	49958	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.396723032 CET	49958	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.396842003 CET	49958	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.396867037 CET	443	49958	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.410969973 CET	443	49954	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.411043882 CET	443	49954	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.411124945 CET	49954	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.411148071 CET	443	49954	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.411226034 CET	49954	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.411278009 CET	49954	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.411278963 CET	49954	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.411331892 CET	443	49954	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.411364079 CET	443	49954	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.413160086 CET	49959	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.413237095 CET	443	49959	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.413302898 CET	49959	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.413410902 CET	49959	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.413433075 CET	443	49959	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.544600010 CET	443	49955	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.545070887 CET	49955	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.545094013 CET	443	49955	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.545573950 CET	49955	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.545579910 CET	443	49955	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.590033054 CET	443	49956	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.592046022 CET	49956	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.592135906 CET	443	49956	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.592911959 CET	49956	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.592928886 CET	443	49956	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.674690008 CET	443	49955	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.674874067 CET	443	49955	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.674928904 CET	49955	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.674978971 CET	49955	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.674994946 CET	443	49955	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.675007105 CET	49955	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.675014019 CET	443	49955	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.677916050 CET	49960	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.678009033 CET	443	49960	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.678101063 CET	49960	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.678241014 CET	49960	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.678266048 CET	443	49960	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.722388983 CET	443	49956	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.722547054 CET	443	49956	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.722619057 CET	49956	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.722702026 CET	49956	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.722702980 CET	49956	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.722745895 CET	443	49956	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.722774982 CET	443	49956	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.725090027 CET	49961	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.725183964 CET	443	49961	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.725267887 CET	49961	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.725380898 CET	49961	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.725404024 CET	443	49961	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.977493048 CET	443	49957	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.978030920 CET	49957	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.978096962 CET	443	49957	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:11.978375912 CET	49957	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:11.978399038 CET	443	49957	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.103971004 CET	443	49957	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.104145050 CET	443	49957	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.104244947 CET	49957	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.104336023 CET	49957	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.104336023 CET	49957	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.104379892 CET	443	49957	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.104410887 CET	443	49957	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.107692957 CET	49962	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.107769012 CET	443	49962	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.107861996 CET	49962	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.108016968 CET	49962	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.108041048 CET	443	49962	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.130768061 CET	443	49958	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.131269932 CET	49958	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.131318092 CET	443	49958	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.131711006 CET	49958	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.131720066 CET	443	49958	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.159235954 CET	443	49959	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.159598112 CET	49959	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.159683943 CET	443	49959	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.160015106 CET	49959	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.160029888 CET	443	49959	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.261471987 CET	443	49958	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.261509895 CET	443	49958	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.261560917 CET	443	49958	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.261709929 CET	49958	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.261710882 CET	49958	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.262878895 CET	49958	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.262878895 CET	49958	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.262923002 CET	443	49958	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.262953997 CET	443	49958	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.265475035 CET	49963	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.265568972 CET	443	49963	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.265656948 CET	49963	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.265772104 CET	49963	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.265793085 CET	443	49963	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.289192915 CET	443	49959	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.289335966 CET	443	49959	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.289428949 CET	49959	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.289428949 CET	49959	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.289429903 CET	49959	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.291527033 CET	49964	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.291548014 CET	443	49964	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.291603088 CET	49964	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.291733980 CET	49964	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.291748047 CET	443	49964	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.404938936 CET	443	49960	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.405302048 CET	49960	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.405334949 CET	443	49960	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.405649900 CET	49960	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.405656099 CET	443	49960	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.469377041 CET	443	49961	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.470012903 CET	49961	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.470012903 CET	49961	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.470094919 CET	443	49961	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.470125914 CET	443	49961	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.532051086 CET	443	49960	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.532123089 CET	443	49960	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.532211065 CET	443	49960	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.532313108 CET	49960	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.532314062 CET	49960	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.532409906 CET	49960	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.532411098 CET	49960	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.532450914 CET	443	49960	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.532481909 CET	443	49960	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.534470081 CET	49965	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.534513950 CET	443	49965	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.534717083 CET	49965	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.534908056 CET	49965	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.534928083 CET	443	49965	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.600028038 CET	443	49961	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.600164890 CET	49959	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.600172997 CET	443	49961	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.600189924 CET	443	49959	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.600301981 CET	49961	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.601392984 CET	49961	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.601433992 CET	443	49961	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.601471901 CET	49961	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.601489067 CET	443	49961	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.604434967 CET	49966	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.604455948 CET	443	49966	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.604567051 CET	49966	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.608458996 CET	49966	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.608473063 CET	443	49966	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.857268095 CET	443	49962	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.858185053 CET	49962	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.858185053 CET	49962	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.858251095 CET	443	49962	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.858294010 CET	443	49962	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.988730907 CET	443	49962	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.988887072 CET	443	49962	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.989094973 CET	49962	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.989094973 CET	49962	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.989094973 CET	49962	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.992300034 CET	49967	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.992330074 CET	443	49967	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.992496014 CET	49967	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.992784977 CET	49967	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.992801905 CET	443	49967	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.997025967 CET	443	49963	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.998146057 CET	49963	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.998147011 CET	49963	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:12.998214006 CET	443	49963	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:12.998266935 CET	443	49963	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.027395010 CET	443	49964	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.028218985 CET	49964	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.028259993 CET	443	49964	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.029010057 CET	49964	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.029016972 CET	443	49964	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.126799107 CET	443	49963	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.126862049 CET	443	49963	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.127093077 CET	49963	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.127197027 CET	49963	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.127197027 CET	49963	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.127239943 CET	443	49963	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.127278090 CET	443	49963	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.130183935 CET	49968	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.130234003 CET	443	49968	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.130520105 CET	49968	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.139827013 CET	49968	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.139859915 CET	443	49968	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.155957937 CET	443	49964	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.156033993 CET	443	49964	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.156142950 CET	443	49964	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.156375885 CET	49964	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.156423092 CET	49964	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.156423092 CET	49964	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.156444073 CET	443	49964	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.156461000 CET	443	49964	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.158704042 CET	49969	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.158792973 CET	443	49969	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.160561085 CET	49969	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.160759926 CET	49969	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.160797119 CET	443	49969	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.266113997 CET	443	49965	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.267497063 CET	49965	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.267503977 CET	443	49965	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.267786980 CET	49965	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.267792940 CET	443	49965	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.302577019 CET	49962	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.302661896 CET	443	49962	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.356409073 CET	443	49966	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.357690096 CET	49966	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.357690096 CET	49966	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.357724905 CET	443	49966	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.357753992 CET	443	49966	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.393213034 CET	443	49965	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.393393993 CET	443	49965	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.393834114 CET	49965	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.393889904 CET	49965	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.393901110 CET	443	49965	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.393927097 CET	49965	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.393930912 CET	443	49965	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.396665096 CET	49970	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.396760941 CET	443	49970	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.396864891 CET	49970	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.397053957 CET	49970	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.397077084 CET	443	49970	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.488892078 CET	443	49966	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.488970041 CET	443	49966	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.489074945 CET	443	49966	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.489125967 CET	49966	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.489125967 CET	49966	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.489171982 CET	49966	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.489192963 CET	443	49966	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.489208937 CET	49966	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.489216089 CET	443	49966	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.491204977 CET	49971	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.491292000 CET	443	49971	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.491375923 CET	49971	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.491491079 CET	49971	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.491513968 CET	443	49971	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.724318027 CET	443	49967	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.724827051 CET	49967	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.724843025 CET	443	49967	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.725485086 CET	49967	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.725488901 CET	443	49967	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.853905916 CET	443	49967	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.853969097 CET	443	49967	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.854049921 CET	49967	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.854193926 CET	49967	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.854213953 CET	443	49967	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.854226112 CET	49967	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.854233027 CET	443	49967	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.857601881 CET	49972	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.857625961 CET	443	49972	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.857815027 CET	49972	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.857965946 CET	49972	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.857975960 CET	443	49972	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.879939079 CET	443	49968	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.880341053 CET	49968	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.880404949 CET	443	49968	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:13.881015062 CET	49968	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:13.881030083 CET	443	49968	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.011280060 CET	443	49968	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.011476040 CET	443	49968	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.011553049 CET	49968	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.011710882 CET	49968	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.011710882 CET	49968	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.011756897 CET	443	49968	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.011785984 CET	443	49968	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.015316963 CET	49973	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.015367031 CET	443	49973	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.015433073 CET	49973	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.015642881 CET	49973	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.015662909 CET	443	49973	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.044765949 CET	443	49969	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.045265913 CET	49969	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.045332909 CET	443	49969	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.045867920 CET	49969	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.045923948 CET	443	49969	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.137221098 CET	443	49970	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.137696028 CET	49970	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.137772083 CET	443	49970	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.138251066 CET	49970	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.138266087 CET	443	49970	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.173851967 CET	443	49969	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.173917055 CET	443	49969	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.174124956 CET	49969	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.174124956 CET	49969	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.174124956 CET	49969	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.176712990 CET	49974	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.176748991 CET	443	49974	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.176812887 CET	49974	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.176940918 CET	49974	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.176950932 CET	443	49974	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.263487101 CET	443	49971	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.263911009 CET	49971	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.263977051 CET	443	49971	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.264458895 CET	49971	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.264517069 CET	443	49971	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.270693064 CET	443	49970	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.270843029 CET	443	49970	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.270958900 CET	49970	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.271039009 CET	49970	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.271078110 CET	443	49970	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.271115065 CET	49970	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.271132946 CET	443	49970	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.273401976 CET	49975	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.273452044 CET	443	49975	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.273639917 CET	49975	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.273639917 CET	49975	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.273710012 CET	443	49975	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.396137953 CET	49969	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.396208048 CET	443	49969	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.416258097 CET	443	49971	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.416440010 CET	443	49971	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.416712999 CET	49971	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.416712999 CET	49971	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.416712999 CET	49971	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.419195890 CET	49976	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.419240952 CET	443	49976	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.419341087 CET	49976	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.419476986 CET	49976	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.419496059 CET	443	49976	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.596570015 CET	443	49972	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.597048044 CET	49972	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.597059965 CET	443	49972	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.597599030 CET	49972	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.597604036 CET	443	49972	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.724169016 CET	49971	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.724241018 CET	443	49971	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.738419056 CET	443	49972	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.745069981 CET	443	49972	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.745130062 CET	49972	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.745193005 CET	49972	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.745213985 CET	443	49972	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.745227098 CET	49972	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.745234013 CET	443	49972	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.748050928 CET	49977	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.748159885 CET	443	49977	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.748239994 CET	49977	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.748425961 CET	49977	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.748464108 CET	443	49977	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.757690907 CET	443	49973	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.758080959 CET	49973	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.758124113 CET	443	49973	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.758486032 CET	49973	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.758493900 CET	443	49973	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.893789053 CET	443	49973	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.894129038 CET	443	49973	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.894207001 CET	49973	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.894207001 CET	49973	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.894318104 CET	49973	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.894360065 CET	443	49973	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.896779060 CET	49978	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.896815062 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.896872044 CET	49978	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.896979094 CET	49978	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.896986961 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.913758039 CET	443	49974	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.914082050 CET	49974	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.914093018 CET	443	49974	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:14.914467096 CET	49974	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:14.914473057 CET	443	49974	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.062685013 CET	443	49974	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.062758923 CET	443	49974	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.062870026 CET	443	49974	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.062947989 CET	49974	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.062999964 CET	49974	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.063015938 CET	443	49974	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.063030005 CET	49974	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.063036919 CET	443	49974	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.065912008 CET	49979	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.066011906 CET	443	49979	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.066103935 CET	49979	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.066253901 CET	49979	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.066291094 CET	443	49979	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.163115978 CET	443	49976	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.164376020 CET	49976	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.164403915 CET	443	49976	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.165009975 CET	49976	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.165018082 CET	443	49976	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.293433905 CET	443	49976	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.293606043 CET	443	49976	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.293746948 CET	49976	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.293787956 CET	49976	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.293787956 CET	49976	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.293808937 CET	443	49976	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.293823004 CET	443	49976	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.296439886 CET	49980	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.296533108 CET	443	49980	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.296607018 CET	49980	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.296751022 CET	49980	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.296775103 CET	443	49980	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.475353956 CET	443	49977	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.475961924 CET	49977	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.476027012 CET	443	49977	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.476455927 CET	49977	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.476512909 CET	443	49977	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.601819038 CET	443	49977	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.601979971 CET	443	49977	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.602166891 CET	49977	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.602166891 CET	49977	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.602166891 CET	49977	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.604715109 CET	49981	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.604811907 CET	443	49981	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.604975939 CET	49981	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.605113029 CET	49981	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.605154037 CET	443	49981	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.626071930 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.626492977 CET	49978	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.626538992 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.626929045 CET	49978	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.626940966 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.752209902 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.752260923 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.752329111 CET	49978	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.752347946 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.752404928 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.752608061 CET	49978	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.752634048 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.752648115 CET	49978	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.752655983 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.752684116 CET	49978	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.752688885 CET	443	49978	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.755954981 CET	49982	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.756053925 CET	443	49982	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.756136894 CET	49982	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.756275892 CET	49982	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.756300926 CET	443	49982	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.799252987 CET	443	49979	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.799644947 CET	49979	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.799666882 CET	443	49979	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.800080061 CET	49979	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.800086021 CET	443	49979	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.911633015 CET	49977	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.911655903 CET	443	49977	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.929263115 CET	443	49979	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.929337025 CET	443	49979	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.929436922 CET	443	49979	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.929483891 CET	49979	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.929539919 CET	49979	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.929550886 CET	443	49979	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.929563999 CET	49979	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.929569006 CET	443	49979	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.931945086 CET	49983	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.932038069 CET	443	49983	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:15.932151079 CET	49983	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.932323933 CET	49983	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:15.932349920 CET	443	49983	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.039918900 CET	443	49980	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.043509960 CET	49980	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.043574095 CET	443	49980	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.043960094 CET	49980	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.043972969 CET	443	49980	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.176583052 CET	443	49980	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.176654100 CET	443	49980	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.176767111 CET	443	49980	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.176831007 CET	49980	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.177021980 CET	49980	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.177021980 CET	49980	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.177067041 CET	443	49980	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.177093983 CET	443	49980	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.179769993 CET	49984	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.179847002 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.179944038 CET	49984	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.180120945 CET	49984	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.180150986 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.380187035 CET	443	49981	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.386657000 CET	49981	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.386723042 CET	443	49981	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.387021065 CET	49981	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.387037992 CET	443	49981	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.488488913 CET	443	49982	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.488883972 CET	49982	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.488971949 CET	443	49982	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.489351034 CET	49982	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.489367962 CET	443	49982	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.526165962 CET	443	49981	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.526314974 CET	443	49981	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.526388884 CET	49981	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.526516914 CET	49981	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.526534081 CET	443	49981	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.526542902 CET	49981	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.526547909 CET	443	49981	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.529809952 CET	49985	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.529905081 CET	443	49985	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.530164003 CET	49985	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.530388117 CET	49985	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.530424118 CET	443	49985	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.618287086 CET	443	49982	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.621155024 CET	443	49982	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.621222019 CET	49982	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.621252060 CET	443	49982	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.621541023 CET	49982	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.621588945 CET	49982	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.621588945 CET	49982	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.621630907 CET	443	49982	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.621659040 CET	443	49982	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.623615980 CET	49986	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.623709917 CET	443	49986	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.623819113 CET	49986	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.623918056 CET	49986	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.623953104 CET	443	49986	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.677860975 CET	443	49983	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.678299904 CET	49983	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.678375959 CET	443	49983	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.678565979 CET	49983	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.678582907 CET	443	49983	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.809340954 CET	443	49983	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.809514046 CET	443	49983	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.809737921 CET	49983	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.809737921 CET	49983	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.809739113 CET	49983	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.812550068 CET	49987	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.812649012 CET	443	49987	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.812743902 CET	49987	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.812900066 CET	49987	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.812937021 CET	443	49987	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.940485001 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.941766024 CET	49984	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.941832066 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.942085028 CET	49984	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.942102909 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.967268944 CET	443	49975	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.969738007 CET	49975	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.969769955 CET	443	49975	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:16.970252991 CET	49975	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:16.970258951 CET	443	49975	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.074052095 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.074111938 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.074199915 CET	49984	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.074240923 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.074275970 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.074330091 CET	49984	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.074547052 CET	49984	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.074579000 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.074610949 CET	49984	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.074626923 CET	443	49984	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.079250097 CET	49988	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.079288006 CET	443	49988	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.079340935 CET	49988	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.079703093 CET	49988	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.079719067 CET	443	49988	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.104549885 CET	443	49975	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.104715109 CET	443	49975	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.104911089 CET	49975	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.104911089 CET	49975	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.104911089 CET	49975	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.107381105 CET	49989	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.107414961 CET	443	49989	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.107614040 CET	49989	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.107731104 CET	49989	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.107745886 CET	443	49989	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.114765882 CET	49983	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.114783049 CET	443	49983	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.278183937 CET	443	49985	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.278717041 CET	49985	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.278764963 CET	443	49985	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.279258966 CET	49985	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.279273033 CET	443	49985	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.379792929 CET	443	49986	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.384644985 CET	49986	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.384711027 CET	443	49986	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.385566950 CET	49986	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.385586977 CET	443	49986	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.415915966 CET	443	49985	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.416023970 CET	443	49985	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.416150093 CET	443	49985	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.416352987 CET	49985	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.416784048 CET	49975	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.416810989 CET	443	49975	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.440726995 CET	49985	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.440726995 CET	49985	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.440814018 CET	443	49985	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.440850019 CET	443	49985	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.443965912 CET	49990	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.444001913 CET	443	49990	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.444189072 CET	49990	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.444411039 CET	49990	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.444420099 CET	443	49990	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.520792007 CET	443	49986	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.520878077 CET	443	49986	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.521300077 CET	443	49986	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.521415949 CET	49986	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.562359095 CET	49986	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.562359095 CET	49986	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.562434912 CET	443	49986	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.562477112 CET	443	49986	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.606295109 CET	49991	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.606336117 CET	443	49991	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.606443882 CET	49991	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.606576920 CET	49991	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.606585026 CET	443	49991	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.709443092 CET	443	49987	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.740804911 CET	49987	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.740870953 CET	443	49987	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.745520115 CET	49987	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.745536089 CET	443	49987	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.836287022 CET	443	49988	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.839919090 CET	443	49989	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.851372957 CET	49988	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.851408958 CET	443	49988	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.851867914 CET	49988	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.851872921 CET	443	49988	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.852329016 CET	49989	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.852348089 CET	443	49989	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.852890968 CET	49989	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.852897882 CET	443	49989	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.874408007 CET	443	49987	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.874578953 CET	443	49987	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.874706030 CET	49987	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.874794960 CET	49987	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.874794960 CET	49987	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.874840021 CET	443	49987	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.874871016 CET	443	49987	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.877657890 CET	49992	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.877700090 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.877758980 CET	49992	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.877885103 CET	49992	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.877896070 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.977037907 CET	443	49989	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.977188110 CET	443	49989	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.977247000 CET	49989	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.977284908 CET	49989	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.977300882 CET	443	49989	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.977309942 CET	49989	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.977313995 CET	443	49989	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.979506969 CET	49993	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.979542971 CET	443	49993	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.979640961 CET	49993	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.979779959 CET	49993	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.979789972 CET	443	49993	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.980732918 CET	443	49988	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.980906010 CET	443	49988	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.980961084 CET	49988	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.981003046 CET	49988	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.981023073 CET	443	49988	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.981034994 CET	49988	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.981040001 CET	443	49988	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.983544111 CET	49994	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.983582020 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:17.983644009 CET	49994	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.983829021 CET	49994	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:17.983844995 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.159478903 CET	443	49990	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.159926891 CET	49990	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.159965038 CET	443	49990	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.160332918 CET	49990	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.160339117 CET	443	49990	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.287488937 CET	443	49990	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.287511110 CET	443	49990	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.287555933 CET	49990	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.287569046 CET	443	49990	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.287609100 CET	49990	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.287862062 CET	49990	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.287877083 CET	443	49990	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.287887096 CET	49990	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.287892103 CET	443	49990	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.290473938 CET	49995	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.290505886 CET	443	49995	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.290600061 CET	49995	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.290764093 CET	49995	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.290776968 CET	443	49995	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.378675938 CET	443	49991	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.379003048 CET	49991	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.379025936 CET	443	49991	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.379348993 CET	49991	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.379353046 CET	443	49991	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.508729935 CET	443	49991	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.509394884 CET	443	49991	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.509448051 CET	49991	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.509502888 CET	49991	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.509516001 CET	443	49991	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.509543896 CET	49991	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.509547949 CET	443	49991	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.512057066 CET	49996	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.512156963 CET	443	49996	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.512284994 CET	49996	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.512450933 CET	49996	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.512482882 CET	443	49996	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.616130114 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.616518021 CET	49992	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.616569042 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.616889000 CET	49992	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.616895914 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.706899881 CET	443	49993	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.707194090 CET	49993	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.707206011 CET	443	49993	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.707578897 CET	49993	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.707585096 CET	443	49993	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.718194962 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.718622923 CET	49994	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.718660116 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.718976021 CET	49994	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.718983889 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.744277000 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.744570971 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.744626999 CET	49992	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.744662046 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.744692087 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.744738102 CET	49992	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.744770050 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.744786024 CET	49992	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.744793892 CET	443	49992	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.747322083 CET	49997	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.747416973 CET	443	49997	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.747514009 CET	49997	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.747647047 CET	49997	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.747670889 CET	443	49997	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.835081100 CET	443	49993	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.835258007 CET	443	49993	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.835318089 CET	49993	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.835417032 CET	49993	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.835434914 CET	443	49993	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.835449934 CET	49993	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.835457087 CET	443	49993	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.838104010 CET	49998	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.838207006 CET	443	49998	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.838294029 CET	49998	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.838422060 CET	49998	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.838443995 CET	443	49998	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.848196983 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.848268986 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.848325968 CET	49994	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.848366976 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.848397017 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.848445892 CET	49994	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.848484993 CET	49994	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.848505020 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.848519087 CET	49994	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.848526001 CET	443	49994	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.850330114 CET	49999	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.850424051 CET	443	49999	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:18.850549936 CET	49999	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.850682974 CET	49999	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:18.850718975 CET	443	49999	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.006599903 CET	443	49995	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.007287025 CET	49995	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.007302999 CET	443	49995	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.007606983 CET	49995	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.007625103 CET	443	49995	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.134295940 CET	443	49995	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.134362936 CET	443	49995	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.134428024 CET	49995	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.134527922 CET	49995	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.134562969 CET	443	49995	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.134576082 CET	49995	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.134582996 CET	443	49995	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.136850119 CET	50000	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.136874914 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.137111902 CET	50000	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.137255907 CET	50000	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.137267113 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.287950039 CET	443	49996	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.288427114 CET	49996	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.288465977 CET	443	49996	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.288898945 CET	49996	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.288908958 CET	443	49996	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.422856092 CET	443	49996	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.423017025 CET	443	49996	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.423274994 CET	49996	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.423274994 CET	49996	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.423420906 CET	49996	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.423470020 CET	443	49996	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.425745010 CET	50001	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.425812960 CET	443	50001	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.426009893 CET	50001	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.426009893 CET	50001	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.426068068 CET	443	50001	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.496251106 CET	443	49997	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.496972084 CET	49997	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.497044086 CET	443	49997	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.498431921 CET	49997	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.498447895 CET	443	49997	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.589960098 CET	443	49999	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.590747118 CET	49999	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.590747118 CET	49999	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.590812922 CET	443	49999	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.590867043 CET	443	49999	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.594849110 CET	443	49998	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.595383883 CET	49998	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.595448971 CET	443	49998	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.595555067 CET	49998	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.595571041 CET	443	49998	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.626456022 CET	443	49997	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.626602888 CET	443	49997	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.626832008 CET	49997	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.626832962 CET	49997	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.626832962 CET	49997	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.629573107 CET	50002	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.629609108 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.629985094 CET	50002	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.629985094 CET	50002	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.630018950 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.719080925 CET	443	49999	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.719244003 CET	443	49999	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.719439983 CET	49999	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.719439983 CET	49999	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.719439983 CET	49999	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.723006010 CET	50003	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.723063946 CET	443	50003	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.723233938 CET	50003	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.723233938 CET	50003	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.723278999 CET	443	50003	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.725210905 CET	443	49998	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.725369930 CET	443	49998	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.725492001 CET	49998	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.725492954 CET	49998	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.725492954 CET	49998	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.727355957 CET	50004	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.727417946 CET	443	50004	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.727565050 CET	50004	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.727672100 CET	50004	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.727693081 CET	443	50004	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:19.927548885 CET	49997	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:19.927594900 CET	443	49997	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.021409988 CET	49999	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.021480083 CET	443	49999	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.036693096 CET	49998	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.036770105 CET	443	49998	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.175442934 CET	443	50001	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.221236944 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.224216938 CET	50001	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.237049103 CET	50001	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.237049103 CET	50001	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.237066984 CET	443	50001	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.237097025 CET	443	50001	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.272409916 CET	50000	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.273015022 CET	50000	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.273031950 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.273520947 CET	50000	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.273534060 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.365914106 CET	443	50001	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.366456985 CET	443	50001	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.372422934 CET	50001	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.373666048 CET	50001	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.373666048 CET	50001	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.373689890 CET	443	50001	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.373703003 CET	443	50001	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.375876904 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.392493010 CET	50002	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.392508030 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.395076990 CET	50002	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.395092010 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.398235083 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.398271084 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.398317099 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.398341894 CET	50000	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.398514032 CET	50000	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.398539066 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.398549080 CET	50000	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.398549080 CET	50000	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.398555040 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.398560047 CET	443	50000	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.426733971 CET	50005	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.426831007 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.426901102 CET	50006	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.426917076 CET	50005	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.426996946 CET	443	50006	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.427025080 CET	50005	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.427046061 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.427063942 CET	50006	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.427122116 CET	50006	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.427140951 CET	443	50006	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.471054077 CET	443	50004	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.472009897 CET	50004	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.472039938 CET	443	50004	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.473030090 CET	443	50003	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.473053932 CET	50004	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.473066092 CET	443	50004	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.503015995 CET	50003	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.503050089 CET	443	50003	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.504147053 CET	50003	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.504156113 CET	443	50003	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.521929026 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.522008896 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.522062063 CET	50002	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.522069931 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.522124052 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.522167921 CET	50002	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.601413965 CET	443	50004	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.601615906 CET	443	50004	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.601738930 CET	443	50004	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.601804972 CET	50004	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.601805925 CET	50004	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.629554987 CET	443	50003	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.629739046 CET	443	50003	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.629798889 CET	50003	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.638943911 CET	50002	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.638963938 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.638974905 CET	50002	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.638982058 CET	443	50002	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.646615028 CET	50004	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.646682024 CET	443	50004	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.657454967 CET	50003	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.657454967 CET	50003	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.657494068 CET	443	50003	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.657510996 CET	443	50003	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.684237957 CET	50007	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.684329987 CET	443	50007	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.684390068 CET	50008	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.684416056 CET	50007	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.684482098 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.684544086 CET	50008	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.684952021 CET	50007	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.684990883 CET	443	50007	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.685034037 CET	50008	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.685075045 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.686243057 CET	50009	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.686336994 CET	443	50009	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:20.686491966 CET	50009	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.686697960 CET	50009	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:20.686733961 CET	443	50009	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.160285950 CET	443	50006	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.160876989 CET	50006	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.160939932 CET	443	50006	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.161147118 CET	50006	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.161163092 CET	443	50006	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.167798042 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.168236017 CET	50005	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.168277979 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.168538094 CET	50005	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.168548107 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.290376902 CET	443	50006	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.290597916 CET	443	50006	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.290776968 CET	50006	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.290776968 CET	50006	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.290776968 CET	50006	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.293342113 CET	50010	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.293436050 CET	443	50010	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.293565989 CET	50010	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.293724060 CET	50010	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.293747902 CET	443	50010	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.299026966 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.299051046 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.299108028 CET	50005	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.299175024 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.299213886 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.299221992 CET	50005	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.299273014 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.299304962 CET	50005	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.299304962 CET	50005	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.299326897 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.299346924 CET	443	50005	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.300944090 CET	50011	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.301040888 CET	443	50011	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.301124096 CET	50011	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.301234961 CET	50011	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.301270962 CET	443	50011	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.420198917 CET	443	50007	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.421173096 CET	50007	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.421173096 CET	50007	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.421242952 CET	443	50007	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.421292067 CET	443	50007	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.426501036 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.428653002 CET	50008	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.428714991 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.431364059 CET	50008	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.431379080 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.523577929 CET	50006	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.523643017 CET	443	50006	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.549205065 CET	443	50007	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.549367905 CET	443	50007	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.552506924 CET	50007	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.552603006 CET	50007	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.552603006 CET	50007	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.552649975 CET	443	50007	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.552680016 CET	443	50007	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.560408115 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.560468912 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.560580969 CET	50008	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.560648918 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.560822010 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.560952902 CET	50008	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.561007023 CET	50008	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.561007977 CET	50008	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.561042070 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.561065912 CET	443	50008	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.561876059 CET	50012	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.561917067 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.564452887 CET	50012	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.564508915 CET	50013	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.564603090 CET	443	50013	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.564641953 CET	50012	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.564655066 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:21.564688921 CET	50013	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.564750910 CET	50013	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:21.564774036 CET	443	50013	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.020237923 CET	443	50010	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.021226883 CET	50010	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.021226883 CET	50010	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.021296024 CET	443	50010	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.021394968 CET	443	50010	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.077353001 CET	443	50011	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.077872992 CET	50011	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.077944994 CET	443	50011	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.078389883 CET	50011	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.078404903 CET	443	50011	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.148931980 CET	443	50010	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.148993969 CET	443	50010	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.149111032 CET	443	50010	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.149230003 CET	50010	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.149307013 CET	50010	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.149307013 CET	50010	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.149358034 CET	443	50010	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.149452925 CET	50010	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.149471998 CET	443	50010	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.152120113 CET	50014	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.152151108 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.155462027 CET	50014	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.155539989 CET	50014	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.155544043 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.219145060 CET	443	50011	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.219189882 CET	443	50011	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.220571041 CET	50011	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.220571041 CET	50011	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.220571041 CET	50011	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.223444939 CET	50015	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.223500013 CET	443	50015	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.223629951 CET	50015	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.224397898 CET	50015	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.224436998 CET	443	50015	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.305226088 CET	443	50013	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.305799961 CET	50013	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.305865049 CET	443	50013	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.306427002 CET	50013	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.306442022 CET	443	50013	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.309155941 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.309428930 CET	50012	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.309439898 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.312386036 CET	50012	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.312390089 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.438188076 CET	443	50013	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.438349009 CET	443	50013	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.438404083 CET	50013	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.438478947 CET	50013	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.438478947 CET	50013	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.438519001 CET	443	50013	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.438545942 CET	443	50013	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.440351009 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.440419912 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.440464973 CET	50012	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.440475941 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.440526962 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.440562010 CET	50012	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.440579891 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.440592051 CET	50012	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.440592051 CET	50012	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.440597057 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.440618992 CET	443	50012	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.441840887 CET	50016	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.441869020 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.441921949 CET	50016	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.442213058 CET	50016	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.442224026 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.442976952 CET	50011	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.443042994 CET	443	50011	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.443542957 CET	50017	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.443593025 CET	443	50017	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.443665028 CET	50017	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.443820953 CET	50017	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.443841934 CET	443	50017	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.478734970 CET	443	50009	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.479125977 CET	50009	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.479214907 CET	443	50009	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.479677916 CET	50009	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.479696035 CET	443	50009	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.609217882 CET	443	50009	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.609273911 CET	443	50009	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.609414101 CET	443	50009	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.609452009 CET	50009	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.609530926 CET	50009	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.609621048 CET	50009	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.609621048 CET	50009	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.609666109 CET	443	50009	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.609697104 CET	443	50009	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.612634897 CET	50018	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.612668037 CET	443	50018	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.612723112 CET	50018	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.612878084 CET	50018	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.612884045 CET	443	50018	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.921149969 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.921819925 CET	50014	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.921833992 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.922503948 CET	50014	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.922508001 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.953452110 CET	443	50015	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.988440990 CET	50015	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.988472939 CET	443	50015	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:22.989052057 CET	50015	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:22.989059925 CET	443	50015	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.060054064 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.060118914 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.060165882 CET	50014	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.060182095 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.060228109 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.060271978 CET	50014	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.060381889 CET	50014	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.060395002 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.060404062 CET	50014	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.060408115 CET	443	50014	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.063750029 CET	50019	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.063843012 CET	443	50019	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.063939095 CET	50019	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.064054966 CET	50019	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.064081907 CET	443	50019	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.112934113 CET	443	50015	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.113305092 CET	443	50015	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.113367081 CET	50015	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.113420963 CET	50015	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.113439083 CET	443	50015	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.113456011 CET	50015	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.113461971 CET	443	50015	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.116009951 CET	50020	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.116103888 CET	443	50020	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.116190910 CET	50020	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.116333961 CET	50020	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.116365910 CET	443	50020	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.168363094 CET	443	50017	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.168853998 CET	50017	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.168948889 CET	443	50017	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.169258118 CET	50017	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.169275045 CET	443	50017	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.177681923 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.178462982 CET	50016	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.178474903 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.178945065 CET	50016	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.178949118 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.295933008 CET	443	50017	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.296104908 CET	443	50017	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.296317101 CET	50017	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.296317101 CET	50017	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.296317101 CET	50017	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.299662113 CET	50021	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.299720049 CET	443	50021	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.300466061 CET	50021	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.300626040 CET	50021	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.300651073 CET	443	50021	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.307498932 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.307570934 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.307710886 CET	50016	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.307725906 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.307835102 CET	50016	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.307836056 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.307883024 CET	50016	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.307883024 CET	50016	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.307887077 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.307902098 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.307914019 CET	443	50016	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.310354948 CET	50022	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.310451031 CET	443	50022	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.310590982 CET	50022	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.310688972 CET	50022	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.310723066 CET	443	50022	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.599354982 CET	50017	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.599430084 CET	443	50017	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.806473017 CET	443	50019	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.809047937 CET	50019	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.809144974 CET	443	50019	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.812395096 CET	50019	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.812412024 CET	443	50019	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.824995041 CET	443	50018	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.827781916 CET	50018	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.827816963 CET	443	50018	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.832191944 CET	50018	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.832200050 CET	443	50018	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.856307030 CET	443	50020	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.856946945 CET	50020	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.857011080 CET	443	50020	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.858387947 CET	50020	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.858405113 CET	443	50020	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.938416004 CET	443	50019	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.938560009 CET	443	50019	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.940675020 CET	50019	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.940675020 CET	50019	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.940675020 CET	50019	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.943376064 CET	50023	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.943475962 CET	443	50023	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.944575071 CET	50023	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.944575071 CET	50023	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.944664955 CET	443	50023	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.965090036 CET	443	50018	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.965121031 CET	443	50018	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.965162039 CET	443	50018	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.965181112 CET	50018	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.965203047 CET	50018	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.965385914 CET	50018	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.965385914 CET	50018	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.965408087 CET	443	50018	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.965420961 CET	443	50018	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.968508959 CET	50024	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.968604088 CET	443	50024	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.968815088 CET	50024	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.968815088 CET	50024	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.968905926 CET	443	50024	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.988317966 CET	443	50020	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.988845110 CET	443	50020	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.992439032 CET	50020	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.992527008 CET	50020	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.992567062 CET	443	50020	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.992611885 CET	50020	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.992629051 CET	443	50020	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.994815111 CET	50025	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.994910955 CET	443	50025	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:23.996459007 CET	50025	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.996659040 CET	50025	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:23.996699095 CET	443	50025	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.038361073 CET	443	50021	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.039133072 CET	50021	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.039134026 CET	50021	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.039201975 CET	443	50021	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.039236069 CET	443	50021	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.060616016 CET	443	50022	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.061304092 CET	50022	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.061304092 CET	50022	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.061369896 CET	443	50022	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.061425924 CET	443	50022	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.191054106 CET	443	50022	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.191186905 CET	443	50022	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.191322088 CET	50022	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.191322088 CET	50022	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.191323042 CET	50022	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.193721056 CET	50026	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.193768978 CET	443	50026	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.193908930 CET	50026	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.194046021 CET	50026	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.194061041 CET	443	50026	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.255552053 CET	50019	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.255625963 CET	443	50019	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.377350092 CET	443	50021	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.377430916 CET	443	50021	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.377571106 CET	443	50021	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.377716064 CET	50021	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.377716064 CET	50021	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.377717018 CET	50021	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.380453110 CET	50027	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.380551100 CET	443	50027	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.380755901 CET	50027	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.380827904 CET	50027	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.380846977 CET	443	50027	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.505378962 CET	50022	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.505448103 CET	443	50022	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.599117994 CET	50021	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.599199057 CET	443	50021	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.677962065 CET	443	50023	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.678591013 CET	50023	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.678662062 CET	443	50023	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.679080009 CET	50023	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.679095030 CET	443	50023	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.702564001 CET	443	50024	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.703037977 CET	50024	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.703103065 CET	443	50024	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.703294992 CET	50024	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.703310013 CET	443	50024	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.727950096 CET	443	50025	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.728378057 CET	50025	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.728446007 CET	443	50025	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.728713989 CET	50025	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.728773117 CET	443	50025	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.806778908 CET	443	50023	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.807076931 CET	443	50023	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.807281971 CET	50023	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.807281971 CET	50023	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.807281971 CET	50023	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.809845924 CET	50028	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.809885979 CET	443	50028	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.810050964 CET	50028	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.810198069 CET	50028	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.810213089 CET	443	50028	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.831022978 CET	443	50024	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.831099033 CET	443	50024	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.831207991 CET	443	50024	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.831435919 CET	50024	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.831437111 CET	50024	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.831437111 CET	50024	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.833904982 CET	50029	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.833998919 CET	443	50029	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.834084034 CET	50029	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.834214926 CET	50029	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.834240913 CET	443	50029	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.856827021 CET	443	50025	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.857037067 CET	443	50025	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.857237101 CET	50025	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.857413054 CET	50025	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.857462883 CET	443	50025	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.857496977 CET	50025	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.857513905 CET	443	50025	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.860347033 CET	50030	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.860366106 CET	443	50030	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.860420942 CET	50030	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.860766888 CET	50030	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.860780954 CET	443	50030	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.937560081 CET	443	50026	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.938170910 CET	50026	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.938260078 CET	443	50026	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:24.938666105 CET	50026	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:24.938682079 CET	443	50026	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.067605019 CET	443	50026	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.067681074 CET	443	50026	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.067792892 CET	443	50026	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.067971945 CET	50026	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.067971945 CET	50026	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.068130970 CET	50026	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.068130970 CET	50026	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.068176985 CET	443	50026	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.068207979 CET	443	50026	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.071177006 CET	50031	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.071264982 CET	443	50031	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.071351051 CET	50031	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.071471930 CET	50031	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.071499109 CET	443	50031	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.114749908 CET	50023	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.114824057 CET	443	50023	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.117983103 CET	443	50027	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.118408918 CET	50027	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.118434906 CET	443	50027	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.118805885 CET	50027	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.118812084 CET	443	50027	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.146100044 CET	50024	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.146167040 CET	443	50024	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.249802113 CET	443	50027	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.249957085 CET	443	50027	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.250037909 CET	50027	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.250072002 CET	50027	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.250072002 CET	50027	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.250087976 CET	443	50027	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.250097990 CET	443	50027	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.251955032 CET	50032	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.251981974 CET	443	50032	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.252065897 CET	50032	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.252218962 CET	50032	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.252228022 CET	443	50032	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.543998003 CET	443	50028	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.544496059 CET	50028	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.544514894 CET	443	50028	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.545001984 CET	50028	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.545006990 CET	443	50028	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.598392963 CET	443	50029	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.598800898 CET	50029	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.598886967 CET	443	50029	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.599174976 CET	50029	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.599191904 CET	443	50029	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.607435942 CET	443	50030	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.607732058 CET	50030	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.607742071 CET	443	50030	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.608064890 CET	50030	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.608069897 CET	443	50030	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.671909094 CET	443	50028	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.672384024 CET	443	50028	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.672553062 CET	50028	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.672605991 CET	50028	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.672620058 CET	443	50028	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.672629118 CET	50028	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.672633886 CET	443	50028	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.675329924 CET	50033	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.675430059 CET	443	50033	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.675518036 CET	50033	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.675662041 CET	50033	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.675693035 CET	443	50033	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.729768991 CET	443	50029	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.729809046 CET	443	50029	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.729871035 CET	443	50029	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.729934931 CET	50029	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.730159044 CET	50029	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.730210066 CET	443	50029	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.730247021 CET	50029	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.730262995 CET	443	50029	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.733692884 CET	50034	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.733745098 CET	443	50034	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.734266043 CET	50034	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.734322071 CET	50034	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.734330893 CET	443	50034	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.737699986 CET	443	50030	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.737931967 CET	443	50030	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.738004923 CET	50030	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.738094091 CET	50030	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.738101959 CET	443	50030	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.738110065 CET	50030	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.738114119 CET	443	50030	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.740916967 CET	50035	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.741014004 CET	443	50035	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.741204977 CET	50035	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.741363049 CET	50035	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.741391897 CET	443	50035	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.817465067 CET	443	50031	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.817919970 CET	50031	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.818007946 CET	443	50031	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.818299055 CET	50031	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.818314075 CET	443	50031	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.946466923 CET	443	50031	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.946659088 CET	443	50031	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.946738958 CET	50031	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.946829081 CET	50031	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.946830034 CET	50031	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.946877956 CET	443	50031	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.946907997 CET	443	50031	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.949470043 CET	50036	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.949526072 CET	443	50036	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.949727058 CET	50036	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.949850082 CET	50036	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.949872017 CET	443	50036	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.984361887 CET	443	50032	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.985975981 CET	50032	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.985995054 CET	443	50032	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:25.986706972 CET	50032	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:25.986711979 CET	443	50032	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.112312078 CET	443	50032	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.112392902 CET	443	50032	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.112524033 CET	443	50032	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.112596035 CET	50032	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.112641096 CET	50032	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.112660885 CET	443	50032	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.112673998 CET	50032	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.112679958 CET	443	50032	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.115184069 CET	50037	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.115216017 CET	443	50037	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.115437031 CET	50037	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.115437984 CET	50037	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.115467072 CET	443	50037	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.420695066 CET	443	50033	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.421638966 CET	50033	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.421638966 CET	50033	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.421681881 CET	443	50033	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.421710968 CET	443	50033	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.483835936 CET	443	50035	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.484466076 CET	50035	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.484467030 CET	50035	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.484532118 CET	443	50035	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.484586954 CET	443	50035	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.485079050 CET	443	50034	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.485352039 CET	50034	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.485388041 CET	443	50034	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.485665083 CET	50034	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.485677004 CET	443	50034	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.547087908 CET	443	50033	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.547223091 CET	443	50033	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.547481060 CET	50033	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.547481060 CET	50033	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.547481060 CET	50033	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.550017118 CET	50038	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.550096035 CET	443	50038	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.550321102 CET	50038	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.550321102 CET	50038	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.550393105 CET	443	50038	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.611457109 CET	443	50035	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.611607075 CET	443	50035	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.611690044 CET	50035	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.611771107 CET	50035	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.611771107 CET	50035	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.611815929 CET	443	50035	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.611844063 CET	443	50035	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.613656998 CET	50039	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.613699913 CET	443	50039	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.613962889 CET	50039	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.614080906 CET	50039	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.614094019 CET	443	50039	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.614684105 CET	443	50034	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.614753962 CET	443	50034	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.614857912 CET	443	50034	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.615015984 CET	50034	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.615015984 CET	50034	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.615015984 CET	50034	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.615128994 CET	443	50034	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.615175962 CET	50034	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.615195036 CET	443	50034	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.616682053 CET	50040	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.616776943 CET	443	50040	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.616867065 CET	50040	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.616971970 CET	50040	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.617000103 CET	443	50040	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.691716909 CET	443	50036	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.693865061 CET	50036	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.693931103 CET	443	50036	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.694226980 CET	50036	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.694242001 CET	443	50036	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.771331072 CET	50033	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.771406889 CET	443	50033	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.821029902 CET	443	50036	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.821263075 CET	443	50036	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.821523905 CET	50036	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.821647882 CET	50036	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.821647882 CET	50036	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.821697950 CET	443	50036	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.821732044 CET	443	50036	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.824527025 CET	50041	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.824573994 CET	443	50041	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.827445030 CET	50041	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.827553988 CET	50041	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.827569008 CET	443	50041	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.857608080 CET	443	50037	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.857950926 CET	50037	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.857985973 CET	443	50037	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.859347105 CET	50037	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.859354019 CET	443	50037	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.986346960 CET	443	50037	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.986511946 CET	443	50037	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.986886978 CET	50037	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.987370968 CET	50037	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.987370968 CET	50037	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.987391949 CET	443	50037	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.987396002 CET	443	50037	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.990375042 CET	50042	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.990478992 CET	443	50042	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:26.991431952 CET	50042	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.992377043 CET	50042	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:26.992415905 CET	443	50042	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.284193993 CET	443	50038	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.293015957 CET	50038	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.293040037 CET	443	50038	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.295355082 CET	50038	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.295360088 CET	443	50038	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.360332012 CET	443	50039	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.363902092 CET	50039	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.363902092 CET	50039	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.363940954 CET	443	50039	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.363987923 CET	443	50039	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.367518902 CET	443	50040	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.372517109 CET	50040	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.372584105 CET	443	50040	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.372965097 CET	50040	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.372980118 CET	443	50040	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.420711994 CET	443	50038	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.420789003 CET	443	50038	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.420922041 CET	443	50038	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.424367905 CET	50038	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.479358912 CET	50038	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.479358912 CET	50038	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.479384899 CET	443	50038	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.479393959 CET	443	50038	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.483414888 CET	50043	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.483458042 CET	443	50043	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.483515978 CET	50043	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.483920097 CET	50043	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.483936071 CET	443	50043	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.492096901 CET	443	50039	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.492430925 CET	443	50039	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.492482901 CET	50039	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.492548943 CET	50039	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.492577076 CET	443	50039	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.492593050 CET	50039	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.492599964 CET	443	50039	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.495210886 CET	50044	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.495265961 CET	443	50044	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.495325089 CET	50044	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.495570898 CET	50044	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.495587111 CET	443	50044	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.505702019 CET	443	50040	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.505733013 CET	443	50040	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.505784035 CET	443	50040	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.505810022 CET	50040	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.505881071 CET	50040	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.506052017 CET	50040	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.506052017 CET	50040	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.506093979 CET	443	50040	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.506136894 CET	443	50040	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.515635967 CET	50045	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.515691996 CET	443	50045	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.515762091 CET	50045	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.515855074 CET	50045	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.515872002 CET	443	50045	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.762262106 CET	443	50041	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.762793064 CET	50041	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.762803078 CET	443	50041	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:27.763593912 CET	50041	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:27.763597965 CET	443	50041	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.921305895 CET	443	50042	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.922163963 CET	50042	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.922233105 CET	443	50042	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.922626019 CET	50042	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.922682047 CET	443	50042	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.930037022 CET	443	50041	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.930123091 CET	443	50041	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.930525064 CET	50041	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.930525064 CET	50041	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.930737972 CET	50041	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.930757999 CET	443	50041	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.933998108 CET	50046	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.934039116 CET	443	50046	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.934129000 CET	50046	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.934942961 CET	50046	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.934959888 CET	443	50044	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.934982061 CET	443	50046	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.935369015 CET	50044	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.935406923 CET	443	50044	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.936378956 CET	50044	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.936391115 CET	443	50044	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.938847065 CET	443	50043	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.939965010 CET	50043	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.939982891 CET	443	50043	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:28.940304041 CET	50043	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:28.940320969 CET	443	50043	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.047525883 CET	443	50042	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.047558069 CET	443	50042	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.047602892 CET	443	50042	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.048039913 CET	50042	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.048039913 CET	50042	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.048366070 CET	50042	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.048407078 CET	443	50042	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.050383091 CET	50047	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.050474882 CET	443	50047	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.050697088 CET	50047	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.050697088 CET	50047	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.050781965 CET	443	50047	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.061403036 CET	443	50044	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.061574936 CET	443	50044	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.061825991 CET	50044	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.061825991 CET	50044	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.063710928 CET	50044	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.063750029 CET	443	50044	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.063826084 CET	50048	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.063918114 CET	443	50048	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.064124107 CET	50048	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.064125061 CET	50048	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.064212084 CET	443	50048	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.070482969 CET	443	50043	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.070641994 CET	443	50043	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.072500944 CET	50043	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.072501898 CET	50043	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.074124098 CET	50043	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.074124098 CET	50049	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.074151993 CET	443	50043	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.074172020 CET	443	50049	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.074347973 CET	50049	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.074347973 CET	50049	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.074378014 CET	443	50049	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.510863066 CET	443	50045	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.511817932 CET	50045	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.511881113 CET	443	50045	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.512478113 CET	50045	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.512535095 CET	443	50045	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.638844013 CET	443	50045	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.638942957 CET	443	50045	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.639120102 CET	50045	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.639255047 CET	50045	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.639256001 CET	50045	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.639303923 CET	443	50045	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.639343977 CET	443	50045	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.641724110 CET	50050	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.641825914 CET	443	50050	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.641917944 CET	50050	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.642040968 CET	50050	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.642062902 CET	443	50050	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.677412033 CET	443	50046	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.677829981 CET	50046	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.677917957 CET	443	50046	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.678286076 CET	50046	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.678350925 CET	443	50046	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.808428049 CET	443	50048	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.811855078 CET	443	50046	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.811932087 CET	443	50046	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.812024117 CET	50046	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.812052011 CET	443	50046	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.812113047 CET	50046	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.820080996 CET	443	50047	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.820843935 CET	443	50049	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.826873064 CET	50049	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.826891899 CET	443	50049	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.827287912 CET	50049	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.827295065 CET	443	50049	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.827609062 CET	50048	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.827678919 CET	443	50048	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.827820063 CET	50048	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.827836037 CET	443	50048	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.828008890 CET	50046	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.828008890 CET	50046	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.828052998 CET	443	50046	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.828082085 CET	443	50046	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.829169035 CET	50047	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.829226017 CET	443	50047	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.829526901 CET	50047	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.829539061 CET	443	50047	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.831341028 CET	50051	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.831377983 CET	443	50051	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.831444979 CET	50051	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.831574917 CET	50051	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.831593037 CET	443	50051	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.955353022 CET	443	50049	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.955530882 CET	443	50049	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.955715895 CET	50049	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.957071066 CET	443	50048	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.957217932 CET	443	50048	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.957331896 CET	50048	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.957418919 CET	50049	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.957441092 CET	443	50049	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.963119984 CET	443	50047	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.963274002 CET	443	50047	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.963345051 CET	50047	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.969430923 CET	50047	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.969430923 CET	50047	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.969461918 CET	443	50047	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.969485044 CET	443	50047	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.970470905 CET	50048	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.970470905 CET	50048	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.970521927 CET	443	50048	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.970551014 CET	443	50048	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.987593889 CET	50052	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:29.987690926 CET	443	50052	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:29.987807989 CET	50052	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:30.002722025 CET	50052	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:30.002762079 CET	443	50052	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:30.028323889 CET	50053	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:30.028384924 CET	443	50053	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:30.028470993 CET	50053	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:30.028800964 CET	50053	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:30.028820038 CET	443	50053	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:30.031003952 CET	50054	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:30.031095028 CET	443	50054	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:30.031224012 CET	50054	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:30.031426907 CET	50054	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:30.031455994 CET	443	50054	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.367695093 CET	443	50050	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.368313074 CET	50050	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.368383884 CET	443	50050	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.368634939 CET	50050	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.368650913 CET	443	50050	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.501113892 CET	443	50050	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.501281023 CET	443	50050	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.501519918 CET	50050	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.501641989 CET	50050	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.501694918 CET	443	50050	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.501728058 CET	50050	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.501744986 CET	443	50050	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.504817963 CET	50055	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.504892111 CET	443	50055	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.505114079 CET	50055	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.505412102 CET	50055	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.505445004 CET	443	50055	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.506568909 CET	443	50052	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.506944895 CET	50052	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.507013083 CET	443	50052	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.507569075 CET	50052	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.507586002 CET	443	50052	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.508629084 CET	443	50051	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.509001017 CET	50051	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.509035110 CET	443	50051	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.509330988 CET	50051	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.509339094 CET	443	50051	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.514209032 CET	443	50053	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.514489889 CET	50053	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.514527082 CET	443	50053	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.515018940 CET	50053	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.515027046 CET	443	50053	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.637115955 CET	443	50052	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.637281895 CET	443	50052	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.637384892 CET	50052	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.637562990 CET	50052	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.637615919 CET	443	50052	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.637646914 CET	50052	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.637662888 CET	443	50052	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.641182899 CET	50056	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.641293049 CET	443	50056	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.641417027 CET	50056	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.641621113 CET	50056	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.641661882 CET	443	50056	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.643564939 CET	443	50051	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.643718958 CET	443	50051	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.643788099 CET	50051	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.643843889 CET	50051	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.643866062 CET	443	50051	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.643879890 CET	50051	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.643887997 CET	443	50051	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.646311998 CET	50057	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.646406889 CET	443	50057	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.646517038 CET	50057	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.646697998 CET	50057	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.646742105 CET	443	50057	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.652586937 CET	443	50053	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.652755976 CET	443	50053	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.652837038 CET	50053	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.652908087 CET	50053	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.652908087 CET	50053	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.652939081 CET	443	50053	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.652962923 CET	443	50053	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.655164957 CET	50058	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.655201912 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.655288935 CET	50058	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.655453920 CET	50058	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.655483007 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.710136890 CET	443	50054	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.710618973 CET	50054	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.710688114 CET	443	50054	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.710969925 CET	50054	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.710985899 CET	443	50054	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.840924978 CET	443	50054	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.840993881 CET	443	50054	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.841113091 CET	443	50054	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.841145992 CET	50054	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.841213942 CET	50054	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.841443062 CET	50054	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.841490030 CET	443	50054	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.841520071 CET	50054	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.841537952 CET	443	50054	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.844738007 CET	50059	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.844832897 CET	443	50059	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:31.844993114 CET	50059	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.845228910 CET	50059	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:31.845263958 CET	443	50059	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.239377022 CET	443	50055	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.240237951 CET	50055	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.240303993 CET	443	50055	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.240549088 CET	50055	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.240565062 CET	443	50055	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.371870041 CET	443	50055	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.371942997 CET	443	50055	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.372024059 CET	50055	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.372211933 CET	50055	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.372211933 CET	50055	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.372256994 CET	443	50055	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.372287035 CET	443	50055	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.374818087 CET	50060	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.374871969 CET	443	50060	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.374944925 CET	50060	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.375071049 CET	50060	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.375080109 CET	443	50060	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.379884958 CET	443	50057	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.380177975 CET	50057	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.380264997 CET	443	50057	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.380589962 CET	50057	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.380604029 CET	443	50057	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.387278080 CET	443	50056	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.387676001 CET	50056	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.387742043 CET	443	50056	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.387880087 CET	50056	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.387897015 CET	443	50056	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.400274038 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.400654078 CET	50058	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.400718927 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.400868893 CET	50058	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.400883913 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.510325909 CET	443	50057	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.510510921 CET	443	50057	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.510644913 CET	50057	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.519552946 CET	443	50056	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.519628048 CET	443	50056	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.519752979 CET	443	50056	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.519819021 CET	50056	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.519819975 CET	50056	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.522330999 CET	50057	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.522330999 CET	50057	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.522382021 CET	443	50057	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.522413969 CET	443	50057	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.531433105 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.531548977 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.531619072 CET	50058	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.531656027 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.531693935 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.531754017 CET	50058	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.586693048 CET	50056	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.586744070 CET	443	50056	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.586796999 CET	50056	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.586815119 CET	443	50056	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.593664885 CET	443	50059	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.637238979 CET	50058	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.637305975 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.637360096 CET	50058	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.637379885 CET	443	50058	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.646071911 CET	50059	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.699615002 CET	50059	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.699676037 CET	443	50059	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.699898958 CET	50059	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.699915886 CET	443	50059	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.703104973 CET	50061	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.703152895 CET	443	50061	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.703212976 CET	50061	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.703774929 CET	50062	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.703819036 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.703840971 CET	50063	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.703852892 CET	443	50063	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.703871965 CET	50062	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.703902006 CET	50063	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.704075098 CET	50063	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.704075098 CET	50061	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.704091072 CET	443	50063	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.704111099 CET	443	50061	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.704147100 CET	50062	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.704159021 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.828838110 CET	443	50059	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.829025030 CET	443	50059	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.829216957 CET	50059	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.830674887 CET	50059	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.830674887 CET	50059	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.830720901 CET	443	50059	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.830750942 CET	443	50059	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.839385033 CET	50064	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.839438915 CET	443	50064	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:32.839498997 CET	50064	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.839699984 CET	50064	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:32.839720964 CET	443	50064	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.100909948 CET	443	50060	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.101572037 CET	50060	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.101594925 CET	443	50060	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.101854086 CET	50060	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.101860046 CET	443	50060	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.229165077 CET	443	50060	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.229206085 CET	443	50060	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.229253054 CET	50060	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.229435921 CET	50060	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.229454041 CET	443	50060	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.229469061 CET	50060	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.229471922 CET	443	50060	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.231981993 CET	50065	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.232079029 CET	443	50065	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.232172012 CET	50065	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.232287884 CET	50065	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.232316017 CET	443	50065	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.603168011 CET	443	50063	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.604168892 CET	50063	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.604208946 CET	443	50063	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.604515076 CET	50063	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.604523897 CET	443	50063	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.608270884 CET	443	50061	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.608324051 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.608576059 CET	50061	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.608586073 CET	443	50061	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.608659029 CET	50062	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.608692884 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.608975887 CET	50061	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.608983994 CET	443	50061	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.609031916 CET	50062	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.609038115 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.730017900 CET	443	50064	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.730724096 CET	50064	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.730803013 CET	443	50064	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.731368065 CET	50064	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.731381893 CET	443	50064	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.733936071 CET	443	50063	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.734101057 CET	443	50063	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.734196901 CET	50063	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.734340906 CET	50063	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.734366894 CET	443	50063	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.734383106 CET	50063	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.734390020 CET	443	50063	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.735795021 CET	443	50061	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.735953093 CET	443	50061	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.736016035 CET	50061	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.736036062 CET	50061	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.736036062 CET	50061	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.736042976 CET	443	50061	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.736053944 CET	443	50061	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.738353014 CET	50067	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.738462925 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.738792896 CET	50066	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.738806009 CET	50067	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.738852978 CET	443	50066	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.738924980 CET	50067	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.738934994 CET	50066	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.738959074 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.739151001 CET	50066	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.739181042 CET	443	50066	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.740648031 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.740716934 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.740773916 CET	50062	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.740801096 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.740824938 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.740874052 CET	50062	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.740902901 CET	50062	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.740914106 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.740925074 CET	50062	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.740928888 CET	443	50062	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.743155956 CET	50068	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.743176937 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.743251085 CET	50068	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.743447065 CET	50068	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.743464947 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.860620022 CET	443	50064	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.860826015 CET	443	50064	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.861080885 CET	50064	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.861248970 CET	50064	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.861264944 CET	443	50064	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.861300945 CET	50064	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.861306906 CET	443	50064	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.863224983 CET	50069	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.863260984 CET	443	50069	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.863341093 CET	50069	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.863456964 CET	50069	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.863471031 CET	443	50069	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.964585066 CET	443	50065	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.965395927 CET	50065	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.965491056 CET	443	50065	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:33.965862989 CET	50065	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:33.965879917 CET	443	50065	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.093741894 CET	443	50065	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.093761921 CET	443	50065	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.093812943 CET	443	50065	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.093976974 CET	50065	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.093976974 CET	50065	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.094111919 CET	50065	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.094111919 CET	50065	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.094160080 CET	443	50065	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.094194889 CET	443	50065	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.097012997 CET	50070	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.097054005 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.097141027 CET	50070	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.097309113 CET	50070	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.097327948 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.474004984 CET	443	50066	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.474982977 CET	50066	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.475074053 CET	443	50066	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.475337029 CET	50066	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.475353956 CET	443	50066	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.477135897 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.477394104 CET	50068	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.477427959 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.477694988 CET	50068	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.477703094 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.483728886 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.484209061 CET	50067	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.484277010 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.484471083 CET	50067	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.484488010 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.601955891 CET	443	50066	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.602056026 CET	443	50066	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.602144957 CET	50066	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.602478027 CET	50066	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.602478027 CET	50066	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.602549076 CET	443	50066	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.602585077 CET	443	50066	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.604892969 CET	50071	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.604983091 CET	443	50071	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.605077982 CET	50071	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.605190039 CET	50071	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.605215073 CET	443	50071	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.605393887 CET	443	50069	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.605675936 CET	50069	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.605716944 CET	443	50069	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.605874062 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.605932951 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.605983973 CET	50068	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.606015921 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.606056929 CET	50069	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.606070995 CET	443	50069	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.606154919 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.606170893 CET	50068	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.606172085 CET	50068	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.606195927 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.606213093 CET	50068	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.606220961 CET	443	50068	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.607994080 CET	50072	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.608042955 CET	443	50072	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.608098984 CET	50072	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.608196974 CET	50072	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.608210087 CET	443	50072	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.622324944 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.622385025 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.622487068 CET	50067	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.622525930 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.622564077 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.622618914 CET	50067	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.622675896 CET	50067	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.622709990 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.622735977 CET	50067	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.622750998 CET	443	50067	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.624639034 CET	50073	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.624725103 CET	443	50073	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.624810934 CET	50073	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.624908924 CET	50073	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.624938011 CET	443	50073	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.733772993 CET	443	50069	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.733829975 CET	443	50069	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.733966112 CET	443	50069	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.734023094 CET	50069	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.734023094 CET	50069	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.734566927 CET	50069	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.734566927 CET	50069	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.734611034 CET	443	50069	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.734639883 CET	443	50069	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.737860918 CET	50074	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.737905025 CET	443	50074	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.738006115 CET	50074	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.738198042 CET	50074	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.738213062 CET	443	50074	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.825586081 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.826021910 CET	50070	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.826045990 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.826468945 CET	50070	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.826478004 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.954782009 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.954843044 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.954889059 CET	50070	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.954917908 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.954988003 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.955034018 CET	50070	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.955344915 CET	50070	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.955359936 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.955373049 CET	50070	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.955379963 CET	443	50070	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.960787058 CET	50075	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.960876942 CET	443	50075	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:34.960954905 CET	50075	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.963207006 CET	50075	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:34.963246107 CET	443	50075	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.348233938 CET	443	50071	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.362843990 CET	50071	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.362906933 CET	443	50071	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.363924026 CET	443	50073	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.382217884 CET	443	50072	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.392486095 CET	50071	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.392541885 CET	443	50071	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.411652088 CET	50073	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.411715984 CET	443	50073	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.412614107 CET	50073	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.412631989 CET	443	50073	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.412925005 CET	50072	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.412950993 CET	443	50072	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.413209915 CET	50072	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.413217068 CET	443	50072	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.487567902 CET	443	50074	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.501213074 CET	50074	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.501280069 CET	443	50074	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.501398087 CET	50074	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.501414061 CET	443	50074	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.522841930 CET	443	50071	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.522903919 CET	443	50071	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.523156881 CET	50071	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.525156021 CET	50071	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.525156021 CET	50071	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.525226116 CET	443	50071	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.525279999 CET	443	50071	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.537889957 CET	443	50073	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.538058996 CET	443	50073	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.538232088 CET	50073	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.539653063 CET	50073	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.539719105 CET	443	50073	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.539778948 CET	50073	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.539799929 CET	443	50073	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.543886900 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.543970108 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.544053078 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.544563055 CET	443	50072	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.544698954 CET	443	50072	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.544749975 CET	50072	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.547169924 CET	50077	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.547262907 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.547409058 CET	50077	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.550137043 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.550173044 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.550277948 CET	50072	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.550277948 CET	50072	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.550301075 CET	443	50072	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.550318003 CET	443	50072	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.554970980 CET	50077	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.555012941 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.559602976 CET	50078	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.559643030 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.559735060 CET	50078	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.560275078 CET	50078	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.560302019 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.630817890 CET	443	50074	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.630975962 CET	443	50074	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.631128073 CET	50074	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.631128073 CET	50074	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.631128073 CET	50074	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.633078098 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.633166075 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.633259058 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.633347988 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.633372068 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.706902981 CET	443	50075	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.707618952 CET	50075	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.707683086 CET	443	50075	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.707875013 CET	50075	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.707890987 CET	443	50075	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.834028006 CET	443	50075	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.834084988 CET	443	50075	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.834224939 CET	443	50075	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.834243059 CET	50075	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.834310055 CET	50075	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.834433079 CET	50075	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.834434032 CET	50075	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.834475994 CET	443	50075	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.834505081 CET	443	50075	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.837230921 CET	50080	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.837328911 CET	443	50080	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.837425947 CET	50080	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.837542057 CET	50080	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.837565899 CET	443	50080	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:35.942998886 CET	50074	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:35.943031073 CET	443	50074	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.299285889 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.300491095 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.300517082 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.300921917 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.300928116 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.304044008 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.304522038 CET	50077	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.304589033 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.305011988 CET	50077	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.305030107 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.307518959 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.307832003 CET	50078	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.307847023 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.308289051 CET	50078	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.308293104 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.369554043 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.369956970 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.370023012 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.370160103 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.370177031 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.437634945 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.437688112 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.437757015 CET	50078	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.437819958 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.438011885 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.438077927 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.438091040 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.438132048 CET	50078	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.438306093 CET	50077	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.438374043 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.438488007 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.438550949 CET	50077	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.447372913 CET	50078	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.447407007 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.447438002 CET	50078	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.447453022 CET	443	50078	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.449074030 CET	50077	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.449074030 CET	50077	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.449143887 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.449179888 CET	443	50077	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.452711105 CET	50081	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.452780008 CET	443	50081	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.452867985 CET	50081	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.453124046 CET	50082	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.453221083 CET	443	50082	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.453223944 CET	50081	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.453253984 CET	443	50081	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.453310966 CET	50082	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.453414917 CET	50082	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.453445911 CET	443	50082	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.548451900 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.548516035 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.548614979 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.548651934 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.548708916 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.548744917 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.548787117 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.548825026 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.548839092 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.548866987 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.548902035 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.548933029 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.549109936 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.549138069 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.549180984 CET	50076	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.549195051 CET	443	50076	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.551887989 CET	50083	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.551980019 CET	443	50083	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.552078962 CET	50083	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.552288055 CET	50083	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.552326918 CET	443	50083	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.585095882 CET	443	50080	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.585733891 CET	50080	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.585796118 CET	443	50080	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.586211920 CET	50080	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.586229086 CET	443	50080	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.624730110 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.624797106 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.624941111 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.624989986 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.625063896 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.625112057 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.625134945 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.715276957 CET	443	50080	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.715378046 CET	443	50080	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.715527058 CET	443	50080	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.715600967 CET	50080	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.715600967 CET	50080	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.715939999 CET	50080	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.715939999 CET	50080	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.716010094 CET	443	50080	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.716053009 CET	443	50080	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.718671083 CET	50084	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.718714952 CET	443	50084	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.718907118 CET	50084	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.719074011 CET	50084	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.719094038 CET	443	50084	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.751662970 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.751827955 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.751841068 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.751935005 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.752026081 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.752068996 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.752101898 CET	50079	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.752119064 CET	443	50079	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.754903078 CET	50085	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.754990101 CET	443	50085	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:36.755238056 CET	50085	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.755386114 CET	50085	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:36.755419016 CET	443	50085	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.179600000 CET	443	50082	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.180289984 CET	50082	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.180351019 CET	443	50082	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.180840015 CET	50082	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.180854082 CET	443	50082	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.202985048 CET	443	50081	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.203561068 CET	50081	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.203646898 CET	443	50081	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.203855038 CET	50081	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.203872919 CET	443	50081	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.286137104 CET	443	50083	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.286741972 CET	50083	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.286803961 CET	443	50083	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.286967993 CET	50083	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.286983967 CET	443	50083	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.307988882 CET	443	50082	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.308207989 CET	443	50082	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.308284998 CET	50082	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.308449984 CET	50082	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.308497906 CET	443	50082	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.308528900 CET	50082	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.308546066 CET	443	50082	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.311767101 CET	50086	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.311810017 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.311897039 CET	50086	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.312055111 CET	50086	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.312074900 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.344202995 CET	443	50081	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.344254971 CET	443	50081	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.344393969 CET	443	50081	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.344533920 CET	50081	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.344535112 CET	50081	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.344628096 CET	50081	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.344628096 CET	50081	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.344667912 CET	443	50081	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.344698906 CET	443	50081	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.347165108 CET	50087	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.347207069 CET	443	50087	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.347285986 CET	50087	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.347400904 CET	50087	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.347410917 CET	443	50087	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.415338993 CET	443	50083	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.415493965 CET	443	50083	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.415776968 CET	50083	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.415776968 CET	50083	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.415776968 CET	50083	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.417840958 CET	50088	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.417887926 CET	443	50088	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.417968035 CET	50088	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.418088913 CET	50088	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.418106079 CET	443	50088	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.478523016 CET	443	50084	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.479187965 CET	50084	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.479221106 CET	443	50084	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.479949951 CET	50084	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.479958057 CET	443	50084	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.488316059 CET	443	50085	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.488884926 CET	50085	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.488945961 CET	443	50085	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.489499092 CET	50085	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.489515066 CET	443	50085	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.609236002 CET	443	50084	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.609725952 CET	443	50084	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.609781027 CET	50084	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.609853983 CET	50084	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.609862089 CET	443	50084	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.609884977 CET	50084	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.609889030 CET	443	50084	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.616549015 CET	443	50085	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.617326975 CET	443	50085	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.617398977 CET	50085	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.619220018 CET	50085	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.619220018 CET	50085	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.619288921 CET	443	50085	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.619350910 CET	443	50085	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.625011921 CET	50089	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.625097036 CET	443	50089	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.625170946 CET	50089	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.625554085 CET	50089	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.625592947 CET	443	50089	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.626158953 CET	50090	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.626199007 CET	443	50090	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.626255989 CET	50090	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.626364946 CET	50090	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.626377106 CET	443	50090	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:37.724277020 CET	50083	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:37.724342108 CET	443	50083	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.058789015 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.059396982 CET	50086	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.059429884 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.060339928 CET	50086	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.060348988 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.086463928 CET	443	50087	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.097939968 CET	50087	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.098004103 CET	443	50087	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.114011049 CET	50087	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.114068031 CET	443	50087	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.158127069 CET	443	50088	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.174443960 CET	50088	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.174459934 CET	443	50088	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.174869061 CET	50088	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.174874067 CET	443	50088	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.191741943 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.191775084 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.191823006 CET	50086	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.191844940 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.191893101 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.191939116 CET	50086	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.203896999 CET	50086	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.203896999 CET	50086	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.203931093 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.203950882 CET	443	50086	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.240319014 CET	443	50087	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.240494013 CET	443	50087	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.240566969 CET	50087	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.248378038 CET	50087	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.248378038 CET	50087	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.248398066 CET	443	50087	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.248414040 CET	443	50087	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.301482916 CET	443	50088	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.301605940 CET	443	50088	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.301660061 CET	50088	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.304802895 CET	50088	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.304802895 CET	50088	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.304816008 CET	443	50088	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.304821968 CET	443	50088	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.349868059 CET	443	50090	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.350253105 CET	50090	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.350264072 CET	443	50090	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.350837946 CET	50090	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.350842953 CET	443	50090	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.357371092 CET	443	50089	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.357769012 CET	50089	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.357835054 CET	443	50089	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.357985973 CET	50089	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.358002901 CET	443	50089	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.476967096 CET	443	50090	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.477447987 CET	443	50090	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.477559090 CET	50090	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.477727890 CET	50090	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.477727890 CET	50090	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.477751970 CET	443	50090	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.477768898 CET	443	50090	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.488856077 CET	443	50089	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.489006996 CET	443	50089	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.489150047 CET	50089	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.489468098 CET	50089	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.489469051 CET	50089	443	192.168.2.4	13.107.246.45
Nov 13, 2024 09:54:38.489514112 CET	443	50089	13.107.246.45	192.168.2.4
Nov 13, 2024 09:54:38.489551067 CET	443	50089	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 09:53:08.145643950 CET	138	138	192.168.2.4	192.168.2.255
Nov 13, 2024 09:53:27.591056108 CET	54327	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:27.600541115 CET	53	54327	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:30.731674910 CET	53	61979	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:30.800061941 CET	53	64719	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:31.046518087 CET	52628	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:31.046646118 CET	65275	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:31.053277969 CET	53	52628	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:31.053668022 CET	53	65275	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:32.038147926 CET	53	60049	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:34.231266975 CET	52257	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:34.231674910 CET	51529	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:34.238775969 CET	53	52257	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:34.238825083 CET	53	51529	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:35.479085922 CET	58714	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:35.479263067 CET	62608	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:35.717747927 CET	54469	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:35.717931032 CET	52901	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:35.724725008 CET	53	54469	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:35.725138903 CET	53	52901	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:35.991645098 CET	63810	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:35.991866112 CET	51951	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:35.998419046 CET	53	63810	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:35.999005079 CET	53	51951	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:37.538348913 CET	53817	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:37.538760900 CET	55109	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:37.543287992 CET	50286	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:37.543409109 CET	62415	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:37.545471907 CET	53	53817	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:37.545850039 CET	53	55109	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:37.547123909 CET	61929	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:37.547245979 CET	60964	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:37.554960012 CET	53	60964	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:37.556586027 CET	65058	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:37.556694031 CET	53935	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:37.563678980 CET	53	53935	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:38.658694029 CET	55077	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:38.658832073 CET	62893	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:38.659096003 CET	59333	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:38.659193993 CET	55387	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:38.667169094 CET	53	59333	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:38.667229891 CET	53	55077	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:38.667258978 CET	53	62893	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:38.667289019 CET	53	55387	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:38.722506046 CET	54149	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:38.722506046 CET	59857	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:53:38.729430914 CET	53	54149	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:38.729790926 CET	53	59857	1.1.1.1	192.168.2.4
Nov 13, 2024 09:53:39.576348066 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:39.877232075 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.375196934 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.375211000 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.375225067 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.375240088 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.375256062 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.377928972 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.379906893 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.379982948 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.381632090 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.384464979 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.512336969 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.512525082 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.513174057 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.513498068 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.514183998 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.514344931 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.514379978 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.515043974 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.516316891 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.517093897 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.646711111 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.707187891 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.716943979 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.717159986 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:40.877324104 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.877351999 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.877379894 CET	443	59448	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:40.881601095 CET	59448	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.352502108 CET	64986	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.656735897 CET	64986	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.950139046 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.950180054 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.950212955 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.950244904 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:41.950891972 CET	64986	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.951967001 CET	64986	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.952069044 CET	64986	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.952305079 CET	64986	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:41.954488993 CET	64986	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:42.077750921 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:42.077788115 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:42.077816963 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:42.077850103 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:42.078150034 CET	64986	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:42.078291893 CET	64986	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:42.078651905 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:42.080739975 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:42.095721960 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:42.107686996 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:42.107877016 CET	64986	443	192.168.2.4	172.64.41.3
Nov 13, 2024 09:53:42.218004942 CET	443	64986	172.64.41.3	192.168.2.4
Nov 13, 2024 09:53:42.250812054 CET	64986	443	192.168.2.4	172.64.41.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 09:53:27.591056108 CET	192.168.2.4	1.1.1.1	0x7c61	Standard query (0)	catbox.moe	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:31.046518087 CET	192.168.2.4	1.1.1.1	0xa40f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:31.046646118 CET	192.168.2.4	1.1.1.1	0x898	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 13, 2024 09:53:34.231266975 CET	192.168.2.4	1.1.1.1	0xc6e9	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:34.231674910 CET	192.168.2.4	1.1.1.1	0xcfef	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 13, 2024 09:53:35.479085922 CET	192.168.2.4	1.1.1.1	0x7ddb	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:35.479263067 CET	192.168.2.4	1.1.1.1	0x822f	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 13, 2024 09:53:35.717747927 CET	192.168.2.4	1.1.1.1	0xe94b	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:35.717931032 CET	192.168.2.4	1.1.1.1	0xc662	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 13, 2024 09:53:35.991645098 CET	192.168.2.4	1.1.1.1	0xfac3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:35.991866112 CET	192.168.2.4	1.1.1.1	0x210c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 09:53:37.538348913 CET	192.168.2.4	1.1.1.1	0x70fa	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:37.538760900 CET	192.168.2.4	1.1.1.1	0xf5ad	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 13, 2024 09:53:37.543287992 CET	192.168.2.4	1.1.1.1	0x9	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:37.543409109 CET	192.168.2.4	1.1.1.1	0x2e6c	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 13, 2024 09:53:37.547123909 CET	192.168.2.4	1.1.1.1	0xcdf4	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:37.547245979 CET	192.168.2.4	1.1.1.1	0x614d	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 13, 2024 09:53:37.556586027 CET	192.168.2.4	1.1.1.1	0xf9b9	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:37.556694031 CET	192.168.2.4	1.1.1.1	0x5f0b	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 13, 2024 09:53:38.658694029 CET	192.168.2.4	1.1.1.1	0x1e04	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:38.658832073 CET	192.168.2.4	1.1.1.1	0xa3e0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 09:53:38.659096003 CET	192.168.2.4	1.1.1.1	0x5b07	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:38.659193993 CET	192.168.2.4	1.1.1.1	0xca1f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 09:53:38.722506046 CET	192.168.2.4	1.1.1.1	0xff40	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:38.722506046 CET	192.168.2.4	1.1.1.1	0xee04	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 09:53:27.600541115 CET	1.1.1.1	192.168.2.4	0x7c61	No error (0)	catbox.moe		108.181.20.35	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:31.053277969 CET	1.1.1.1	192.168.2.4	0xa40f	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:31.053668022 CET	1.1.1.1	192.168.2.4	0x898	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 13, 2024 09:53:34.238825083 CET	1.1.1.1	192.168.2.4	0xcfef	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:34.852564096 CET	1.1.1.1	192.168.2.4	0x69f5	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:35.486103058 CET	1.1.1.1	192.168.2.4	0x7ddb	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:35.486149073 CET	1.1.1.1	192.168.2.4	0x822f	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:35.724725008 CET	1.1.1.1	192.168.2.4	0xe94b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:35.724725008 CET	1.1.1.1	192.168.2.4	0xe94b	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.97	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:35.725138903 CET	1.1.1.1	192.168.2.4	0xc662	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:35.998419046 CET	1.1.1.1	192.168.2.4	0xfac3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:35.998419046 CET	1.1.1.1	192.168.2.4	0xfac3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:35.999005079 CET	1.1.1.1	192.168.2.4	0x210c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 09:53:37.545471907 CET	1.1.1.1	192.168.2.4	0x70fa	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:37.545471907 CET	1.1.1.1	192.168.2.4	0x70fa	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:37.545471907 CET	1.1.1.1	192.168.2.4	0x70fa	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:37.545471907 CET	1.1.1.1	192.168.2.4	0x70fa	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:37.550642014 CET	1.1.1.1	192.168.2.4	0x9	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:37.551500082 CET	1.1.1.1	192.168.2.4	0x2e6c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:37.553910971 CET	1.1.1.1	192.168.2.4	0xcdf4	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:37.554960012 CET	1.1.1.1	192.168.2.4	0x614d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:37.563640118 CET	1.1.1.1	192.168.2.4	0xf9b9	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:37.563678980 CET	1.1.1.1	192.168.2.4	0x5f0b	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:37.744616985 CET	1.1.1.1	192.168.2.4	0x68c	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:37.744616985 CET	1.1.1.1	192.168.2.4	0x68c	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:37.972232103 CET	1.1.1.1	192.168.2.4	0xca	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:38.667169094 CET	1.1.1.1	192.168.2.4	0x5b07	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:38.667169094 CET	1.1.1.1	192.168.2.4	0x5b07	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:38.667229891 CET	1.1.1.1	192.168.2.4	0x1e04	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:38.667229891 CET	1.1.1.1	192.168.2.4	0x1e04	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:38.667258978 CET	1.1.1.1	192.168.2.4	0xa3e0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 09:53:38.667289019 CET	1.1.1.1	192.168.2.4	0xca1f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 09:53:38.729430914 CET	1.1.1.1	192.168.2.4	0xff40	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:38.729430914 CET	1.1.1.1	192.168.2.4	0xff40	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:53:38.729790926 CET	1.1.1.1	192.168.2.4	0xee04	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 09:53:38.959973097 CET	1.1.1.1	192.168.2.4	0x3ef4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:53:38.959973097 CET	1.1.1.1	192.168.2.4	0x3ef4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

fs.microsoft.com

www.google.com

clients2.googleusercontent.com

chrome.cloudflare-dns.com

edgeassetservice.azureedge.net

www.googleapis.com

https:

www.bing.com

data-edge.smartscreen.microsoft.com

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=nPtt+6KKERhgrKN&MD=omBsCfMH HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-13 08:53:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: aea880a4-94d3-457e-908e-a7783c02fba7 MS-RequestId: 6f22bfad-1e9a-42fa-90c8-636df4440348 MS-CV: 1UlbaiBD7EqMku9Z.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 13 Nov 2024 08:53:14 GMT Connection: close Content-Length: 24490
2024-11-13 08:53:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-13 08:53:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49743	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:29 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-13 08:53:30 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=114692 Date: Wed, 13 Nov 2024 08:53:29 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49744	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-13 08:53:31 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=114728 Date: Wed, 13 Nov 2024 08:53:31 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-13 08:53:31 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49748	216.58.206.68	443	2792	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:31 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 08:53:32 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:32 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-EMzrlNRZNWSwtpwSZPDcug' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-13 08:53:32 UTC	112	IN	Data Raw: 66 63 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 6f 67 65 63 6f 69 6e 20 70 72 69 63 65 20 70 72 65 64 69 63 74 69 6f 6e 22 2c 22 77 77 65 20 72 61 77 22 2c 22 77 61 73 68 69 6e 67 74 6f 6e 20 63 6f 6d 6d 61 6e 64 65 72 73 20 69 6e 6a 75 72 79 20 72 65 70 6f 72 74 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 6d 65 64 69 Data Ascii: fca)]}'["",["dogecoin price prediction","wwe raw","washington commanders injury report","social security medi
2024-11-13 08:53:32 UTC	1378	IN	Data Raw: 63 61 72 65 20 70 72 65 6d 69 75 6d 73 20 32 30 32 35 22 2c 22 62 6c 61 63 6b 20 6f 70 73 20 7a 6f 6d 62 69 65 73 20 65 61 73 74 65 72 20 65 67 67 73 22 2c 22 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 73 20 68 75 72 72 69 63 61 6e 65 73 22 2c 22 75 72 61 6e 75 73 20 76 6f 79 61 67 65 72 22 2c 22 76 65 72 69 7a 6f 6e 20 66 69 6f 73 20 69 6e 74 65 72 6e 65 74 20 6f 75 74 61 67 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 Data Ascii: care premiums 2025","black ops zombies easter eggs","tropical storms hurricanes","uranus voyager","verizon fios internet outages"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2V
2024-11-13 08:53:32 UTC	1378	IN	Data Raw: 4b 7a 4a 44 4e 6b 68 4d 4d 6c 4a 53 51 31 4a 6b 4e 56 42 74 53 55 64 4f 63 57 6c 72 59 57 31 53 64 56 56 44 63 45 68 56 4b 31 64 45 4e 6d 64 46 52 44 5a 6a 62 57 39 59 55 6c 46 4b 53 6e 46 6e 54 33 64 6d 5a 46 51 31 54 6a 49 76 59 6b 68 53 59 56 64 76 61 32 74 6a 54 45 67 30 64 33 52 74 52 6e 55 7a 5a 6b 68 61 5a 6b 52 68 4d 6b 74 55 53 31 64 77 53 6c 70 5a 4e 55 74 35 51 58 70 78 4e 56 5a 59 55 56 4a 73 65 47 55 30 4f 46 4a 42 4e 32 5a 71 52 6b 6c 31 56 6b 39 75 62 57 4a 71 57 57 78 61 53 32 4a 6b 5a 6c 56 53 56 58 52 51 56 48 52 50 57 54 46 6a 59 33 68 53 59 33 49 76 51 55 52 79 4c 30 46 47 61 44 64 73 5a 46 4a 49 55 56 5a 6a 51 56 70 77 64 32 52 58 63 46 4a 47 4c 33 64 43 62 45 4a 51 4d 6e 68 36 61 58 46 71 61 6c 64 32 62 7a 5a 32 54 44 5a 4e 4d 45 35 Data Ascii: KzJDNkhMMlJSQ1JkNVBtSUdOcWlrYW1SdVVDcEhVK1dENmdFRDZjbW9YUlFKSnFnT3dmZFQ1TjIvYkhSYVdva2tjTEg0d3RtRnUzZkhaZkRhMktUS1dwSlpZNUt5QXpxNVZYUVJseGU0OFJBN2ZqRkl1Vk9ubWJqWWxaS2JkZlVSVXRQVHRPWTFjY3hSY3IvQURyL0FGaDdsZFJIUVZjQVpwd2RXcFJGL3dCbEJQMnh6aXFqald2bzZ2TDZNME5
2024-11-13 08:53:32 UTC	1181	IN	Data Raw: 56 53 4d 47 78 54 54 33 70 4e 52 44 45 34 4f 47 45 31 59 6d 35 57 51 6c 52 61 57 6d 77 35 51 30 70 57 5a 32 56 48 63 54 42 31 53 45 49 77 59 6b 5a 30 61 57 5a 6d 4f 45 46 55 52 30 52 53 65 55 59 7a 57 55 35 48 64 6b 70 59 62 55 56 54 55 30 4a 54 4d 57 6c 4f 61 44 56 74 4e 54 5a 5a 62 6e 42 74 61 46 6c 57 56 57 4e 71 51 6c 4e 73 59 53 74 33 57 46 5a 7a 5a 54 6c 32 64 6d 68 50 53 55 4a 73 63 56 64 31 54 6e 5a 46 4d 30 39 4f 55 32 5a 75 4e 47 35 78 4d 43 74 68 55 6b 78 4b 53 46 45 77 4d 47 6c 30 4e 45 46 59 57 57 4a 71 59 32 70 78 5a 6c 56 68 63 31 51 72 59 6c 5a 74 57 56 56 74 5a 58 52 58 64 46 5a 44 62 6a 42 6f 5a 6d 68 76 56 6c 46 32 63 6d 6f 32 51 6d 31 49 65 57 63 7a 51 6a 4d 32 4e 46 52 6a 55 48 6c 4b 51 6b 34 34 54 6b 52 44 63 30 74 76 61 58 56 35 61 Data Ascii: VSMGxTT3pNRDE4OGE1Ym5WQlRaWmw5Q0pWZ2VHcTB1SEIwYkZ0aWZmOEFUR0RSeUYzWU5HdkpYbUVTU0JTMWlOaDVtNTZZbnBtaFlWVWNqQlNsYSt3WFZzZTl2dmhPSUJscVd1TnZFM09OU2ZuNG5xMCthUkxKSFEwMGl0NEFYWWJqY2pxZlVhc1QrYlZtWVVtZXRXdFZDbjBoZmhvVlF2cmo2Qm1IeWczQjM2NFRjUHlKQk44TkRDc0tvaXV5a
2024-11-13 08:53:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49749	216.58.206.68	443	2792	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:32 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 08:53:32 UTC	1042	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 13 Nov 2024 08:53:32 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-13 08:53:32 UTC	336	IN	Data Raw: 32 37 39 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2796)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-13 08:53:32 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-13 08:53:32 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-13 08:53:32 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-13 08:53:32 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-13 08:53:32 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 37 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700297,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-13 08:53:32 UTC	1378	IN	Data Raw: 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 4c 64 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 Data Ascii: : Apache-2.0\n*/\nvar Ld;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u
2024-11-13 08:53:32 UTC	1378	IN	Data Raw: 33 64 5f 2e 58 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 59 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 Data Ascii: 3d_.Xd();return new _.Yd(b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else th
2024-11-13 08:53:32 UTC	160	IN	Data Raw: 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 0d 0a Data Ascii: {var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003d
2024-11-13 08:53:32 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 Data Ascii: 8000b\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.pe\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49750	216.58.206.68	443	2792	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:32 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 08:53:32 UTC	957	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 13 Nov 2024 08:53:32 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-13 08:53:32 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-13 08:53:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49760	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-13 08:53:36 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 08:53:36 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 08:52:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 16402046-aeac-46a2-9189-128eb7d9da92 PPServer: PPV: 30 H: SN1PEPF0002FA8D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 08:53:35 GMT Connection: close Content-Length: 1276
2024-11-13 08:53:36 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49764	142.250.186.97	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:36 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:36 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY1rN40-9iQQIQZCuil1s4tNU34_0IlkQngwS84_OOoNBazlDD3dVhZ5hIa5j9rJiL1hXYlef3kVqQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Tue, 12 Nov 2024 20:33:29 GMT Expires: Wed, 12 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 44407 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-13 08:53:36 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-13 08:53:36 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-13 08:53:36 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-13 08:53:36 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-13 08:53:36 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-13 08:53:36 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-13 08:53:36 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-13 08:53:36 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-13 08:53:36 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-13 08:53:37 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49766	172.64.41.3	443	5100	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 08:53:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 08:53:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 08:53:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e1d884868d02848-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 08:53:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f4 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49771	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:37 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-13 08:53:37 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 66 6d 64 71 6d 6a 64 78 67 76 6e 72 6d 64 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 4b 30 7e 2b 3a 6b 4d 4f 4a 50 44 74 68 61 5f 40 38 45 49 47 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02fmdqmjdxgvnrmd</Membername><Password>K0~+:kMOJPDtha_@8EIG</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-11-13 08:53:40 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Wed, 13 Nov 2024 08:52:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_SN1 x-ms-request-id: a8b89abd-f861-47bd-8aad-9d87180ed3dc PPServer: PPV: 30 H: SN1PEPF0002FA94 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 08:53:39 GMT Connection: close Content-Length: 17166
2024-11-13 08:53:40 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 32 37 33 38 39 46 38 39 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 30 38 34 37 61 32 34 61 2d 37 64 37 37 2d 34 34 61 62 2d 62 35 34 32 2d 37 65 65 63 63 65 63 33 32 30 37 30 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018801027389F89</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="0847a24a-7d77-44ab-b542-7eeccec32070" LicenseID="3252b20c-d425-4711
2024-11-13 08:53:40 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49787	13.107.246.45	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:38 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:38 UTC	552	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:38 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Mon, 11 Nov 2024 18:09:12 GMT ETag: 0x8DD027BF2282F19 x-ms-request-id: 87e3c705-301e-006f-13fa-34c0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T085338Z-16547b76f7fx6rhxhC1DFW76kg0000000gt000000000car0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:38 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49789	13.107.246.45	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:38 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:38 UTC	576	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:38 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: efca23cb-901e-0062-69eb-322fdf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T085338Z-16547b76f7fr4g8xhC1DFW9cqc0000000g6g0000000002wm Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:38 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-13 08:53:38 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-13 08:53:39 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-13 08:53:39 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-13 08:53:39 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49790	13.107.246.45	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:38 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:38 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:38 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 94bdde0a-901e-0004-24a7-359d85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T085338Z-r178fb8d765tllwdhC1DFWaz8400000000x0000000005qww Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:38 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-13 08:53:38 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-13 08:53:39 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-13 08:53:39 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-13 08:53:39 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-13 08:53:39 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-13 08:53:39 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-13 08:53:39 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-13 08:53:39 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-13 08:53:39 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49792	172.64.41.3	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 08:53:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 08:53:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 08:53:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e1d8858edb845fc-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 08:53:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49791	172.64.41.3	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 08:53:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 08:53:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 08:53:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e1d8858fa1ab78f-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 08:53:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f8 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49793	162.159.61.3	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 08:53:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 08:53:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 08:53:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e1d88595cf62e21-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 08:53:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d2 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49799	142.250.114.95	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:41 UTC	448	OUT	POST /chromewebstore/v1.1/items/verify HTTP/1.1 Host: www.googleapis.com Connection: keep-alive Content-Length: 119 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:41 UTC	119	OUT	Data Raw: 7b 22 68 61 73 68 22 3a 22 47 72 44 4d 54 73 6b 50 4b 38 58 4f 49 45 37 36 32 31 7a 42 79 49 66 54 52 4c 5a 4e 4a 6f 6d 37 37 2f 53 36 62 45 4d 7a 2f 7a 51 3d 22 2c 22 69 64 73 22 3a 5b 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d Data Ascii: {"hash":"GrDMTskPK8XOIE7621zByIfTRLZNJom77/S6bEMz/zQ=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}
2024-11-13 08:53:41 UTC	341	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: Origin Vary: X-Origin Vary: Referer Date: Wed, 13 Nov 2024 08:53:41 GMT Server: ESF Content-Length: 483 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-13 08:53:41 UTC	483	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 20 31 2c 0a 20 20 22 73 69 67 6e 61 74 75 72 65 22 3a 20 22 53 6c 41 77 55 6b 49 74 77 6b 53 30 76 53 73 57 45 79 69 4b 4d 44 65 35 49 30 65 45 64 69 44 67 47 32 4f 6a 54 33 62 67 42 52 65 4a 6f 67 4c 59 4e 54 74 4a 4b 35 78 73 63 4d 30 5a 33 68 62 46 4b 2f 49 65 2b 74 44 71 46 77 69 62 35 67 32 2f 7a 75 66 32 35 32 67 74 61 6a 76 4d 42 4c 4d 74 53 75 6f 6d 32 6e 34 41 68 62 48 39 6c 6c 4b 44 41 6d 48 38 7a 34 63 48 74 55 61 33 57 77 49 72 57 30 7a 43 61 49 62 58 37 44 54 69 32 46 61 33 70 69 31 46 7a 58 46 37 52 4f 51 45 33 76 77 69 6f 48 75 68 67 4d 79 2b 65 4f 59 41 55 6b 35 39 41 2b 4a 57 48 69 73 42 43 6e 46 33 2b 56 6b 70 73 35 43 43 76 4e 31 46 44 69 6d 46 51 67 64 7a 68 76 6d 68 Data Ascii: { "protocol_version": 1, "signature": "SlAwUkItwkS0vSsWEyiKMDe5I0eEdiDgG2OjT3bgBReJogLYNTtJK5xscM0Z3hbFK/Ie+tDqFwib5g2/zuf252gtajvMBLMtSuom2n4AhbH9llKDAmH8z4cHtUa3WwIrW0zCaIbX7DTi2Fa3pi1FzXF7ROQE3vwioHuhgMy+eOYAUk59A+JWHisBCnF3+Vkps5CCvN1FDimFQgdzhvmh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49802	13.107.246.57	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:41 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:41 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:41 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: da94d91f-101e-0051-36a7-3576f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T085341Z-r178fb8d7652zbm6hC1DFWqtr400000000gg000000008h0u Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:41 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49803	13.107.246.57	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:41 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:41 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:41 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 0d52236e-d01e-0008-0da9-357374000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T085341Z-1749fc9bdbd85qw2hC1DFW157000000000u000000000c9dv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-13 08:53:41 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49805	13.107.246.57	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:41 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:41 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:41 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: aa765c33-a01e-0007-42a9-359e82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T085341Z-1749fc9bdbdlzhmchC1DFWe68s00000000mg00000000b2wu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-13 08:53:41 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49804	13.107.246.57	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:41 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:41 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:41 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 794c108b-001e-000a-0ab4-2e718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T085341Z-16547b76f7fp46ndhC1DFW66zg0000000gwg00000000a9d7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:41 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49800	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-13 08:53:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 08:53:42 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 08:52:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C549_SN1 x-ms-request-id: 549ba039-2260-43c9-8ebd-a2d895b47c28 PPServer: PPV: 30 H: SN1PEPF0002F9EC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 08:53:41 GMT Connection: close Content-Length: 11392
2024-11-13 08:53:42 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49806	13.107.246.57	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:41 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:41 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:41 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 2ee7a5c9-c01e-001c-5ca9-35b010000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T085341Z-1749fc9bdbdpg69chC1DFWhecg00000000ng000000007v8g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-13 08:53:41 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49801	13.107.246.57	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:41 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:42 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:41 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: e335897b-a01e-0007-3434-2f9e82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T085341Z-16547b76f7fdtmzhhC1DFW6zhc00000005pg00000000d4c5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:42 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49809	173.222.162.32	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:42 UTC	2172	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109000CC6 X-BM-CBT: 1696420817 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 60 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109000CC6 X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-t X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2235 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346
2024-11-13 08:53:42 UTC	2235	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 36 36 36 36 36 39 34 32 38 34 34 38 34 46 41 31 42 33 35 43 43 42 34 33 33 44 34 32 45 39 39 37 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 38 39 32 46 41 30 37 38 38 36 34 31 34 42 44 46 38 45 45 31 37 36 34 41 35 39 46 46 33 39 43 36 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 Data Ascii: <ClientInstRequest><CID>6666694284484FA1B35CCB433D42E997</CID><Events><E><T>Event.ClientInst</T><IG>892FA07886414BDF8EE1764A59FF39C6</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"C
2024-11-13 08:53:42 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: E600F7FEFAC643BF8C41D00F3F519015 Ref B: LAX311000113035 Ref C: 2024-11-13T08:53:42Z Date: Wed, 13 Nov 2024 08:53:42 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.2ea6dc17.1731488022.8f4c9c2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49810	13.107.246.57	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:42 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 08:53:42 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:42 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 174c0071-f01e-003d-08a2-34dd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T085342Z-16547b76f7fdf69shC1DFWcpd00000000gwg000000002b4a Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:42 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49812	4.150.155.223	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:42 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiZHhCbFk1RVV3MTdnRjhIOEljdUhwdz09IiwgImhhc2giOiJ4dm9yb2xRRXZjOD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-13 08:53:42 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-13 08:53:42 UTC	248	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:42 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-13 08:53:42 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49813	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-13 08:53:43 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 08:53:43 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 08:52:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 6d2a4a15-7a33-4515-b336-130686eba32c PPServer: PPV: 30 H: SN1PEPF0003F966 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 08:53:43 GMT Connection: close Content-Length: 1918
2024-11-13 08:53:43 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49814	4.150.155.223	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:43 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiMDJTK05WM0EzamRHallpc0tEZmRrdz09IiwgImhhc2giOiJ2THN0bVc1bjQrTT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-13 08:53:43 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-13 08:53:44 UTC	302	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:44 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-13 08:53:44 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-13 08:53:44 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-13 08:53:44 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-13 08:53:44 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-13 08:53:44 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-13 08:53:44 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-13 08:53:44 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-13 08:53:44 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49818	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-13 08:53:45 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 08:53:55 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 08:52:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C549_SN1 x-ms-request-id: d13d9c49-ab3c-4346-80d1-e4b1cc3092cc PPServer: PPV: 30 H: SN1PEPF0002F9F1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 08:53:54 GMT Connection: close Content-Length: 11412
2024-11-13 08:53:55 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49817	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-13 08:53:45 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 08:53:45 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 08:52:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BL2 x-ms-request-id: e4bfff7a-b943-4955-afbe-62eca9e9c846 PPServer: PPV: 30 H: BL02EPF0001D9BC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 08:53:44 GMT Connection: close Content-Length: 1918
2024-11-13 08:53:45 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:45 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:45 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:45 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: a1588731-601e-000d-094b-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085345Z-1749fc9bdbd85qw2hC1DFW157000000000z0000000001n3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:45 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-13 08:53:46 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-13 08:53:46 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-13 08:53:46 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-13 08:53:46 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-13 08:53:46 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-13 08:53:46 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-13 08:53:46 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-13 08:53:46 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-13 08:53:46 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:48 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:48 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f8aed360-a01e-0032-69a0-341949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085348Z-1749fc9bdbdr6qwphC1DFW0nv400000000u000000000ch16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:48 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:48 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:48 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:48 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b9f0e195-301e-0033-8068-35fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085348Z-1749fc9bdbdnkwnnhC1DFWud0400000000u0000000001hwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:48 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:48 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:48 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:48 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: be525922-801e-00a0-03ff-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085348Z-16547b76f7f76p6chC1DFWctqw0000000h3g00000000145h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:48 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:48 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:48 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:48 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 216c6b49-701e-001e-23a0-34f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085348Z-r178fb8d765dbczshC1DFW33an00000000n000000000ak5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:48 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:48 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:48 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:48 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 537f77db-e01e-0085-2863-35c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085348Z-r178fb8d765v4sc4hC1DFW62ec00000000s000000000d1ry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:48 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:48 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:49 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ee786005-101e-0065-140e-2d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085348Z-16547b76f7fcjqqhhC1DFWrrrc0000000gv000000000929n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:49 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:48 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:49 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 9d8ed93b-d01e-00a1-36a7-3435b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085349Z-1749fc9bdbd4dqj6hC1DFWr4n400000000w0000000002tgh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:49 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:48 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:48 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085348Z-16547b76f7fknvdnhC1DFWxnys0000000gv000000000c7ah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:49 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:48 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:49 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:49 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 6d3b9569-701e-0001-03a2-34b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085349Z-r178fb8d765cgqv6hC1DFWsdr400000000r000000000fygk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:49 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:49 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:49 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:49 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 6ba2b82c-f01e-0071-33a3-34431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085349Z-1749fc9bdbdmg6wshC1DFWu2bc00000000sg00000000a8m5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:49 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:49 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:50 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:50 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7c20effc-801e-0015-04a3-34f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085350Z-r178fb8d7657w5c5hC1DFW5ngg00000000v0000000009xyb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:50 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:49 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:50 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 2e9646c6-a01e-0098-2aa5-348556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085350Z-r178fb8d765n474shC1DFWge7g00000000t0000000008v8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:50 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:49 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:50 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085350Z-16547b76f7fnlcwwhC1DFWz6gw0000000gz000000000a39w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:50 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:49 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:50 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 933b6e18-c01e-0079-6ca0-34e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085350Z-1749fc9bdbd2c44rhC1DFWbxe000000000rg00000000cemh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:50 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:50 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:50 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ea01f9e5-001e-002b-3081-3599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085350Z-1749fc9bdbd6szhxhC1DFW199s00000000vg000000002ypw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:50 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:50 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:50 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:50 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 59f2508d-401e-00a3-296f-358b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085350Z-1749fc9bdbdgs9sshC1DFWt6ws00000000yg0000000026nf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:50 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:50 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:50 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:50 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 6bd3c087-001e-000b-13fd-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085350Z-16547b76f7fx6rhxhC1DFW76kg0000000gtg00000000ba0n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:50 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:50 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:51 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:50 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 88f0aa43-e01e-0033-32a0-344695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085350Z-1749fc9bdbdhnf7rhC1DFWgd0n00000000t00000000080q2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:51 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:50 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:51 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:50 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 63ea3643-901e-0015-3101-2db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085350Z-16547b76f7fj897nhC1DFWdwq40000000grg00000000893e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:51 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:51 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:51 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 94736f86-d01e-0082-21a1-34e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085351Z-r178fb8d765tllwdhC1DFWaz8400000000ug00000000cdgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:51 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:51 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:51 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 412bc4a2-301e-0020-47a2-346299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085351Z-r178fb8d765tq2dphC1DFW278s00000000m000000000dmah x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:51 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:51 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085351Z-16547b76f7fxsvjdhC1DFWprrs0000000gs000000000bxkd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:51 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:51 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:51 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 764b7f95-c01e-00a1-1c00-2d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085351Z-16547b76f7fxsvjdhC1DFWprrs0000000gwg00000000324a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:51 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:51 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:51 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 06b7c879-901e-00a0-36a3-346a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085351Z-r178fb8d765w8fzdhC1DFW8ep400000000r0000000009hzs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:51 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:52 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:52 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:52 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 53e8259c-c01e-0046-51a0-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085352Z-1749fc9bdbdkq6zthC1DFW38fn00000000ng00000000evyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:52 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:52 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:52 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:52 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e718dad-301e-0051-6df1-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085352Z-16547b76f7f7lhvnhC1DFWa2k00000000gs000000000axea x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:52 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:52 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:52 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:52 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 47d81796-701e-0021-2403-2d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085352Z-16547b76f7frbg6bhC1DFWr5400000000gsg00000000ayey x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:52 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:52 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d33f60ae-f01e-0085-74ec-2b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085352Z-16547b76f7fnlcwwhC1DFWz6gw0000000h20000000003xkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:52 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:52 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:52 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 231ce337-901e-0083-5701-2dbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085352Z-16547b76f7ftdm8dhC1DFWs13g0000000gv0000000008fm5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:52 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:53 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:53 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 2361c5fe-901e-0064-45f6-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085353Z-16547b76f7fj5p7mhC1DFWf8w40000000h0g0000000071gy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:53 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:53 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:53 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: e1bc049e-701e-003e-11a5-3479b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085353Z-1749fc9bdbdhnf7rhC1DFWgd0n00000000q000000000k2pr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:53 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:53 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c6b44c52-001e-0028-1ef0-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085353Z-16547b76f7f9bs6dhC1DFWt3rg0000000gwg000000006wg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:53 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:53 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085353Z-16547b76f7f2g4rlhC1DFWnx880000000gtg000000007v5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:53 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:53 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:53 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085353Z-16547b76f7fcrtpchC1DFW52e80000000gzg000000004zau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:53 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:54 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:54 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085354Z-16547b76f7fr4g8xhC1DFW9cqc0000000g1000000000a5sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:54 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:54 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:54 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 2d611ff0-901e-002a-3d01-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085354Z-16547b76f7f76p6chC1DFWctqw0000000h400000000007tw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:54 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:54 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:54 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:54 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7ef17957-a01e-0084-1674-359ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085354Z-1749fc9bdbdlzhmchC1DFWe68s00000000qg000000003pxd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:54 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:54 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:54 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:54 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a288df0b-b01e-00ab-0601-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085354Z-16547b76f7fmbrhqhC1DFWkds80000000gug00000000ed2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:54 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:54 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:54 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: db719d09-901e-005b-33cb-322005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085354Z-16547b76f7frbg6bhC1DFWr5400000000gvg000000004px8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:54 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49861	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:54 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=nPtt+6KKERhgrKN&MD=omBsCfMH HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-13 08:53:55 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 7e3a65aa-2f67-4437-8bd7-70a71d322aeb MS-RequestId: 734a3836-4083-42e3-9a39-486e257006c3 MS-CV: G+qPOD+2iUasfAQb.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 13 Nov 2024 08:53:54 GMT Connection: close Content-Length: 30005
2024-11-13 08:53:55 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-13 08:53:55 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:55 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:55 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 87bd4a9e-701e-0021-04a0-343d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085355Z-1749fc9bdbdmg6wshC1DFWu2bc00000000w000000000379f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:55 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:55 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:55 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 79c751c3-501e-0078-3aa2-3406cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085355Z-1749fc9bdbds4vwlhC1DFWz44000000000t0000000002tb7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:55 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:55 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:55 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 32d5e889-e01e-0099-1f00-2dda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085355Z-16547b76f7f7lhvnhC1DFWa2k00000000gq000000000es7s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:55 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:55 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:55 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:55 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: dbfc4b04-101e-000b-2a2a-355e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085355Z-1749fc9bdbdjgplnhC1DFWhrks00000000ng000000006v5d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:55 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:55 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:55 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:55 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: ac6bbd40-501e-007b-3e0c-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085355Z-16547b76f7fq9mcrhC1DFWq15w0000000gxg000000004vnk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:55 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:56 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:56 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 28a3e358-d01e-0065-18ab-34b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085356Z-r178fb8d765hbcjvhC1DFW50zc00000000s000000000bykz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:56 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:56 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:56 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 22e74508-c01e-00a1-69a2-347e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085356Z-1749fc9bdbdwv5sghC1DFWwp6n00000000r0000000002pyr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:56 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:56 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:56 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 100aec20-201e-006e-1215-2dbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085356Z-16547b76f7fwvr5dhC1DFW2c940000000gv0000000004yzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:56 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:56 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:56 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 53ec7209-c01e-0046-37a2-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085356Z-r178fb8d765hbcjvhC1DFW50zc00000000s000000000bym3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:56 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:56 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:56 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2012891f-801e-00ac-7a8d-35fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085356Z-r178fb8d765pnpzfhC1DFWgn8s00000000w0000000008g80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:56 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49872	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-13 08:53:56 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 08:53:57 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 08:52:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C549_BL2 x-ms-request-id: c1dd1dda-174a-45b5-9d68-c9dea3fbf6aa PPServer: PPV: 30 H: BL02EPF00027B54 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 08:53:56 GMT Connection: close Content-Length: 11412
2024-11-13 08:53:57 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:57 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:57 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:57 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 43621d70-001e-0046-5ca5-34da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085357Z-1749fc9bdbds4vwlhC1DFWz44000000000ug0000000007wh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:57 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:57 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:57 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085357Z-16547b76f7f8dwtrhC1DFWd1zn0000000h00000000008awm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:57 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:57 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085357Z-16547b76f7ftdm8dhC1DFWs13g0000000gw0000000007wuw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:57 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:57 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 28b142bf-301e-0000-3ca7-34eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085357Z-1749fc9bdbdjgplnhC1DFWhrks00000000pg0000000057s4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:57 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085357Z-16547b76f7fdtmzhhC1DFW6zhc00000005x0000000000132 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:58 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:58 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 96a6b3aa-501e-008f-53a1-349054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085358Z-r178fb8d765kzgrxhC1DFWrsuc00000000t0000000000cxg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:58 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:58 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:58 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085358Z-16547b76f7f67wxlhC1DFWah9w0000000gxg0000000052b4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:58 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:58 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:58 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 574f1a94-c01e-0049-095e-35ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085358Z-1749fc9bdbdnks4vhC1DFW79r800000000n000000000k2nn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:58 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49878	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-13 08:53:58 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 08:53:58 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 08:52:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C549_BL2 x-ms-request-id: 06ddb5e7-35c7-475c-a78e-03d97b992fc4 PPServer: PPV: 30 H: BL02EPF00027B3B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 08:53:58 GMT Connection: close Content-Length: 11412
2024-11-13 08:53:58 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:58 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:58 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085358Z-16547b76f7f7lhvnhC1DFWa2k00000000gt0000000009y5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:58 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:58 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d980b71d-401e-000a-13a8-344a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085358Z-1749fc9bdbdgs9sshC1DFWt6ws00000000yg0000000026u2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:53:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:58 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:58 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2d5e3293-901e-002a-4f00-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085358Z-16547b76f7fwvr5dhC1DFW2c940000000gu0000000006uq3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:59 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:58 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:59 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 162cf1ac-401e-002a-0c09-2dc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085358Z-16547b76f7f7jnp2hC1DFWfc300000000h0g000000003gsy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:59 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:59 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 6dc34679-101e-0034-7d01-2d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085359Z-16547b76f7fmbrhqhC1DFWkds80000000gzg000000005rbk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:59 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:59 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ed171e7d-901e-0015-69a2-34b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085359Z-1749fc9bdbdv5qmhhC1DFWf75800000000tg000000006qyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:59 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:59 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:59 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 5df09d77-001e-00a2-0c15-2dd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085359Z-16547b76f7f9bs6dhC1DFWt3rg0000000gvg000000008qft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:59 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:59 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:59 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ea775dbe-901e-0016-4f03-2defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085359Z-16547b76f7f4k79zhC1DFWu9y00000000gug00000000e4pf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:59 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49889	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-13 08:53:59 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 08:54:00 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 08:52:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C549_SN1 x-ms-request-id: c77f00d5-fc22-4c05-bc24-9e6fed311440 PPServer: PPV: 30 H: SN1PEPF0002F141 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 08:53:59 GMT Connection: close Content-Length: 11412
2024-11-13 08:54:00 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:59 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:53:59 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:59 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 86fb44b9-501e-0078-06d2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085359Z-16547b76f7f4k79zhC1DFWu9y00000000gwg00000000b1ga x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:53:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:53:59 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:53:59 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 392771d5-701e-000d-1cd2-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085359Z-16547b76f7flf9g6hC1DFWmcx800000007dg000000008u75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:00 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:00 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:00 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 898dd9bc-901e-0048-53d2-2cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085400Z-16547b76f7fmbrhqhC1DFWkds80000000gvg00000000bsnz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:00 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:00 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:00 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:00 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 44d502e9-701e-000d-5c08-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085400Z-16547b76f7flf9g6hC1DFWmcx800000007hg000000000veh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:00 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: b37f67ef-101e-008d-17ad-3492e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085400Z-r178fb8d765z89v7hC1DFW0kvw00000000m000000000cv8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:00 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:00 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 1ec43ba4-f01e-0003-65d2-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085400Z-16547b76f7f7lhvnhC1DFWa2k00000000gr000000000dc74 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:00 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:00 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 9ec2e68b-201e-0096-6cd2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085400Z-16547b76f7fj5p7mhC1DFWf8w40000000h10000000005vtf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:00 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:01 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:01 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:01 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: e1e5caf7-d01e-00ad-6fa7-34e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085401Z-r178fb8d765pnpzfhC1DFWgn8s00000000wg000000006q1s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:01 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:01 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 229e582e-901e-0083-26d2-2cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085401Z-16547b76f7fm7xw6hC1DFW5px40000000gw0000000003r1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49898	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-13 08:54:01 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 08:54:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 08:53:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C549_SN1 x-ms-request-id: 5d70efe9-55fe-4675-b036-84f343879e5f PPServer: PPV: 30 H: SN1PEPF0003F19A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 08:54:00 GMT Connection: close Content-Length: 11412
2024-11-13 08:54:01 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:01 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:01 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:01 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085401Z-16547b76f7fxsvjdhC1DFWprrs0000000gvg0000000051sr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:01 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:01 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:01 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:01 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 31833cf5-a01e-0070-33a3-34573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085401Z-r178fb8d765z89v7hC1DFW0kvw00000000sg000000000pth x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:01 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:01 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:01 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:01 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 8a5e2199-d01e-0014-3f2b-2ced58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085401Z-16547b76f7f7jnp2hC1DFWfc300000000gw000000000cd1f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:01 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:01 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:01 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f61ab913-a01e-006f-21a0-3413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085401Z-1749fc9bdbdkq6zthC1DFW38fn00000000ng00000000ew45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:02 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:02 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:02 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:02 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 682504c0-001e-005a-75d2-2cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085402Z-16547b76f7fnlcwwhC1DFWz6gw0000000h300000000024se x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:02 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:02 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:02 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:02 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 659aa3e6-801e-008f-64d2-2c2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085402Z-16547b76f7ftdm8dhC1DFWs13g0000000gug0000000094k4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:02 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:02 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:02 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:02 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085402Z-16547b76f7fcrtpchC1DFW52e80000000gv000000000d0n5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:02 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:02 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:02 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 4e98fbea-b01e-0002-08d2-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085402Z-16547b76f7fdtmzhhC1DFW6zhc00000005wg000000000u28 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:02 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:02 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:03 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:02 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 081c3a8e-a01e-0053-58d2-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085402Z-16547b76f7f775p5hC1DFWzdvn0000000gzg0000000015dm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:03 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:03 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b1270df0-501e-0035-6dd2-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085403Z-16547b76f7f7rtshhC1DFWrtqn0000000gyg00000000741c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:03 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:03 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: d5f81faf-001e-0017-2ed2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085403Z-16547b76f7fp46ndhC1DFW66zg0000000h1g0000000014bt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:03 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:03 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:03 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: b51813c1-401e-002a-5f12-32c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085403Z-16547b76f7f7scqbhC1DFW0m5w0000000gqg00000000amx7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:03 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:03 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:03 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:03 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3caab57d-601e-005c-6cd2-2cf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085403Z-16547b76f7fkcrm9hC1DFWxdag0000000gz000000000a5h6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:03 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:03 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:03 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:03 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 790f93ef-601e-003e-42a2-343248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085403Z-1749fc9bdbd2jxtthC1DFWfk5w00000000qg000000008qv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:54:03 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:04 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:04 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 70b2909d-801e-00ac-33c1-2cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085404Z-16547b76f7fm7xw6hC1DFW5px40000000gu0000000007d7a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:04 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:04 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:04 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:04 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085404Z-16547b76f7fr28cchC1DFWnuws0000000h300000000024mm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:04 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:04 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:04 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:04 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 26c42504-001e-0017-7560-350c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085404Z-r178fb8d765r2t2rhC1DFWa9x000000000sg000000005thn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:04 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:04 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:04 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:04 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 3018d77d-101e-008d-49d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085404Z-16547b76f7f4k79zhC1DFWu9y00000000h10000000001ydk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:04 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:04 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:04 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:04 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ddaecdfb-101e-0079-21d2-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085404Z-16547b76f7ftdm8dhC1DFWs13g0000000gsg00000000ddk4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:04 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:04 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:05 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:05 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 21399fcf-c01e-008e-25a8-347381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085404Z-r178fb8d7656shmjhC1DFWu5kw00000000r000000000genw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:54:05 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:05 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:05 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:05 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 98909b4d-d01e-002b-39d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085405Z-16547b76f7f7jnp2hC1DFWfc300000000gug00000000e7rg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:05 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:05 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:05 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:05 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 2ce7ce6f-901e-002a-1fd2-2c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085405Z-16547b76f7fcrtpchC1DFW52e80000000gyg000000006k9u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:05 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:05 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:05 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:05 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 86fb53ab-501e-0078-4ed2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085405Z-16547b76f7f8dwtrhC1DFWd1zn0000000gwg00000000e6rg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:05 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:05 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:05 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:05 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 4630a231-e01e-0020-14ff-2bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085405Z-16547b76f7fcrtpchC1DFW52e80000000gzg000000004zwa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:05 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:05 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:05 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 934c77ff-c01e-0079-30a7-34e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085405Z-r178fb8d765z89v7hC1DFW0kvw00000000p0000000007w3h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:05 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:05 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:06 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:05 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: ad01162d-901e-0064-5fc3-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085405Z-16547b76f7fknvdnhC1DFWxnys0000000gwg00000000arvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:06 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:06 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:06 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:06 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 26ab9fbe-e01e-0099-1ba1-34da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085406Z-1749fc9bdbdkq6zthC1DFW38fn00000000t0000000004bds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:06 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:06 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:06 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:06 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 384ed142-801e-0047-1f8c-327265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085406Z-16547b76f7fdf69shC1DFWcpd00000000gu0000000008tzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:06 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:06 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:06 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:06 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: f81db1ec-b01e-00ab-60a2-34dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085406Z-1749fc9bdbd9f5rdhC1DFWbers00000000ug00000000a81c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:54:06 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:06 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:06 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:06 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: c6a80355-b01e-0070-0e08-2c1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085406Z-16547b76f7fx6rhxhC1DFW76kg0000000gwg000000006zm9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:06 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:06 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:07 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:06 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 3018dbe1-101e-008d-70d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085406Z-16547b76f7fkcrm9hC1DFWxdag0000000h30000000001vg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:07 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:06 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:07 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:06 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6c65b011-001e-000b-6024-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085406Z-16547b76f7f4k79zhC1DFWu9y00000000h10000000001yep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:07 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49933	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:07 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:07 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:07 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 792e95e0-001e-0065-4da8-340b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085407Z-r178fb8d765bflfthC1DFWuy9n00000000y0000000003d41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:07 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49934	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:07 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:07 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:07 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 8dbb7985-901e-005b-56a0-342005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085407Z-r178fb8d7652w4wkhC1DFW0d7w00000000ug000000001rpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:07 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:07 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:07 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:07 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 58833dad-701e-0097-44a0-34b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085407Z-r178fb8d765th6bkhC1DFWr7h000000000sg00000000ntc2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 08:54:07 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49937	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:07 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:07 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:07 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 9890a075-d01e-002b-06d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085407Z-16547b76f7f7lhvnhC1DFWa2k00000000gug000000005r74 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:07 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49938	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:07 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:08 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:08 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 29f76c25-201e-0000-6fd2-2ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085408Z-16547b76f7fdtmzhhC1DFW6zhc00000005qg00000000amqt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:08 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49939	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:08 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:08 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:08 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: ff648744-f01e-0096-2ca0-3410ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085408Z-r178fb8d765tllwdhC1DFWaz8400000000w000000000874a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:08 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49940	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 08:54:08 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 08:54:08 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:54:08 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 4847cb37-401e-0016-7fd2-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T085408Z-16547b76f7fq9mcrhC1DFWq15w0000000gtg00000000crp6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 08:54:08 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Target ID:	0
Start time:	03:52:56
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Xeno Executor Setup 1.0.0.exe"
Imagebase:	0x400000
File size:	86'060'027 bytes
MD5 hash:	3E16CBD302CB621239608AC3CAF444CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:52:57
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Xeno Executor.exe" \| %SYSTEMROOT%\System32\find.exe "Xeno Executor.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:52:57
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:52:57
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Xeno Executor.exe"
Imagebase:	0x240000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:52:57
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\find.exe "Xeno Executor.exe"
Imagebase:	0x120000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:53:20
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe"
Imagebase:	0x7ff604060000
File size:	162'117'120 bytes
MD5 hash:	1D932D5598C44D2BA24C72C7F58D3F37
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 1%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:53:23
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:53:23
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:53:23
Start date:	13/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff6fea20000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:53:24
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Imagebase:	0x7ff604060000
File size:	162'117'120 bytes
MD5 hash:	1D932D5598C44D2BA24C72C7F58D3F37
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	03:53:27
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2448 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Imagebase:	0x7ff604060000
File size:	162'117'120 bytes
MD5 hash:	1D932D5598C44D2BA24C72C7F58D3F37
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:53:27
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:53:29
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2072,i,5952011540355768207,9689636640769716154,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:53:31
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --window-position=-2400,-2400
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:53:32
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2912 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:53:35
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6496 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:53:35
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6980 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:53:36
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Imagebase:	0x7ff75bd10000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:53:36
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,7420616656286760538,5130127522800317646,262144 /prefetch:8
Imagebase:	0x7ff75bd10000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:53:45
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:53:45
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:53:45
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8380, Parent PID: 8324

General

Target ID:	29
Start time:	03:53:45
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:53:45
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: tasklist.exePID: 8316, Parent PID: 8036

General

Target ID:	31
Start time:	03:53:45
Start date:	13/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff6c6fe0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:53:45
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:53:45
Start date:	13/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff6c6fe0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:53:45
Start date:	13/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff6c6fe0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:53:45
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5292, Parent PID: 3408

General

Target ID:	36
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff6c6fe0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7380, Parent PID: 7348

General

Target ID:	41
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7500, Parent PID: 3176

General

Target ID:	43
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /T /IM msedge.exe
Imagebase:	0x7ff66bee0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /T /IM msedge.exe
Imagebase:	0x7ff66bee0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /T /IM msedge.exe
Imagebase:	0x7ff66bee0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	03:53:46
Start date:	13/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM EpicGamesLauncher.exe /F
Imagebase:	0x7ff66bee0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	03:53:47
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	03:53:47
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	03:53:47
Start date:	13/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM javaw.exe /F
Imagebase:	0x7ff66bee0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	03:53:47
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	03:53:47
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	03:53:47
Start date:	13/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM Steam.exe /F
Imagebase:	0x7ff66bee0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	03:53:47
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
Imagebase:	0x7ff6f5f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8948, Parent PID: 8900

General

Target ID:	57
Start time:	03:53:47
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	03:53:47
Start date:	13/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /T /IM msedge.exe
Imagebase:	0x7ff66bee0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	03:55:25
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\unrealgame\Xeno Executor.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,4686225955580083845,940031297734996434,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Imagebase:	0x7ff604060000
File size:	162'117'120 bytes
MD5 hash:	1D932D5598C44D2BA24C72C7F58D3F37
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	27%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.2%
Total number of Nodes:	1333
Total number of Limit Nodes:	35

Executed Functions

Function 0040338F Relevance: 75.7, APIs: 33, Strings: 10, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033B2
GetVersion.KERNEL32 ref: 004033B8
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033EB
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403428
OleInitialize.OLE32(00000000), ref: 0040342F
SHGetFileInfoW.SHELL32(00440208,00000000,?,000002B4,00000000), ref: 0040344B
GetCommandLineW.KERNEL32(00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 00403460
CharNextW.USER32(00000000,004CB000,00000020,004CB000,00000000,?,00000006,00000008,0000000A), ref: 00403498

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

GetTempPathW.KERNEL32(00002000,004DF000,?,00000006,00000008,0000000A), ref: 004035D2
GetWindowsDirectoryW.KERNEL32(004DF000,00001FFB,?,00000006,00000008,0000000A), ref: 004035E3
lstrcatW.KERNEL32(004DF000,\Temp,?,00000006,00000008,0000000A), ref: 004035EF
GetTempPathW.KERNEL32(00001FFC,004DF000,004DF000,\Temp,?,00000006,00000008,0000000A), ref: 00403603
lstrcatW.KERNEL32(004DF000,Low,?,00000006,00000008,0000000A), ref: 0040360B
SetEnvironmentVariableW.KERNEL32(TEMP,004DF000,004DF000,Low,?,00000006,00000008,0000000A), ref: 0040361C
SetEnvironmentVariableW.KERNEL32(TMP,004DF000,?,00000006,00000008,0000000A), ref: 00403624
DeleteFileW.KERNELBASE(004DB000,?,00000006,00000008,0000000A), ref: 00403638

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 004036FE
CoUninitialize.COMBASE(00000006,?,00000006,00000008,0000000A), ref: 00403703
ExitProcess.KERNEL32 ref: 00403724
lstrcatW.KERNEL32(004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
lstrcatW.KERNEL32(004DF000,0040A26C,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403746
lstrcatW.KERNEL32(004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403751
lstrcmpiW.KERNEL32(004DF000,004D7000,004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040375D
SetCurrentDirectoryW.KERNEL32(004DF000,004DF000,?,00000006,00000008,0000000A), ref: 00403779
DeleteFileW.KERNEL32(0043C208,0043C208,?,0047B000,00000008,?,00000006,00000008,0000000A), ref: 004037D3
CopyFileW.KERNEL32(004E7000,0043C208,00000001,?,00000006,00000008,0000000A), ref: 004037E7
CloseHandle.KERNEL32(00000000,0043C208,0043C208,?,0043C208,00000000,?,00000006,00000008,0000000A), ref: 00403814
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403843
OpenProcessToken.ADVAPI32(00000000), ref: 0040384A
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040385F
AdjustTokenPrivileges.ADVAPI32 ref: 00403882
ExitWindowsEx.USER32(00000002,80040002), ref: 004038A7
ExitProcess.KERNEL32 ref: 004038CA

Strings

.tmp, xrefs: 0040374B
SeShutdownPrivilege, xrefs: 00403859
Error launching installer, xrefs: 004036BA
NSIS Error, xrefs: 00403451
TEMP, xrefs: 00403617
~nsu, xrefs: 0040372F
Low, xrefs: 00403605
UXTHEME, xrefs: 004033DF, 004033E4, 004033EA
\Temp, xrefs: 004035E9
TMP, xrefs: 0040361F

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 424501083-3195845224
Opcode ID: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
Instruction ID: 33fbdd78d52bfd04f2c73b4da217482bb076a8c6d1615cdfa2cd3638f3c4bec2
Opcode Fuzzy Hash: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
Instruction Fuzzy Hash: 45D1F471100310AAE720BF769D45B2B3AADEB4070AF10447FF885B62E1DBBD8D55876E

Function 00405461 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004054BF
GetDlgItem.USER32(?,000003EE), ref: 004054CE
GetClientRect.USER32(?,?), ref: 0040550B
GetSystemMetrics.USER32(00000002), ref: 00405512
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405533
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405544
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405557
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405565
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405578
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040559A
ShowWindow.USER32(?,00000008), ref: 004055AE
GetDlgItem.USER32(?,000003EC), ref: 004055CF
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055DF
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055F8
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405604
GetDlgItem.USER32(?,000003F8), ref: 004054DD

Part of subcall function 00404266: SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

GetDlgItem.USER32(?,000003EC), ref: 00405621
CreateThread.KERNELBASE(00000000,00000000,Function_000053F5,00000000), ref: 0040562F
CloseHandle.KERNELBASE(00000000), ref: 00405636
ShowWindow.USER32(00000000), ref: 0040565A
ShowWindow.USER32(?,00000008), ref: 0040565F
ShowWindow.USER32(00000008), ref: 004056A9
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056DD
CreatePopupMenu.USER32 ref: 004056EE
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405702
GetWindowRect.USER32(?,?), ref: 00405722
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040573B
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
OpenClipboard.USER32(00000000), ref: 00405783
EmptyClipboard.USER32 ref: 00405789
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405795
GlobalLock.KERNEL32(00000000), ref: 0040579F
SendMessageW.USER32(?,00001073,00000000,?), ref: 004057B3
GlobalUnlock.KERNEL32(00000000), ref: 004057D3
SetClipboardData.USER32(0000000D,00000000), ref: 004057DE
CloseClipboard.USER32 ref: 004057E4

Strings

{, xrefs: 004056C7

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
Instruction ID: bae72a1d173c3811f2fd5642bc5838002141c6bee16c4b6d0499208050eeb164
Opcode Fuzzy Hash: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
Instruction Fuzzy Hash: 3CB12970900608FFDB119FA0DE89EAE7B79FB48354F00413AFA45A61A0CBB55E91DF58

Function 004059CC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,004DF000,74DF3420,00000000), ref: 004059F5
lstrcatW.KERNEL32(00460250,\*.*,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A3D
lstrcatW.KERNEL32(?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A60
lstrlenW.KERNEL32(?,?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A66
FindFirstFileW.KERNELBASE(00460250,?,?,?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A76
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B16
FindClose.KERNEL32(00000000), ref: 00405B25

Strings

\*.*, xrefs: 00405A37

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 381ae1539308b0fff5c23660480c7799636f68814d34eb948432fba1f876741c
Instruction ID: 3baa02bdf70247edfb0f680676f8bffda79515ede8bd61e7e13478a9eee65f3b
Opcode Fuzzy Hash: 381ae1539308b0fff5c23660480c7799636f68814d34eb948432fba1f876741c
Instruction Fuzzy Hash: E141D430900914AACB21AB618C89ABF7778EF45369F10427FF801711D1D77CAD81DE6E

Function 004065FD Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004DF000,00468298,00464250,00405CE0,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00406608
FindClose.KERNELBASE(00000000), ref: 00406614

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
Instruction ID: 086872f0bf6ffc0fec3bf9e050170664210a11ef237051a194e92f35cf11c1a2
Opcode Fuzzy Hash: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
Instruction Fuzzy Hash: 52D012315455205BC7001B386E0C85B7B599F553317158F37F46AF51E0DB758C62869D

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
Instruction ID: 6590b0d0bd135a94e5278e34c2007f8374f9804fe0c2ec815525577e7f77d17f
Opcode Fuzzy Hash: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
Instruction Fuzzy Hash: 01414C71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E0DBB99981CB44

Function 00403D58 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D94
ShowWindow.USER32(?), ref: 00403DB1
DestroyWindow.USER32 ref: 00403DC5
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DE1
GetDlgItem.USER32(?,?), ref: 00403E02
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E16
IsWindowEnabled.USER32(00000000), ref: 00403E1D
GetDlgItem.USER32(?,00000001), ref: 00403ECB
GetDlgItem.USER32(?,00000002), ref: 00403ED5
SetClassLongW.USER32(?,000000F2,?), ref: 00403EEF
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F40
GetDlgItem.USER32(?,00000003), ref: 00403FE6
ShowWindow.USER32(00000000,?), ref: 00404007
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404019
EnableWindow.USER32(?,?), ref: 00404034
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040404A
EnableMenuItem.USER32(00000000), ref: 00404051
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404069
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040407C
lstrlenW.KERNEL32(00450248,?,00450248,00000000), ref: 004040A6
SetWindowTextW.USER32(?,00450248), ref: 004040BA
ShowWindow.USER32(?,0000000A), ref: 004041EE

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
Instruction ID: ebd8885eb79f40fe398f9982bcc50e4b60f6275a3dc5f5776bcae5bce4ead0d0
Opcode Fuzzy Hash: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
Instruction Fuzzy Hash: AFC1D5B1500304ABDB206F61EE88E2B3A78FB95346F00053EF645B51F1CB799891DB6E

Function 004039AA Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

lstrcatW.KERNEL32(004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000,74DF3420,004CB000,00000000), ref: 00403A2B
lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000), ref: 00403AAB
lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000), ref: 00403ABE
GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403AC9
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004CF000), ref: 00403B12

Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E

RegisterClassW.USER32(00472E80), ref: 00403B4F
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B67
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B9C
ShowWindow.USER32(00000005,00000000), ref: 00403BD2
GetClassInfoW.USER32(00000000,RichEdit20W,00472E80), ref: 00403BFE
GetClassInfoW.USER32(00000000,RichEdit,00472E80), ref: 00403C0B
RegisterClassW.USER32(00472E80), ref: 00403C14
DialogBoxParamW.USER32(?,00000000,00403D58,00000000), ref: 00403C33

Strings

_Nb, xrefs: 00403B2E, 00403B96
Remove folder: , xrefs: 00403A72, 00403A7B, 00403A89, 00403AD8, 00403ADE
.exe, xrefs: 00403AB8
RichEdit, xrefs: 00403C05
Control Panel\Desktop\ResourceLocale, xrefs: 004039DE
RichEd20, xrefs: 00403BD8
.DEFAULT\Control Panel\International, xrefs: 00403A16
RichEd32, xrefs: 00403BE6
RichEdit20W, xrefs: 00403BF6, 00403BFC

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-564491471
Opcode ID: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
Instruction ID: e946f9b6b947081a315c1f95bc525aa973ad4f651662e5f5477bf26fdb3bf1de
Opcode Fuzzy Hash: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
Instruction Fuzzy Hash: B361C8302407007ED720AF669E45E2B3A6CEB8474AF40417FF985B51E2DBBD5951CB2E

Function 004062DC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Remove folder: ,00002000), ref: 0040641D
GetWindowsDirectoryW.KERNEL32(Remove folder: ,00002000,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000), ref: 00406430
SHGetSpecialFolderLocation.SHELL32(00405359,0042CE00,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000), ref: 0040646C
SHGetPathFromIDListW.SHELL32(0042CE00,Remove folder: ), ref: 0040647A
CoTaskMemFree.OLE32(0042CE00), ref: 00406485
lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 004064AB
lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000), ref: 00406503

Strings

Remove folder: , xrefs: 00406306, 004063E1, 004063E8, 004063EC, 00406406, 00406407, 0040641C, 0040642F, 0040644B, 00406476, 004064AA, 004064B0, 004064CC, 004064DF, 004064FC, 00406502, 0040650E, 00406541
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063ED
Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\, xrefs: 00406301
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004064A5

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-3385562646
Opcode ID: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
Instruction ID: deb4280fb9253f119c0dee44fead77f8699473dbe43bed35a1e393a154a8df3c
Opcode Fuzzy Hash: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
Instruction Fuzzy Hash: 87612371A00115AADF209F64DC44BAE37A5EF45318F22803FE907B62D0D77D9AA1C75E

Function 00402EDD Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,004E7000,00002000,?,00000006,00000008,0000000A), ref: 00402F0A

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

GetFileSize.KERNEL32(00000000,00000000,004EB000,00000000,004D7000,004D7000,004E7000,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56

Strings

Error launching installer, xrefs: 00402F2D
soft, xrefs: 00402FCB
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
Null, xrefs: 00402FD4
Inst, xrefs: 00402FC2

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 6fdf7a3c576b274adc95fc68e3ac1b8cc101307f87f608dfe476064d1f7918cb
Instruction ID: d807cc789e5c0b6659aec278a7977cb1897ccc82e3fedab9e592eb30a9b28e48
Opcode Fuzzy Hash: 6fdf7a3c576b274adc95fc68e3ac1b8cc101307f87f608dfe476064d1f7918cb
Instruction Fuzzy Hash: 23511671901205ABDB20AF61DD85B9F7FACEB0431AF20403BF914B62D5C7789E818B9D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,ExecShellAsUser,ExecShellAsUser,00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017D5

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll, xrefs: 00401835, 00401851
ExecShellAsUser, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp$C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll$ExecShellAsUser
API String ID: 1941528284-3809898928
Opcode ID: 84cc1ef8d08a74648e49299eefb5f22073aa957ae4a4092afed5da839c45f715
Instruction ID: c6e8234c1d4b6e0ef99598e998ad36802638a9a190aaa2bd7459f070bf199d51
Opcode Fuzzy Hash: 84cc1ef8d08a74648e49299eefb5f22073aa957ae4a4092afed5da839c45f715
Instruction Fuzzy Hash: 9841B471900514BACF107BA5CD45DAF3A79EF05368F20423FF422B10E1DA3C86919A6E

Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
wsprintfW.USER32 ref: 00406676
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Strings

\, xrefs: 0040664C
UXTHEME, xrefs: 0040662D
%s%S.dll, xrefs: 00406670

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 9fa172bba6ca99a644905d2b6d7ed641771312ed853c50fe9922007c80c3d461
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 7CF0FC70501119A6CF10BB64DD0EF9B365CA700304F10447AA54AF10D1EBB9DB64CB99

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403227
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403250
wsprintfW.USER32 ref: 00403263

Strings

... %d%%, xrefs: 0040325D

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
Instruction ID: f437ad28db75119c3a693f92e670aa5c34007c7df9fe8e0debaece40423bbb79
Opcode Fuzzy Hash: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
Instruction Fuzzy Hash: 0D517D71900219DBDB10DF66EA44AAE7BB8AB04356F54417FEC14B72C0CB388A51CBA9

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
Instruction ID: 1af55e8da281c8781352e9764615226c40e2312ccaecb42dabcb88ef8baddf82
Opcode Fuzzy Hash: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
Instruction Fuzzy Hash: 5621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605B61D0D7B889809B19

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw53E1.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsw53E1.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsw53E1.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp
API String ID: 2655323295-1541861853
Opcode ID: 1af8095f3c9504d2ce798825688ccba5ec512a5a8ae6ba4a7bc3247cfd6f00f3
Instruction ID: a703f9f7a84a81219e2528cb215680d2185ac4e531b753f9c0eacf199e84c27d
Opcode Fuzzy Hash: 1af8095f3c9504d2ce798825688ccba5ec512a5a8ae6ba4a7bc3247cfd6f00f3
Instruction Fuzzy Hash: AF118471D00104BEEB10AFA5DE89EAEBA74AB44754F11803BF504F71D1D7F48D409B29

Function 004057F1 Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834
GetLastError.KERNEL32 ref: 00405848
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040585D
GetLastError.KERNEL32 ref: 00405867

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction ID: d156970015101e62572267df52bf1fb018b172c5ebb67f048bc3511340661aba
Opcode Fuzzy Hash: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction Fuzzy Hash: EB010872D00219EADF009FA1C944BEFBBB8EF14304F00803AE945B6280D7789618CFA9

Function 00405C97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405C3A: CharNextW.USER32(?,?,00464250,?,00405CAE,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

lstrlenW.KERNEL32(00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405CF0
GetFileAttributesW.KERNELBASE(00464250,00464250,00464250,00464250,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00405D00

Strings

PBF, xrefs: 00405C9D

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: PBF
API String ID: 3248276644-3456974464
Opcode ID: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
Instruction ID: 4e01e145a0ed536ad24acc563e8a85444835dd946e40d448b56664b374cc0476
Opcode Fuzzy Hash: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
Instruction Fuzzy Hash: 21F0F43500DF6125F626333A1C45AAF2555CE82328B6A057FFC62B12D2DA3C89539D7E

Function 00405DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DFD
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,004CB000,0040338D,004DB000,004DF000,004DF000,004DF000,004DF000,004DF000,74DF3420,004035D9), ref: 00405E18

Strings

nsa, xrefs: 00405DEC

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: af8b6ba947558e1b0daa3aed001b6e0f80e178ffca66ecedc63f3e0829e9a41e
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 61F03076A00304FBEB009F69ED05E9FB7BCEB95710F10803AE941E7250E6B09A548B64

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
Instruction ID: 3abd81b96889d1c7eb1cceed2e7b5e281284f1a6e6a9a5ff44b88a827c8e1d1c
Opcode Fuzzy Hash: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
Instruction Fuzzy Hash: 8821B071D00205AACF20AFA5CE48A9E7A70BF04358F60413BF511B11E0DBBD8981DA6E

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(00857DC0), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00004004), ref: 00401BF9

Strings

ExecShellAsUser, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Global$AllocFree
String ID: ExecShellAsUser
API String ID: 3394109436-869331269
Opcode ID: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
Instruction ID: 2ffc4b8e8b305263ff1bfe934f744a2e7f0909984677ca7ca3d2d917788d1148
Opcode Fuzzy Hash: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
Instruction Fuzzy Hash: 52210A76600100ABCB10FF95CE8499E73A8EB48318BA4443FF506F32D0DB78A852DB6D

Function 00402259 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004065FD: FindFirstFileW.KERNELBASE(004DF000,00468298,00464250,00405CE0,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00406608
Part of subcall function 004065FD: FindClose.KERNELBASE(00000000), ref: 00406614

lstrlenW.KERNEL32 ref: 00402299
lstrlenW.KERNEL32(00000000), ref: 004022A4
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004022CD

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
Instruction ID: edc96df04b91ed766a503f65766f364d086ea8d205cfe5bb15309c141496b913
Opcode Fuzzy Hash: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
Instruction Fuzzy Hash: 57117071900318A6DB10EFF98E4999EB7B8AF04344F50443FB805F72D1D6B8C4419B59

Function 00405984 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D8B: GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
Part of subcall function 00405D8B: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B66), ref: 0040599F
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B66), ref: 004059A7
SetFileAttributesW.KERNEL32(?,00000000), ref: 004059BF

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
Instruction ID: 825022a906987a8d14f11fb4079f6fb6242afe5a54bc5f1377d2c32e3c215ab4
Opcode Fuzzy Hash: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
Instruction Fuzzy Hash: D1E0E5B1119F5096D21067349A0CB5B2AA4DF86334F05093AF891F11C0DB3844068EBE

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405C3A: CharNextW.USER32(?,?,00464250,?,00405CAE,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057F1: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834

SetCurrentDirectoryW.KERNELBASE(?,004D3000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
Instruction ID: 536d45c59d08a7b21130d9dbd5b0e10796a041e4a40079992e14d28e29d42f71
Opcode Fuzzy Hash: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
Instruction Fuzzy Hash: 2211E231504505EBCF30AFA1CD0159F36A0EF14369B28493BFA45B22F1DB3E8A919B5E

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsw53E1.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
Instruction ID: 1206e07bb255176646816810ef0290bee69920d7ecde6c9ccbb84b14c6b4306b
Opcode Fuzzy Hash: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
Instruction Fuzzy Hash: E311A771D10205EBDF14DFA4CA585AE77B4EF44348B20843FE505B72C0D6B89A41EB5E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
Instruction ID: ea42f58d7670a619ed9131e80823b54190387dbc53765a55c310ef4228f9fff3
Opcode Fuzzy Hash: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
Instruction Fuzzy Hash: AF0128316202109BE7095B789E04B2A3798E710315F10463FF855F62F1D6B8CC829B5C

Function 004053F5 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405405

Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

CoUninitialize.COMBASE(00000404,00000000), ref: 00405451

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
Instruction ID: 7813e2a1ccdf537c56c01956b79198a0443dbd649336f33e6835a7e221d2fb99
Opcode Fuzzy Hash: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
Instruction Fuzzy Hash: ABF090B25406009BE7015B549D01BAB7760EFD431AF05443EFF89B22E0D77948928E6E

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
Instruction ID: fc8c1c2e7d4a5a8f9e35cd12a8e681b154a8316ed36a6d041aa31def844ca7e2
Opcode Fuzzy Hash: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
Instruction Fuzzy Hash: 61E01A72E082008FE724ABA5AA495AD77B4EB90365B20847FE211F11D1DA7858819F6A

Function 00406694 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

Part of subcall function 00406624: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
Part of subcall function 00406624: wsprintfW.USER32 ref: 00406676
Part of subcall function 00406624: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
Instruction ID: 155b38c425e345f43688a0673e138072f65e923c2ca09dacbbabb210d44f0fbf
Opcode Fuzzy Hash: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
Instruction Fuzzy Hash: 50E0863250461156D31197709E4487762EC9B95750307483EF946F2091DB399C36A66D

Function 00403915 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,004DF000,00000000,74DF3420,004038ED,00403703,00000006,?,00000006,00000008,0000000A), ref: 0040392F
GlobalFree.KERNEL32(?), ref: 00403936

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
Instruction ID: 228f896298dd83b048f64e6024dd5859bf02c68f9830d759f3998b57695c5827
Opcode Fuzzy Hash: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
Instruction Fuzzy Hash: 12E0C2334122205BC6215F04ED08B5A776CAF49B32F15407AFA807B2A087B81C928FC8

Function 00405DB0 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 00405D8B Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: fe430eedc911e7c92ce83e5abbc00e08444bb0e311ec0623c818608bfa408f6d
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 1BD0C972504420ABD2512728AF0C89BBB95DB542717028B39FAA9A22B0CB304C568A98

Function 004038D0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403703,00000006,?,00000006,00000008,0000000A), ref: 004038DB

Strings

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\, xrefs: 004038EF

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\
API String ID: 2962429428-1223080650
Opcode ID: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
Instruction ID: f79f1cdd038f729e9031bf35a7c7ad7adb8aafebcc14ea038f42f7e62efb972e
Opcode Fuzzy Hash: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
Instruction Fuzzy Hash: 69C0127054070496C1206F759D4F6193E54AB8173BB604776B0B8B10F1C77C4B59595E

Function 0040586E Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403382,004DF000,004DF000,004DF000,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 00405874
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405882

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: b5712d1dc6f90c91938fb9970759bfac189bcafefc635788875416fd9ee2894b
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 2FC04C712155019ED7546F619F08B277A50EB60781F158839A946E10E0DB348465ED2D

Function 00406155 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040617E

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: dcb86bc894ab99bc20e37dc8a6176b737b641c0fdee4176656c7f25b47436c56
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 75E0E6B2110109BEEF195F50DD0AD7B375DE704304F01452EFA06D4091E6B5AD315634

Function 00405E62 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032FA,000000FF,00428200,?,00428200,?,?,00000004,00000000), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 8754e0b6f25d564075f0081c534dd79b85a2df0f0bc88b3642164a4a3ec1e455
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: FDE0B63221065AAFDF109F95DC00AAB7B6CEB052A0F044437FD59E7150D671EA21DAE4

Function 00405E33 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403344,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: bd732019988057c431ec21c3a2c50b1292625b962aa4d7912315599e48db2a91
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: A9E08C3220021AABCF20AF54DC00FEB3B6CEB05760F004832FD65E6040E230EA219BE8

Function 00406127 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,004061B5,?,00000000,?,?,Remove folder: ,?), ref: 0040614B

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: b908bd292ce434c6339c018d18c1e3bfafdd2f7559b63d477f04a141d62eba1a
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 94D0123214020DFBDF119E909D01FAB775DAB08350F014426FE06A9191D776D530AB14

Function 00404231 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,00000000), ref: 0040424B

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
Instruction ID: 58c8b0ee816a9f079cb4560b894257bfb9dfa06490f5d5235509ae25e2c95a64
Opcode Fuzzy Hash: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
Instruction Fuzzy Hash: 79C04C76148300BFD681BB55CC42F1FB79DEF94315F44C52EB59CA11E2C63A84309B26

Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
Instruction ID: 539d97cecbd0a6245bb22c05259f77f590d4a0b0d5c0f28d123e3a53dcb21da8
Opcode Fuzzy Hash: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
Instruction Fuzzy Hash: C6C09BB27403007BDE11CB909E49F1777545790740F18447DB348F51E0D6B4D490D61C

Function 00403347 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403355

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404266 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
Instruction ID: 80b1fa8ab317a3fb83bf0bb9afc1fcb2ede285a6b5c9b7890d3d6fe7da01b763
Opcode Fuzzy Hash: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
Instruction Fuzzy Hash: 69B092361C4600AAEE118B50DE49F497A62E7A4702F008138B244640B0CAB200E0DB09

Function 00404253 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040402A), ref: 0040425D

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
Instruction ID: 6a6b83ba7992c3eb947fe44f0607646ae594aefa1fc7371f7d6a783f6fb0b7b0
Opcode Fuzzy Hash: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
Instruction Fuzzy Hash: 4EA002754445019BCF015B50DF098057A61F7A4701B114479B5555103596314860EB19

Non-executed Functions

Function 00404C9E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404CB6
GetDlgItem.USER32(?,00000408), ref: 00404CC1
GlobalAlloc.KERNEL32(00000040,?), ref: 00404D0B
LoadBitmapW.USER32(0000006E), ref: 00404D1E
SetWindowLongW.USER32(?,000000FC,00405296), ref: 00404D37
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D4B
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D5D
SendMessageW.USER32(?,00001109,00000002), ref: 00404D73
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D7F
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D91
DeleteObject.GDI32(00000000), ref: 00404D94
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404DBF
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DCB
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E61
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E8C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EA0
GetWindowLongW.USER32(?,000000F0), ref: 00404ECF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EDD
ShowWindow.USER32(?,00000005), ref: 00404EEE
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FEB
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405050
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405065
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405089
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050A9
ImageList_Destroy.COMCTL32(?), ref: 004050BE
GlobalFree.KERNEL32(?), ref: 004050CE
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405147
SendMessageW.USER32(?,00001102,?,?), ref: 004051F0
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051FF
InvalidateRect.USER32(?,00000000,00000001), ref: 0040521F
ShowWindow.USER32(?,00000000), ref: 0040526D
GetDlgItem.USER32(?,000003FE), ref: 00405278
ShowWindow.USER32(00000000), ref: 0040527F

Strings

, xrefs: 00405257
M, xrefs: 00404E48
N, xrefs: 00404F29

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
Instruction ID: 350e9793ba1948ff1935c4af006ad7833f39553502bf8ecbcf91bc97059cc7bb
Opcode Fuzzy Hash: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
Instruction Fuzzy Hash: 4C0281B0900209AFDB10DFA4DD85AAE7BB5FB44314F10417AF614BA2E1C7799D92CF58

Function 00404722 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404771
SetWindowTextW.USER32(00000000,?), ref: 0040479B
SHBrowseForFolderW.SHELL32(?), ref: 0040484C
CoTaskMemFree.OLE32(00000000), ref: 00404857
lstrcmpiW.KERNEL32(Remove folder: ,00450248,00000000,?,?), ref: 00404889
lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404895
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048A7

Part of subcall function 00405904: GetDlgItemTextW.USER32(?,?,00002000,004048DE), ref: 00405917

Part of subcall function 0040654E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
Part of subcall function 0040654E: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
Part of subcall function 0040654E: CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
Part of subcall function 0040654E: CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

GetDiskFreeSpaceW.KERNEL32(00440218,?,?,0000040F,?,00440218,00440218,?,00000001,00440218,?,?,000003FB,?), ref: 0040496A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404985

Part of subcall function 00404ADE: lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
Part of subcall function 00404ADE: wsprintfW.USER32 ref: 00404B88
Part of subcall function 00404ADE: SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B

Strings

Remove folder: , xrefs: 00404883, 00404888, 00404893
A, xrefs: 00404845

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$Remove folder:
API String ID: 2624150263-1936035403
Opcode ID: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
Instruction ID: aec38ac33e169681c2ce75898e964705c21f391e9d8eef84a8e49708370a7c65
Opcode Fuzzy Hash: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
Instruction Fuzzy Hash: 0CA173B1900208ABDB11AFA5CD45AAF77B8EF84314F10847BF605B62D1D77C99418F6D

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
Instruction ID: 11d43fc069a5ea90b0fea77c2c23c6da8a8dfc92bb9fdb714ff4c9b8b345b962
Opcode Fuzzy Hash: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
Instruction Fuzzy Hash: 9BF08271A14104EFDB00EBA4DA499ADB378EF04314F6045BBF515F21D1DBB45D909B2A

Function 00406B15 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction ID: 703def0becceeecb9d8561ea32c53bcab4b84ebc773a8a1d0b412cad538f794c
Opcode Fuzzy Hash: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction Fuzzy Hash: 1EE1797190470ADFDB24CF99C880BAAB7F5FF44305F15852EE497A7291E378AA91CB04

Function 004072EC Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
Instruction ID: 59779062152899835760f0dc2f5c49596223a290c6efd11eddd93cbc7c663e45
Opcode Fuzzy Hash: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
Instruction Fuzzy Hash: 0FC15831E04219DBDF18CF68C8905EEBBB2BF88314F25866AC85677380D734A942CF95

Function 004043F0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040448E
GetDlgItem.USER32(?,000003E8), ref: 004044A2
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044BF
GetSysColor.USER32(?), ref: 004044D0
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044DE
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044EC
lstrlenW.KERNEL32(?), ref: 004044F1
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044FE
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404513
GetDlgItem.USER32(?,0000040A), ref: 0040456C
SendMessageW.USER32(00000000), ref: 00404573
GetDlgItem.USER32(?,000003E8), ref: 0040459E
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045E1
LoadCursorW.USER32(00000000,00007F02), ref: 004045EF
SetCursor.USER32(00000000), ref: 004045F2
LoadCursorW.USER32(00000000,00007F00), ref: 0040460B
SetCursor.USER32(00000000), ref: 0040460E
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040463D
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464F

Strings

Remove folder: , xrefs: 004045CD
N, xrefs: 0040458C
gC@, xrefs: 004045FA

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$Remove folder: $gC@
API String ID: 3103080414-3559505530
Opcode ID: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
Instruction ID: 3402c350d7270d9961c63d8365249516a5ebc70a9ec23ab72cb453283ebd69b0
Opcode Fuzzy Hash: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
Instruction Fuzzy Hash: 7761BEB1900209BFDB009F60DD85EAA7B69FB85305F00843AF705B62D0D77D9961CF99

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00472EE0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
Instruction ID: 4eb8147a30471c2b969484520d7d1b1c24976f3a1718a772f7b725b3b94c1b26
Opcode Fuzzy Hash: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
Instruction Fuzzy Hash: 5C418A71800249AFCF058FA5DE459AF7BB9FF44314F00842AF991AA1A0C778D954DFA4

Function 00405F06 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004060A1,?,?), ref: 00405F41
GetShortPathNameW.KERNEL32(?,004688E8,00000400), ref: 00405F4A

Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

GetShortPathNameW.KERNEL32(?,004690E8,00000400), ref: 00405F67
wsprintfA.USER32 ref: 00405F85
GetFileSize.KERNEL32(00000000,00000000,004690E8,C0000000,00000004,004690E8,?,?,?,?,?), ref: 00405FC0
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FCF
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406007
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004684E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040605D
GlobalFree.KERNEL32(00000000), ref: 0040606E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406075

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Strings

[Rename], xrefs: 00405FEF, 00406001
%ls=%ls, xrefs: 00405F7B

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
Instruction ID: 1ccef14564d3a4e3590f6d96bf23d62cdd24cd7414a0bd79904b9c13782922cd
Opcode Fuzzy Hash: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
Instruction Fuzzy Hash: 08312530641B05BBC220AB659D48F6B3AACDF45744F15003FFA42F72C2EB7C98118AAD

Function 00405322 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\), ref: 0040538F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\, xrefs: 00405343, 00405353, 00405359, 0040537C, 00405388

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\
API String ID: 2531174081-3917384042
Opcode ID: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
Instruction ID: c4a8b4fbc7344707c8dcd13f789004ac01d88f238d1262f53b2d1dabcf784db2
Opcode Fuzzy Hash: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
Instruction Fuzzy Hash: 1F21A171900518BBCB11AFA5DD849CFBFB9EF45350F10807AF904B62A0C7B94A80DFA8

Function 00404298 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042B5
GetSysColor.USER32(00000000), ref: 004042F3
SetTextColor.GDI32(?,00000000), ref: 004042FF
SetBkMode.GDI32(?,?), ref: 0040430B
GetSysColor.USER32(?), ref: 0040431E
SetBkColor.GDI32(?,?), ref: 0040432E
DeleteObject.GDI32(?), ref: 00404348
CreateBrushIndirect.GDI32(?), ref: 00404352

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: a3c6a1d12b74a4a342abaca89036a15a37f51972f1e3113ed1cbee018e9c0b42
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 772156716007059BC724DF78D948B5B77F4AF81710B04893DED96A26E0D734E544CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E91: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405EA7

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
Instruction ID: 75c70889326ed48cf653b65eedce39ba48716a77e36bbd16e72a3e0392bfe49c
Opcode Fuzzy Hash: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
Instruction Fuzzy Hash: 9C511975D00219AEDF219F95DA88AAEB779FF04304F10443BE901B72D0DBB89982CB58

Function 00404BEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C07
GetMessagePos.USER32 ref: 00404C0F
ScreenToClient.USER32(?,?), ref: 00404C29
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C3B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C61

Strings

f, xrefs: 00404C3D

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: 457ccdd811883e010b73e4973708530e0d9e00004b69c5e73a61d7a3cd07de8f
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: CF015271900218BAEB10DBA4DD85BFEBBBCAF95711F10412BBA50B71D0D7B499018BA4

Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0041E5D0), ref: 00401E3E

Strings

MS Shell Dlg, xrefs: 00401E24

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: MS Shell Dlg
API String ID: 3808545654-76309092
Opcode ID: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
Instruction ID: 2f87ef527a079fcd98b3174ff93e15f92fad6858fb92d4176ae60913c966d855
Opcode Fuzzy Hash: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
Instruction Fuzzy Hash: 1A01B575604240BFE700ABF1AE0ABDD7FB5AB55309F10887DF641B61E2DA7840458B2D

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(05212BF7,00000064,05212BFB), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
Instruction ID: dfd142ddc65d39fdaa73b229a9921dc7c235b7e072e3123d651e00bd55f03bcf
Opcode Fuzzy Hash: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
Instruction Fuzzy Hash: 60014F7164020CABEF209F60DE49FAE3B69AB44304F008439FA06B51E0DBB895558B98

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ff87bf99e36aab27b6384dee017154e4bdeff7ac382f3b09721b2446f84e6f42
Instruction ID: 85d8fb478e53a7d33050a02afe9876517184a336e4e72b82bbd0c3cba42884f9
Opcode Fuzzy Hash: ff87bf99e36aab27b6384dee017154e4bdeff7ac382f3b09721b2446f84e6f42
Instruction Fuzzy Hash: D121AEB1800128BBDF116FA5DE89DDE7E79EF08364F14423AF960762E0CB794C418B98

Function 0040654E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

Strings

*?|<>/":, xrefs: 004065A0

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 36fae6fd7d65e337959ab81909abbfc549fe516cf0b4c9ff473ab524d2c4c229
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: B611B65580061279DB302B14BC40EB762F8EF54764F56403FED86732C8EBBC5C9292AD

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsw53E1.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll,?,?,C:\Users\user\AppData\Local\Temp\nsw53E1.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsw53E1.tmp, xrefs: 004025E1
C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp$C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\StdUtils.dll
API String ID: 3109718747-2542347202
Opcode ID: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
Instruction ID: b23dc685b5da5394ac89c8ab13f2cbf985e24fd8d9932a4f5164fd221fdd45c5
Opcode Fuzzy Hash: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
Instruction Fuzzy Hash: 76110B72A04201BADB146FF18E89A9F76659F44398F204C3FF102F61D1EAFC89415B5D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
Instruction ID: d9fd13ec482603559a9c09f77eb5ae76b99fbdc016b4c624d38ebcad95bf5f4c
Opcode Fuzzy Hash: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
Instruction Fuzzy Hash: 28F0FF72A04518AFDB01DBE4DF88CEEB7BCEB48341B14047AF641F61A0CA749D519B78

Function 00404ADE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
wsprintfW.USER32 ref: 00404B88
SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B

Strings

%u.%u%s%s, xrefs: 00404B69

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
Instruction ID: 65d6ef813479b3ccfd969ec0db039784a4d8c6b5967a53089d3579ec78c560c8
Opcode Fuzzy Hash: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
Instruction Fuzzy Hash: 401193736041282ADB00656D9C45F9E369C9B85334F25423BFA65F21D1E979D82582E8

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
Instruction ID: fc7ade2e12cd9e993d25f9a328d8db16c9603ee1eb20de8c24b8f84b94a82c23
Opcode Fuzzy Hash: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
Instruction Fuzzy Hash: B4116A32500109FBDF02AB90CE09FEE7B7DAF54340F100076B904B51E1E7B59E21AB68

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
Instruction ID: 9c0cd9c85579b1f1539786df4f617efd254904ce91a486f6a135d178cfad0ab8
Opcode Fuzzy Hash: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
Instruction Fuzzy Hash: 7AF05E30485630EBD6506B20FE0CACB7BA5FB84B41B0149BAF005B11E4D7B85880CBDC

Function 00405296 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052C5
CallWindowProcW.USER32(?,?,?,?), ref: 00405316

Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

Strings

, xrefs: 004052A6

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
Instruction ID: 334c9fee3abb3f39d596823d3a3537c7effd0098edc8ca0b3d981ed7cb288a41
Opcode Fuzzy Hash: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
Instruction Fuzzy Hash: F9015A31100709ABEB205F51DD94A9B3B26EB84795F20507AFA007A1D1D7BA9C919E2E

Function 00406188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00004000,00000002,?,00000000,?,?,Remove folder: ,?,?,004063FC,80000002), ref: 004061CE
RegCloseKey.ADVAPI32(?,?,004063FC,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw53E1.tmp\), ref: 004061D9

Strings

Remove folder: , xrefs: 0040618F

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CloseQueryValue
String ID: Remove folder:
API String ID: 3356406503-1958208860
Opcode ID: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
Instruction ID: 8659262355d6ebf2290daf59b07b2549fc881bd87fa0bb5ea6267207f8cb0b09
Opcode Fuzzy Hash: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
Instruction Fuzzy Hash: 68017C72500209EADF218F51DD09EDB3BB8EF55364F01403AFE16A61A1D378DA64EBA4

Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00468250,Error launching installer), ref: 004058CC
CloseHandle.KERNEL32(?), ref: 004058D9

Strings

Error launching installer, xrefs: 004058B6

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
Instruction ID: 30392a530fa928b09b8412afc6dc4f2cd20664ca8a9f97139eafb5a2ce14b88a
Opcode Fuzzy Hash: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
Instruction Fuzzy Hash: 33E09AB5540609BFEB009B64DD05F7B77ACEB04708F508565BD51F2150EB749C148A79

Function 00405D15 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D3D
CharNextA.USER32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

Memory Dump Source

Source File: 00000000.00000002.2053525092.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2053496903.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053555541.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053583717.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2053879328.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Xeno Executor Setup 1.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: cc601e2af81a4130f3690bf6756e9ae730db34a97aa71f580e1783f9e5236296
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 3DF0F631200818FFC7129FA4DD049AFBBA8EF06354B2580BAE840F7211D634DE02AF98

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Xeno Executor Setup 1.0.0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\D3DSCache\30d3a0d8b88cfc9f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

C:\Users\user\AppData\Local\D3DSCache\30d3a0d8b88cfc9f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

C:\Users\user\AppData\Local\D3DSCache\30d3a0d8b88cfc9f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1faa0066-2d54-4257-aef4-f7677ad11763.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9c6dd258-02de-41ac-a63a-27f6152b425c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d66ca4e6-ebdc-472c-b9f3-f57d4727d0cb.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6734690C-1DC4.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\06a34cad-e526-4d2a-ac07-829b2c85cdf0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\24f4476c-a674-46e0-97ee-845645258613.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7aefae36-765a-4e8a-9124-76fe63baf987.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\879978f6-e175-4ed4-b67b-98d1df5f5890.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8efa69d1-ad43-4315-8869-7a6a1bef2b6b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Windows Analysis Report
Xeno Executor Setup 1.0.0.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre