Edit tour

Windows Analysis Report
Account report.docx

Overview

General Information

Sample name:	Account report.docx
Analysis ID:	1535663
MD5:	55e7b34cef7977ed1a2e616cd9112f89
SHA1:	ce06fb6a30f25ce15c212eb55c4201339fe7f3fe
SHA256:	df6b3859719297e9a95675de46ce3cec25829984b73d2c3049d5b20ea3af5f91
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

AI detected landing page (webpage, office document or email)

Contains an external reference to another file

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 180 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 7216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2084,i,2615446868929396096,10562732040043706015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://https.www.secure.kb4.io/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=?cid=284390382" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.5, DestinationIsIpv6: false, DestinationPort: 49719, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 180, Protocol: tcp, SourceIp: 34.251.245.69, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 180, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=

LLM: Score: 9 Reasons: The brand 'LOMBARD' is known and associated with financial services., The URL 'secure.encryptedconnection.net' does not match the legitimate domain for LOMBARD, which is likely 'lombard.com'., The domain 'encryptedconnection.net' is generic and not directly associated with the LOMBARD brand., The presence of 'secure' and 'encryptedconnection' in the URL is a common tactic used in phishing to create a false sense of security., The input fields contain generic security advice, which is unusual for a legitimate brand-specific site. DOM: 1.0.pages.csv

HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49975 version: TLS 1.0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.251.245.69:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:50012 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 1MB later: 92MB

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49975 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	HTTP traffic detected: GET /XOUJPNkVXNEFDSXNvYUpqeXNSR3BNT2ovWHFVU1ZwbTQ1TVo4aElvME1kZ2hqTDFkV2VaVitnbGgrZC9OYjFFVlRNQ0xuWEJtV1FRNXVZTTM4a3cxUVRyQnJkckIweFNXbG11OXhPRisyQjY1UVZ0ck4vTkx1ek5hZUE9PS0tR3R4Ymx5Q293V2cvNXdiVy0tdnZVNk9tTUlRdEZ1SHVUUGpodEh6QT09?cid=284390382 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: https.www.secure.kb4.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x4shzDNpudrZyDn&MD=zAydarpR HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=?cid=284390382 HTTP/1.1Host: https.www.secure.kb4.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0= HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://https.www.secure.kb4.io/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=?cid=284390382Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/lombard/images/logo.svg HTTP/1.1Host: www.lombardins.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /landing_pages/hand_orange_grey.png HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/lombard/images/logo.svg HTTP/1.1Host: www.lombardins.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /landing_pages/hand_orange_grey.png HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /XOUJPNkVXNEFDSXNvYUpqeXNSR3BNT2ovWHFVU1ZwbTQ1TVo4aElvME1kZ2hqTDFkV2VaVitnbGgrZC9OYjFFVlRNQ0xuWEJtV1FRNXVZTTM4a3cxUVRyQnJkckIweFNXbG11OXhPRisyQjY1UVZ0ck4vTkx1ek5hZUE9PS0tR3R4Ymx5Q293V2cvNXdiVy0tdnZVNk9tTUlRdEZ1SHVUUGpodEh6QT09?cid=284390382 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: https.www.secure.kb4.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x4shzDNpudrZyDn&MD=zAydarpR HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: https.www.secure.kb4.io
Source: global traffic	DNS traffic detected: DNS query: secure.encryptedconnection.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.lombardins.com
Source: global traffic	DNS traffic detected: DNS query: helpimg.s3.amazonaws.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: chromecache_273.9.dr	String found in binary or memory: https://helpimg.s3.amazonaws.com/landing_pages/hand_orange_grey.png
Source: ~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	String found in binary or memory: https://https.www.secure.kb4.io/XMDJrbnVFeVhGZXF0NGtpK3JDdFhtL05hVzk2UEltTG5tY0hnb2FoSWxKNHhENU1ybTZ
Source: ~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	String found in binary or memory: https://https.www.secure.kb4.io/XOUJPNkVXNEFDSXNvYUpqeXNSR3BNT2ovWHFVU1ZwbTQ1TVo4aElvME1kZ2hqTDFkV2V
Source: ~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	String found in binary or memory: https://https.www.secure.kb4.io/XSld4SlFqTW10RFByYnBzV0k0SEgzYy8zVld2bzlXMGhNckJ6cDYrQzFTd1Z5WHN6QUZ
Source: ~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	String found in binary or memory: https://https.www.secure.kb4.io/XTkRuSkFRMCtUakxycW45a2ZyT04vcnRxRGlhMUZXZGNtRkxxT1doMGhSZmtPeXU3OU9
Source: ~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	String found in binary or memory: https://https.www.secure.kb4.io/XVWZaNjB5UStaL1gxQmJjREpxNWdNWUQ5dkhwcnNvbnlhakdWZmhHUkpxWGFreCtnTUJ
Source: ~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	String found in binary or memory: https://https.www.secure.kb4.io/XYlVGZ1QzcC9NNWJSbEdiU0RPRGpCS0w2aWtCaEErR2o5L2NMdVpsMC9LSkU3cDgzZ1Z
Source: ~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	String found in binary or memory: https://https.www.secure.kb4.io/XbTJNTTBkdU5LK0g3QmpIQ3MwcXNhODF4OUM1TndLd0Z3MHV2YXNhRm5jdzI2QVoyTUt
Source: ~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	String found in binary or memory: https://https.www.secure.kb4.io/XcElHWW5VQXlva2N2NUxncHZDMFdxRXpoSWh6Y0d3RktkNmU1WnNnbDNoeGRpTldWdFF
Source: App1729147245624804700_BBC3DA36-6ABA-4EB0-8476-24F5493B6EF9.log.0.dr	String found in binary or memory: https://login.windows.net
Source: chromecache_273.9.dr	String found in binary or memory: https://www.lombardins.com/wp-content/themes/lombard/images/logo.svg

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443

Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.251.245.69:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:50012 version: TLS 1.2

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: screenshot	OCR: Enable editing' button in the top yellow bar, and then "Enable content". Or click the below button t
Source: screenshot	OCR: Enable content". Or click the below button to load content in browser View Document Account report'
Source: screenshot	OCR: Enable editing' button in the top yellow bar, and then "Enable content". Or click the below button t
Source: screenshot	OCR: Enable content". Or click the below button to load content in browser View Document Account report'
Source: screenshot	OCR: Enable editing' button in the top yellow bar, and then "Enable content". Or click the below button t
Source: screenshot	OCR: Enable content". Or click the below button to load content in browser View Document 68 words English
Source: screenshot	OCR: Enable editing" button in the top vellcw bar, and then *'Enable content". Or click the below button
Source: screenshot	OCR: Enable content". Or click the below button to Iced content n browser View Document Pleue nate: some
Source: screenshot	OCR: Enable editing" button in the top vellcw bar, and then *'Enable content". Or click the below button
Source: screenshot	OCR: Enable content". Or click the below button to Iced content n browser View Docurnent Pleue nate: som
Source: screenshot	OCR: Enable editing" button in the top vellcw bar, and then *'Enable content". Or click the below button
Source: screenshot	OCR: Enable content". Or click the below button 1,03d content n browser View Docurnent Pleue nate: some

Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true

Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{470FD81D-4272-462C-8AEB-8B260DF79631}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal64.phis.evad.winDOCX@20/261@17/7

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{BBC3DA36-6ABA-4EB0-8476-24F5493B6EF9} - OProcSessId.dat

Jump to behavior

Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0002.tmp.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true

Source: ~WRF{470FD81D-4272-462C-8AEB-8B260DF79631}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{470FD81D-4272-462C-8AEB-8B260DF79631}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{470FD81D-4272-462C-8AEB-8B260DF79631}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2084,i,2615446868929396096,10562732040043706015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://https.www.secure.kb4.io/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=?cid=284390382"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2084,i,2615446868929396096,10562732040043706015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Templates.LNK.0.dr	LNK file: ..\..\Templates
Source: Account report.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\Account report.docx
Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: Element design set.dotx.0.dr

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Office document	LLM: Page contains button: 'View Document' Source: 'Office document'
Source: Office document	LLM: Office document contains prominent button: 'view document'

Contains an external reference to another file

Source: document.xml.rels

Extracted files from sample: https://https.www.secure.kb4.io/xoujpnkvxnefdsxnvyupqexnsr3bnt2ovwhfvu1zwbtq1tvo4aelvme1kz2hqtdfkv2vavitnbggrzc9oyjffvlrnq0xuwejtv1frnxvzttm4a3cxuvryqnjkckiwefnxbg11oxhprisyqjy1uvz0ck4vtkx1ek5hzue9ps0tr3r4ymx5q293v2cvnxdivy0tdnzvnk9ttulrdez1shvuugpodeh6qt09?cid=284390382

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Process Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Account report.docx	6%	Virustotal		Browse

Source	Detection	Scanner	Link
s3-w.us-east-1.amazonaws.com	0%	Virustotal	Browse
landing.eu.knowbe4.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
www.lombardins.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://login.windows.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s3-w.us-east-1.amazonaws.com	52.217.103.156	true	false	0%, Virustotal, Browse	unknown
landing.eu.knowbe4.com	34.251.245.69	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.185.132	true	false	0%, Virustotal, Browse	unknown
www.lombardins.com	104.18.31.107	true	false	0%, Virustotal, Browse	unknown
helpimg.s3.amazonaws.com	unknown	unknown	false		unknown
https.www.secure.kb4.io	unknown	unknown	true		unknown
secure.encryptedconnection.net	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
https://www.lombardins.com/wp-content/themes/lombard/images/logo.svg	false	unknown
https://https.www.secure.kb4.io/XOUJPNkVXNEFDSXNvYUpqeXNSR3BNT2ovWHFVU1ZwbTQ1TVo4aElvME1kZ2hqTDFkV2VaVitnbGgrZC9OYjFFVlRNQ0xuWEJtV1FRNXVZTTM4a3cxUVRyQnJkckIweFNXbG11OXhPRisyQjY1UVZ0ck4vTkx1ek5hZUE9PS0tR3R4Ymx5Q293V2cvNXdiVy0tdnZVNk9tTUlRdEZ1SHVUUGpodEh6QT09?cid=284390382	false	unknown
https://secure.encryptedconnection.net/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png	false	unknown
https://secure.encryptedconnection.net/favicon.ico	false	unknown
https://secure.encryptedconnection.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	false	unknown
https://secure.encryptedconnection.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	false	unknown
https://secure.encryptedconnection.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css	false	unknown
https://helpimg.s3.amazonaws.com/landing_pages/hand_orange_grey.png	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.windows.net	App1729147245624804700_BBC3DA36-6ABA-4EB0-8476-24F5493B6EF9.log.0.dr	false	URL Reputation: safe	unknown
https://https.www.secure.kb4.io/XOUJPNkVXNEFDSXNvYUpqeXNSR3BNT2ovWHFVU1ZwbTQ1TVo4aElvME1kZ2hqTDFkV2V	~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	false		unknown
https://https.www.secure.kb4.io/XYlVGZ1QzcC9NNWJSbEdiU0RPRGpCS0w2aWtCaEErR2o5L2NMdVpsMC9LSkU3cDgzZ1Z	~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	false		unknown
https://https.www.secure.kb4.io/XVWZaNjB5UStaL1gxQmJjREpxNWdNWUQ5dkhwcnNvbnlhakdWZmhHUkpxWGFreCtnTUJ	~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	false		unknown
https://https.www.secure.kb4.io/XMDJrbnVFeVhGZXF0NGtpK3JDdFhtL05hVzk2UEltTG5tY0hnb2FoSWxKNHhENU1ybTZ	~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	false		unknown
https://https.www.secure.kb4.io/XbTJNTTBkdU5LK0g3QmpIQ3MwcXNhODF4OUM1TndLd0Z3MHV2YXNhRm5jdzI2QVoyTUt	~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	false		unknown
https://https.www.secure.kb4.io/XTkRuSkFRMCtUakxycW45a2ZyT04vcnRxRGlhMUZXZGNtRkxxT1doMGhSZmtPeXU3OU9	~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	false		unknown
https://https.www.secure.kb4.io/XSld4SlFqTW10RFByYnBzV0k0SEgzYy8zVld2bzlXMGhNckJ6cDYrQzFTd1Z5WHN6QUZ	~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.251.245.69	landing.eu.knowbe4.com	United States	16509	AMAZON-02US	false
104.18.31.107	www.lombardins.com	United States	13335	CLOUDFLARENETUS	false
3.5.31.150	unknown	United States	14618	AMAZON-AESUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.217.103.156	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1535663
Start date and time:	2024-10-17 08:39:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Account report.docx
Detection:	MAL
Classification:	mal64.phis.evad.winDOCX@20/261@17/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://https.www.secure.kb4.io/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=?cid=284390382 Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.113.194.132, 184.28.90.27, 88.221.110.91, 192.229.221.95, 52.109.32.46, 52.109.32.38, 52.109.32.47, 52.109.32.39, 20.50.201.201, 95.101.111.168, 95.101.111.179, 52.109.89.19, 88.221.110.138, 88.221.110.227, 142.250.185.67, 142.250.184.206, 64.233.184.84, 34.104.35.123, 199.232.210.172, 142.250.185.195, 142.250.186.142
Excluded domains from analysis (whitelisted): binaries.templates.cdn.office.net.edgesuite.net, slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, onedscolprdweu07.westeurope.cloudapp.azure.com, weu-azsc-000.roaming.officeapps.live.com, clientservices.googleapis.com, weu-azsc-config.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, a1847.dscg2.akamai.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, clients2.google.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, update.googleapis.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, clients1.google.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.aka
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Input	Output
URL: Office document Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "To view secured document, click here", "prominent_button_name": "View Document", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Oops! You clicked on a simulated phishing test.", "prominent_button_name": "unknown", "text_input_field_labels": [ "Stop, Look, Think!", "Use that delete key.", "Do I spot a Red Flag?", "Verify suspicious email with the sender via a different medium.", "\"When in doubt, throw it out.\" There are a thousand ways that internet criminals will try to scam you, and only one way to stay safe: Stay alert as YOU are the last line of defense!" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: Office document Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft Office 365" ] }
	```json { "brands": [ "Microsoft Office 365" ] }
URL: https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5 Model: claude-3-haiku-20240307	```json { "brands": [ "LOMBARD" ] }
	```json { "brands": [ "LOMBARD" ] }
URL: https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5 Model: gpt-4o	```json{ "legit_domain": "lombard.com", "classification": "known", "reasons": [ "The brand 'LOMBARD' is known and associated with financial services.", "The URL 'secure.encryptedconnection.net' does not match the legitimate domain for LOMBARD, which is likely 'lombard.com'.", "The domain 'encryptedconnection.net' is generic and not directly associated with the LOMBARD brand.", "The presence of 'secure' and 'encryptedconnection' in the URL is a common tactic used in phishing to create a false sense of security.", "The input fields contain generic security advice, which is unusual for a legitimate brand-specific site." ], "riskscore": 9} Google indexed: False
URL: secure.encryptedconnection.net Brands: LOMBARD Input Fields: Stop, Look, Think!, Use that delete key., Do I spot a Red Flag?, Verify suspicious email with the sender via a different medium., "When in doubt, throw it out." There are a thousand ways that internet criminals will try to scam you, and only one way to stay safe: Stay alert as YOU are the last line of defense!

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	Xfab BENEFIT ENROLLMENT GUIDE 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	ATTN1.html	Get hash	malicious	Unknown	Browse
	https://www.google.co.uk/url?q=2RUDu&rct=2RUDu&sa=t&esrc=2RUDu&source=&cd=2RUDu&uact=&url=amp%2F%63%6F%64%65%76%69%72%6F%2E%63%6F%6D%2F%2E%6A%61%2F#zFqKgE-SUREJACKdm1hbnRocmlwcmFnYWRhQG1vbnRyb3NlLWVudi5jb20=	Get hash	malicious	Unknown	Browse
	http://nndpdnm.3utilities.com/#bd5on/p8la73b/LoiU9/1oQd1tRDE-SUREIDANt92YuMXZpJHZuV3bmxWYi9GbnBUY5hGZhBHc15Cdp1WY	Get hash	malicious	HTMLPhisher	Browse
	fileDoc_Tracey Clerke.docx	Get hash	malicious	Unknown	Browse
	https://www.google.com/aclk?sa=L&ai=DChcSEwiT4_zk8I-JAxV3GaIDHa9sMjMYABAAGgJsZQ&co=1&ase=2&gclid=EAIaIQobChMIk-P85PCPiQMVdxmiAx2vbDIzEAAYASAAEgJo_PD_BwE&sig=AOD64_2yX-61DuN5RlloHZ07RHFcOg00sw&adurl=http://instructionhub.net%3Fgad_source%3D2&ms=%5BCLICK_MS%5D&nx=338&ny=49&nb=41&nis=6	Get hash	malicious	WinSearchAbuse	Browse
	Play_VoiceMsg_daniel.rivera2@adiglobal.com_{RANDOM_NUMBER6}CQDM.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse
	https://information-adsmanager.com/action-needed/	Get hash	malicious	Unknown	Browse
	EUOgPjsBTC.exe	Get hash	malicious	Unknown	Browse
3.5.31.150	http://wavebrowser.co	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s3-w.us-east-1.amazonaws.com	https://bitbucket.org/aaa14/aaaa/downloads/script3.txt	Get hash	malicious	Unknown	Browse	3.5.28.88
	https://bitbucket.org/aaa14/aaaa/downloads/xwormberlyn.txt	Get hash	malicious	Unknown	Browse	52.217.71.204
	https://wav-installers.s3.amazonaws.com/Stubs/WaveBrowser_Stub-v1.5.18.3-wpf.exe	Get hash	malicious	Unknown	Browse	52.217.94.212
	9F5ED45E-EC48-4AD4-BB6D-A04CE331A78D.1_originalmail.eml	Get hash	malicious	HTMLPhisher	Browse	3.5.29.170
	https://url.us.m.mimecastprotect.com/s/rSQeCmZGA2SjZ8YphOhGFR82nT?domain=designrr.page	Get hash	malicious	HTMLPhisher	Browse	3.5.17.61
	https://click.pstmrk.it/3s/tldr.tech%2Fconfirmed%3Femail%3Djames.ward%2540gerflor.com%26newsletter%3Dinfosec/pEGE/grO4AQ/AQ/de2d9b1d-a87c-40b3-97e7-314a53573877/2/GfrX-GFLqn	Get hash	malicious	HTMLPhisher	Browse	52.216.58.33
	70973273827.exe	Get hash	malicious	DBatLoader, FormBook	Browse	52.217.136.153
	Proforma fatura ektedir.exe	Get hash	malicious	DBatLoader, FormBook	Browse	3.5.30.200
	Doc047892345y.exe	Get hash	malicious	DBatLoader, FormBook	Browse	52.216.218.209
landing.eu.knowbe4.com	https://secure.sign-doc.com/XZlgyVC9seUhkblMwMHFCMCszbjY2dmhYVnQ5NGx0UWVvTFBuYWU4UVlPcGFUOUtaeFh4d00zM2tIZGs1RmNteFpYcGhuK3lzNWsybGZoRGxlQVN1Mjh0MUUrQ0pLMlpaTVB3bndnWGx1MnJmOEdicEN1OUg5RkdVd28ybkNCVlF0cnNBMm92czM4TngvdHJNNHdoVUpmSncrWVJiMjlIek5hdkNNT2RqNmtpcXlVbUZNT00vYXZiRUQ1UktpcHUrcmhSVnRRPT0tLWtkeEJ0TE5naDJCR2hxUG8tLW5rTTFGNitWcTh1bU9zampBTlNXNGc9PQ==?cid=261771626	Get hash	malicious	Unknown	Browse	52.19.176.188
	https://x90.im/XNVRKbS9aREZ0N0cxUDZtTU9oaUZvN0xzZjJ1NzRRL0NMQkVXeGZydFh4eEoxREhmeGtiR1YwSE5ON09qSDIyT08wdkZFaGVzYk5uZUxwcWlycGhsU1pseGp6MWhxTW9OTUo3UjBxM0FRcGNNQ1dpR3RkS0F4SGJmYzJEUTFNUG50NXNzSHlNa2xBa3k3SFZHRHFSVml2KzZKeG1ETW1zUFpOZDB4QzZOVThHR1kvRE1UbGZwbzFYbmkxUEtDMk5yRGprbEVnPT0tLVYyaDduNFNEeFppZEpuV0QtLVVRcVdueUFjaml4Y3hlVWNSc1l3Smc9PQ==?cid=258847974&c=E,1,6GecvPlkW74zS5Pzotx8UiTMoQZDoDAKonE47hQsbrjLKJ5MxpZuvx3yBtKZzAuUp4nLjkMCFzKsgpvwlM3viwEfbGL_GGf_G6AB7akQ25BavzQ,&typo=1	Get hash	malicious	Unknown	Browse	34.248.74.196
	http://zoom.voipmessage.uk/XTVNEL3Y5b1J3cmNET2VKbmR6bVRsN3V1NmVOY1NGblBJVC9iTE8rdVgxbTVqY2FOZnZ4TUM0ZlFjRHpCR3RWejFXajBVK2d4TW1YbEM3bTdUSWMzV3hrSEFpYnNQL282UDBDM1E0OVhPS1ZjR1JpSzJpRlZZSGVWc3RkVld1K0ZNM2t1YU5qN0hocjRoMWlOeXBkYzlZUXdMYysyWTZaUWtNVVlSWWVCNG1FTnBPWXc3R2RFWjJSbVNEcEw3clVRbTRHVzNRPT0tLUR6bnh4akFBbEUrU3NKL3YtLXRQbTlZaDQ1Tzd4b0NQSFdzTDA4eWc9PQ==	Get hash	malicious	Unknown	Browse	34.248.74.196
	https://www.sign-doc.com/XNHBmVkl2Nm5FWHNCSFgzUlpNaTRBQ1UrRWNwZU93aTcrK1J6cFBwUGVMTDRqc252ZFFhZHNsMWZieE9PZmN6YUYzVzhqWWI0R1ZheldoS2FuYXFVTkhpd1BldnB4OHcwZGZzUlQ1UE9JSDRXTWtNbjUvQUx3RFBQMVowRjQ4TWZhOS9WV1VzUHlIRnErVWtpR1lKcEdtQy9JTGt2ck1wZHpoLzhVb0owOThrOXZMcXlMMjVNZE5YRCtuRm52U0JTTkNPV0NnPT0tLSs2a0h3RllhaGNPTGs3ZHotLVY4SE1WRkErbUhsZU9lUnJPbjlCT1E9PQ==?cid=242919939	Get hash	malicious	Unknown	Browse	18.202.192.152
	https://secure.sign-doc.com/XK2NFTnJCUjIvZm9sTDhQT25ndXc0WFkvY00wSVJ3b3M3OWFoTEkzNWdGUWRqTTd5MU9BTStJVDE5M2oxVDlJVE5ISDFCZkh2UzFsV0dGMitlVG1adXFFRHZ1cVk2QzBZYlhuZ2w4cjdhbXcxUWFsNmNvdm5EbDIrNUpINHJoMXpiOVI2d2RNS3dEdHN2MitMT0ZpRmtLQ2l2dWlHWDZUK096NndVeTBYN1NPbXlBRW01WkxTWkJGeUJZaEtYbEdndUU3Y2RXaG5FSUVaT0JlaE50VT0tLXF4NnkybUg1Y1BiditaRjQtLUUzVmM0RzltYi8wYktHYklPSHJTd1E9PQ==?cid=247613173	Get hash	malicious	HTMLPhisher	Browse	18.202.192.152
	Account report (1).docx	Get hash	malicious	Unknown	Browse	52.214.160.103
	Account report (1).docx	Get hash	malicious	Unknown	Browse	52.214.160.103
	Account report (1).docx	Get hash	malicious	Unknown	Browse	63.32.231.118
	Account report (1).docx	Get hash	malicious	Unknown	Browse	52.214.160.103
www.lombardins.com	https://www.lombardins.com/lomcms/?action=lostpassword&error=invalidkey	Get hash	malicious	Unknown	Browse	104.22.4.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	cVUjrXVdo9.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	ATTN1.html	Get hash	malicious	Unknown	Browse	104.16.119.9
	QUOTATION.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	https://www.google.co.uk/url?q=2RUDu&rct=2RUDu&sa=t&esrc=2RUDu&source=&cd=2RUDu&uact=&url=amp%2F%63%6F%64%65%76%69%72%6F%2E%63%6F%6D%2F%2E%6A%61%2F#zFqKgE-SUREJACKdm1hbnRocmlwcmFnYWRhQG1vbnRyb3NlLWVudi5jb20=	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	fileDoc_Tracey Clerke.docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	https://www.google.com/aclk?sa=L&ai=DChcSEwiT4_zk8I-JAxV3GaIDHa9sMjMYABAAGgJsZQ&co=1&ase=2&gclid=EAIaIQobChMIk-P85PCPiQMVdxmiAx2vbDIzEAAYASAAEgJo_PD_BwE&sig=AOD64_2yX-61DuN5RlloHZ07RHFcOg00sw&adurl=http://instructionhub.net%3Fgad_source%3D2&ms=%5BCLICK_MS%5D&nx=338&ny=49&nb=41&nis=6	Get hash	malicious	WinSearchAbuse	Browse	188.114.96.3
	Play_VoiceMsg_daniel.rivera2@adiglobal.com_{RANDOM_NUMBER6}CQDM.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.18.6.145
AMAZON-02US	jTEmDCfcVF.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	1uw8VGBYdd.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	jTEmDCfcVF.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	1uw8VGBYdd.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.48
	Xfab BENEFIT ENROLLMENT GUIDE 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	35.76.224.43
	ATTN1.html	Get hash	malicious	Unknown	Browse	18.245.60.69
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	52.222.236.23
	Pago factura_7273390_2024_I_53430000.exe	Get hash	malicious	FormBook, GuLoader	Browse	75.2.103.23
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	52.222.236.23
AMAZON-AESUS	TT-16-10-24.xls	Get hash	malicious	Unknown	Browse	54.173.129.232
	ADVANCE TT.xls	Get hash	malicious	Unknown	Browse	54.173.129.232
	Xfab BENEFIT ENROLLMENT GUIDE 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	52.72.49.79
	ATTN1.html	Get hash	malicious	Unknown	Browse	54.161.63.113
	http://nndpdnm.3utilities.com/#bd5on/p8la73b/LoiU9/1oQd1tRDE-SUREIDANt92YuMXZpJHZuV3bmxWYi9GbnBUY5hGZhBHc15Cdp1WY	Get hash	malicious	HTMLPhisher	Browse	34.199.8.144
	JFX7sO1HHj.elf	Get hash	malicious	Mirai	Browse	54.133.180.12
	JJLOVjVrYv.elf	Get hash	malicious	Mirai, Gafgyt	Browse	54.158.205.9
	https://beforeitsnews.com/health/2024/10/the-happier-meditation-app-is-offering-free-1-year-access-99-value-3059722.html	Get hash	malicious	Unknown	Browse	3.220.143.116
	https://beforeitsnews.com/health/2024/10/the-happier-meditation-app-is-offering-free-1-year-access-99-value-3059722.html	Get hash	malicious	Unknown	Browse	44.196.238.170

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	JimyDeftons.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	https://information-adsmanager.com/action-needed/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://bitbucket.org/aaa14/aaaa/downloads/script3.txt	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://constructionbybricco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWEwRlNjRzQ9JnVpZD1VU0VSMTgwOTIwMjRVMTYwOTE4MjQ=N0123N%5BEMAIL%5D	Get hash	malicious	Mamba2FA	Browse	23.1.237.91
	Project_Proposal_Review_and_Approval13617.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://app-uk.bitdam.com/api/v1.0/links/rewrite_click/?rewrite_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZXdyaXRlX2lkIjoiNjcwZmJkMjNkYmM5Y2E1Yzg5Mjg2YmU4IiwidXJsIjoiIiwib3JnYW5pemF0aW9uX2lkIjozMjk0NH0.MZs_h27RK21gqVMQMHg-xNNair2piCx759dwB_CjSOE&url=http%3A//qlzxg.gersonpradoconsultoria.com.br/4RVmvH17568cHaH1164btackahjyr26892TMVUQPWDJCVKKGA4768TJXD19153E17	Get hash	malicious	Unknown	Browse	23.1.237.91
	Corteconti_reff_88589919543003].htm	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	12721952796-107-0_1.ad_toast.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	Play.VN-_E_CQDM.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	http://downloads.ciscocems.com/downloads/CeDAR/Setup_Cedar%208.05.08.zip	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	Xfab BENEFIT ENROLLMENT GUIDE 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.202.163.200 40.126.31.73 13.107.246.45
	ATTN1.html	Get hash	malicious	Unknown	Browse	172.202.163.200 40.126.31.73 13.107.246.45
	http://nndpdnm.3utilities.com/#bd5on/p8la73b/LoiU9/1oQd1tRDE-SUREIDANt92YuMXZpJHZuV3bmxWYi9GbnBUY5hGZhBHc15Cdp1WY	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 40.126.31.73 13.107.246.45
	fileDoc_Tracey Clerke.docx	Get hash	malicious	Unknown	Browse	172.202.163.200 40.126.31.73 13.107.246.45
	https://www.google.com/aclk?sa=L&ai=DChcSEwiT4_zk8I-JAxV3GaIDHa9sMjMYABAAGgJsZQ&co=1&ase=2&gclid=EAIaIQobChMIk-P85PCPiQMVdxmiAx2vbDIzEAAYASAAEgJo_PD_BwE&sig=AOD64_2yX-61DuN5RlloHZ07RHFcOg00sw&adurl=http://instructionhub.net%3Fgad_source%3D2&ms=%5BCLICK_MS%5D&nx=338&ny=49&nb=41&nis=6	Get hash	malicious	WinSearchAbuse	Browse	172.202.163.200 40.126.31.73 13.107.246.45
	Play_VoiceMsg_daniel.rivera2@adiglobal.com_{RANDOM_NUMBER6}CQDM.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	172.202.163.200 40.126.31.73 13.107.246.45
	https://information-adsmanager.com/action-needed/	Get hash	malicious	Unknown	Browse	172.202.163.200 40.126.31.73 13.107.246.45
	EUOgPjsBTC.exe	Get hash	malicious	Unknown	Browse	172.202.163.200 40.126.31.73 13.107.246.45
	http://iuf89olclwo0fufk.weebly.com	Get hash	malicious	Unknown	Browse	172.202.163.200 40.126.31.73 13.107.246.45
6271f898ce5be7dd52b0fc260d0662b3	(No subject) (87).eml	Get hash	malicious	HTMLPhisher	Browse	34.251.245.69
	H58teR5e2V.doc	Get hash	malicious	Unknown	Browse	34.251.245.69
	bNvjyaZUir.doc	Get hash	malicious	Unknown	Browse	34.251.245.69
	https://wav-installers.s3.amazonaws.com/Stubs/WaveBrowser_Stub-v1.5.18.3-wpf.exe	Get hash	malicious	Unknown	Browse	34.251.245.69
	Contrato_Compra_Factura_Incorrecta.xls	Get hash	malicious	Unknown	Browse	34.251.245.69
	https://forms.zohopublic.com/pharmops1/form/DOCUSIGNREVIEW/formperma/hzyn6gH_uB4k6Kv8lque19zZem5KI3as5uJYGnlnfac	Get hash	malicious	HTMLPhisher	Browse	34.251.245.69
	Contract-476939299.pdf	Get hash	malicious	Unknown	Browse	34.251.245.69
	Play_New_001min 11sec _ ATT20283(David.dekraker).html	Get hash	malicious	HTMLPhisher	Browse	34.251.245.69
	SWIFT COPY..PAYMENT ADVICE.xls	Get hash	malicious	Unknown	Browse	34.251.245.69

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.842761747640621
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxexl9Il8uBlucvU87pbQSGVsx6d1rc:v6YHlxvN1bbr5
MD5:	80D6985501E913078E689E1F1806CCF2
SHA1:	692BA552D7957CAF9027F65CAFA7B701FA178089
SHA-256:	A72F458121F384D59921D6FCEEB380051474514C7AD340BB38758FEB08F8ADC9
SHA-512:	13D6D0F6E611FF797850DC70CE6314628BBE4B70BF3FAD813B2AC1C611B0D7211BB9B20FB22DD5CF45804366204856D76ECFA5B723DADC6B290F16386BE84297
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.N.Z.r.4.m.c.g.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.K.W.D.n.T.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8990659345143577
Encrypted:	false
SSDEEP:	48:uiTrlKxJxn/xl9Il8uB2TlR3eGEH+0J/yUY+MPqUZxO2wE8SFnWizd/vc:mYHqlk+0J/yUY+MU4HF4
MD5:	E0DB6257FFAD7408B5449C8F03502E92
SHA1:	C0F94D0021035D8E495919FE469E3AF97B307202
SHA-256:	D988077C848AF08E53C8819984FE3EE215120AA100763C1BE255D2BC9E8333EB
SHA-512:	788607EFD107A733671628E38CF5A9ED3ACA6CE104524C09E65F27AC60FA71DC6CEDB450E3502328DFF8C555E9D76F4C580AF4B30459C038EBC67F5C6D1D08A9
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Y.D.L.D.+.T.A./.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.K.W.D.n.T.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.9987100991824915
Encrypted:	false
SSDEEP:	96:0YH7Orz/X6G0bwalLHbbIZsvRmCUjJerWEapmbD:0sSeG0Rh7kZwwjsWEaIbD
MD5:	A8EC0DBFDD296D7CE04AC46AFD8E7C5B
SHA1:	BF1A461DECA893AF77840D36F4BF35BF185761D9
SHA-256:	EA584F6586118C5D2E65625BFE7E1AD214AEF7BF28726BC70A0006657C8653A9
SHA-512:	CF1E2EAC4DC969847B7D5C3586F05B58041DB867900045D6F1D478DB0FBBC9E8C4BCCD01F1C9D44C95250BFE9732AADCD48ECEC59F6CAF9AC891D9A5A8B61625
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Q.D.+.k.x.1.8.g.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.K.W.D.n.T.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\72F50284.jpeg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 337x150, components 3
Category:	dropped
Size (bytes):	6217
Entropy (8bit):	7.910953250801019
Encrypted:	false
SSDEEP:	192:bi7WdHL0rhMOzR7SboKrNj59SFtH7I+MyZ:2idL0rttekoNfS3MG
MD5:	711770BAC92B61644F0A0FB4F917DB44
SHA1:	FF697068764E82833C34833ADE1E0866FC790E78
SHA-256:	F7A061901758E6043632DD450C736D218B256A08BE22DDF40DE2C57682A4CED3
SHA-512:	6DE07CD4BB5FBC1C3C8F8C5356ADB0562EC3D215DC5993F08EEDB52AFCC2F1B42C0A6BC50E000D2A6ADF19EA5686B7F4D6CFC2E30225C258424441E9AF834968
Malicious:	false
Preview:	......JFIF.................................................. ( ..&..."1!%)+../..383-8)-.+...........7% "3770573-17327+-0-5.75-.77-7427--82746--2-5-/3--5+-........Q.."........................................P.........................!...1"AQaq.2...#3BRrst.....456CSb...U.....$%.................................................................!4..123AQqr....a................?..Q..........)D..Q."...E6D..R.!...B)D..l.!...E6K .R.!..,..J .Sd..E(..JY.".".E(..........D.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.E.s....~......QS.q.....?..4z.7...T..5.......Y....w.f..eC...o.t....k+.....u...j..........=gS.Y.UL..<.\|...%..m...Q..a..4m.:..k..+..../.t}w..J......>...{.....+8.....=...\....._%.N6....v\.wi.N.xn.v1OP/.....Hx...=y.pH#....V....B.H.H....%.....O....rf6...U.Z>.5k..".....J0..g....kH#..d7..oJ...(..0.r...\.................+g..Y#......!``.q3.k.; a.......c4t.d5...ZQ.rT..t......@.}..l.$.iO.D.X..q....49..tO+.."......F.DT...w......<...../...43..C...{...jv...n..8...2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{470FD81D-4272-462C-8AEB-8B260DF79631}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	1.4218453410673728
Encrypted:	false
SSDEEP:	6:rl912N0xVN+CFQXwRlXw9Xc8lA9Xc8lA9XCw9XWWQklA9XWWQklA9XCw9XCw9XCD:rl3lTpFQmXIcbcbCIXkXkCICICb77
MD5:	B30098EF6ECCFCC880BEA9DC34DAD397
SHA1:	982C46401D126433D2DEEFE650ACC009F1042E51
SHA-256:	B07A86E8EDFE963AF47F901EB2F762B209E8D79176B44F590F0F2CF427F2D0F4
SHA-512:	190C8C1A71E5D6DD216E1ED373E410689A1CD397A125B77D47E570BF2EA287BF3A42FC82A2BB1FB4E6DD67DF7BB627B6A708D0B75136CEE48C6CABF994525C5C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	3.7380838271624666
Encrypted:	false
SSDEEP:	96:6smNUGnGikznuT4Ig6jRDcgO+jaf/oLKMwUaGzKkODmRy1VCrfLutznv8bp1Yg:6smfAzuPvnGfTbDArTupEt1Yg
MD5:	C13343B016227E686E1C27D748BA0312
SHA1:	BBA916C9FC23FE398AAC6F55DBEFB822DDEF6F8B
SHA-256:	BDE3DE3E45E6668ACDCE04C3B5B6664037D546BD0BA09EFB9B8D93D3ABFA9524
SHA-512:	AC3C5DB942C7CCF7A53F0FA1AC81F77D3B56041AC647ACB94DD864DAD7BDDEA19B96365663EB6ECB56C9F9F7A0DB48841EB0D19C50ECD5588BFFEDDED17CA1FB
Malicious:	false
Preview:	.................................. .I.N.C.L.U.D.E.P.I.C.T.U.R.E. .".". .\.*. .M.E.R.G.E.F.O.R.M.A.T. .\.d. ..................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ..."...........t...`...b...d...f...h...j..................................................................................................................................................................................................................................................................................................................................................................................$.a$.gd/(.......$.a$.gdM%P...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F6F2FFCA-8895-4694-BD53-609A6B7CCFDE}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.5303458675998884
Encrypted:	false
SSDEEP:	6:mEMEEEbyD1wK9lCgK0+zwK7zQ7zoozapzkGkAqGLqGetn:4zYP0+zLz2zjzapxPnLni
MD5:	B610850D05A74AC191E9997EC070212F
SHA1:	6EB040C9ADE694436A8085EF902D856EC8D19F74
SHA-256:	92E3CA0477C0483075427A6A5CFD6991F02D8301D51057191D072DBA34E0FBA7
SHA-512:	43636BF99A23B13759D834D3FFA3C2D65358BF4831FA2184B85B2224F53F572B8591D35D064993B77733BD22D4AE05786EDD765C50051DAFEF6F579CF297C8B4
Malicious:	false
Preview:	....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(...a.l.f.o.n.s...a............................................................................................................................................................................................................................................................................................................................................................................................................................................................. ...&...(.......0...6...8...>...@...D...F...J...L...P...R...V...X...\...j...n...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1729147245624804700_BBC3DA36-6ABA-4EB0-8476-24F5493B6EF9.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (10108), with CRLF line terminators
Category:	dropped
Size (bytes):	35368
Entropy (8bit):	5.471916334164248
Encrypted:	false
SSDEEP:	768:KITeyjxn+rD3In8bnzs+ZPXvzTy3qdlcaF+Po5K8UBEqEpsBemyQzwHtxw9aGg0Z:KITeyjxnoDYn8bnzs+JvzTEqdlT+Po5i
MD5:	5931EB431E5EDB23228EE9F3D37A1CC0
SHA1:	BC0CB5AFD5A3ECC7163DD923BA51E81C45754C59
SHA-256:	58A734D7EA156A099BDA15BC16404EE6CE7397312279085799C49E4DFC3A44EC
SHA-512:	96AA795476B7507BFDE39B4892B19697711661E70C61F784DF9493636D0E70E71E8B5858EF3E18A25589DC7511A7DD5DF7E722A39DE7BEE44D4E2C5A17277BA4
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/17/2024 06:40:45.854.WINWORD (0xB4).0x6FC.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-10-17T06:40:45.854Z","Contract":"Office.System.Activity","Activity.CV":"NtrDu7pqsE6EdiT1STtu+Q.7.1","Activity.Duration":406,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...10/17/2024 06:40:45.854.WINWORD (0xB4).0x6FC.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":24,"Time":"2024-10-17T06:40:45.854Z","Contract":"Office.System.Activity","Activity.CV":"NtrDu7pqsE6EdiT1STtu+Q.7","Activity.Duration":3887,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureDiagnos

C:\Users\user\AppData\Local\Temp\TCD8519.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD8519.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCD852B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD852B.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCD853C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD853C.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD8570.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD8570.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD8571.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCD8571.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD8572.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD8572.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD8595.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD8595.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCD85A6.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD85A6.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD85CC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD85CC.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCD85CD.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD85CD.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCD85CE.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD85CE.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCD85DE.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCD85DE.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD85EF.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD85EF.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCD85F0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD85F0.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCD8601.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD8601.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCD8611.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD8611.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCD8641.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD8641.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCD8642.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCD8642.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD8656.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD8656.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCD8667.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD8667.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCD8668.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD8668.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCD867C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD867C.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCD868D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD868D.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCD869D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD869D.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCD86AE.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD86AE.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCD86ED.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD86ED.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCD86EE.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD86EE.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCD86FF.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD86FF.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCD874F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD874F.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCD8760.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD8760.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8781.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD8781.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCD8792.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD8792.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD87C2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD87C2.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCD87E5.tmp\Frame.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD87E5.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8807.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD8807.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8808.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD8808.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD881A.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD881A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD882A.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCD882A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD886A.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD886A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD88DA.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD88DA.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD88FB.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD88FB.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD892B.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCD892B.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD897B.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD897B.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8A2A.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCD8A2A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8A5A.tmp\Circuit.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD8A5A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8AD9.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCD8AD9.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8B29.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD8B29.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8C25.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD8C25.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8CC3.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCD8CC3.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8D53.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD8D53.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8DD1.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCD8DD1.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8F3B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD8F3B.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\TCD8F9A.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD8F9A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\cab84E1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cab84F1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cab84F2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cab84F3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cab84F4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cab8505.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cab8506.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cab8507.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cab8517.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cab8518.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cab852A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cab854C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cab855D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cab855E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cab856F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cab8582.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cab8583.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cab8584.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cab85A5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cab85A7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cab85A8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cab85A9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cab85AA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cab85AB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cab8643.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cab8644.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cab8645.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cab8657.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cab8669.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cab867A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cab867B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cab872F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cab8770.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cab87A2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cab87C3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cab87D4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cab87E6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cab87E7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cab8809.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cab888A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cab88C9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cab88FA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cab894B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cab89F9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cab8A1A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cab8A8A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cab8ADA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cab8BE6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\cab8C65.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cab8CF3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cab8D42.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cab8E7E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\cab8ECD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:fYSj:wS
MD5:	E77A1ECEA5DE23E7715183FB8D1FA248
SHA1:	B1EF2183685E80303F6A2DF8F3F08DE66E8438AA
SHA-256:	E0CCDB4039540BFB60E6AF6B03DFDC3C32D14EDB7DFC27CAFC3A00B4B36BA0C8
SHA-512:	382F30E06C905FEF69C8F6EC32A9055FA7792683CB319B492E92BF66EE3507E8D61224B1CAFB2199B04DF927F83DA47AD3D7CB88C0F9666E7FAEC5BC4A9B4540
Malicious:	false
Preview:	....h=........................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Account report.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Oct 4 13:16:58 2023, mtime=Thu Oct 17 05:40:49 2024, atime=Thu Oct 17 05:40:44 2024, length=32165, window=hide
Category:	dropped
Size (bytes):	541
Entropy (8bit):	4.728498159627838
Encrypted:	false
SSDEEP:	12:8HB4jGsVO4Qd4HZdDjAGBRLoKDPmUdaxpmV:8Hc2d4HZdHAGBRLXfd4pm
MD5:	3A8ADF1D56F782222A07DCB5AA565E5C
SHA1:	446E11EEC203FD2CFEEDA9A90F752C16F2F4F303
SHA-256:	40367F30D7CE130272B4213B91B4E608EA5A534F7A685E12860FF8FD0EFB9716
SHA-512:	26D0755ECCF52291783EDD2809C6E5A201699B1A2B956C694585EAD56A97A77F04D569EE00B2B9E13527EF235229A90B21AD7A7D1E30F5DD475551C3B2F9ED9C
Malicious:	false
Preview:	L..................F.... ...X.o....[[._ .....}_ ...}......................v.t.2..}..QY.5 .ACCOUN~1.DOC..X......DW rQY.5..........................X.'.A.c.c.o.u.n.t. .r.e.p.o.r.t...d.o.c.x.......Z...............-.......Y............F.......C:\Users\user\Desktop\Account report.docx..*.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.A.c.c.o.u.n.t. .r.e.p.o.r.t...d.o.c.x.`.......X.......642294...........hT..CrF.f4... ..~2=.b...,...W..hT..CrF.f4... ..~2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Thu Oct 17 05:40:45 2024, mtime=Thu Oct 17 05:42:02 2024, atime=Thu Oct 17 05:42:02 2024, length=0, window=hide
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	4.6327460435033805
Encrypted:	false
SSDEEP:	12:814MUYGlCECHiqzglRe/8QOYls0/GywJLw9T71XvfQ8dUql4jABHSuT1lilGqNfS:81kEkoVoFoYuOAEuTmioVCqygm
MD5:	DCB48E8F9021B7E3BE2BE254DE134403
SHA1:	17A6ECAA233B9A31AB60939F7C82334B61A198F3
SHA-256:	CA2DB8934F401B36AB5E7EC004764EA620647E7DF649A59307DB91F1C0ED49D1
SHA-512:	D56CE39B68121F307D5C84D1745B59E7C249BB941DD1D6743360F024EC3B5C3B1024553DAC9409C44BA09BA8AD8CD476D6178BAC32B20EF5771937AA6E9515D9
Malicious:	false
Preview:	L..................F..........~_ ......_ ......_ .........................._....P.O. .:i.....+00.../C:\...................x.1.....DW(m..Users.d......OwHQY.5....................:.....NvM.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....T.1.....QY.5..user..>......DWSlQY.5....2.........................a.l.f.o.n.s.....V.1.....DWSl..AppData.@......DWSlQY.5....B.....................Bdg.A.p.p.D.a.t.a.....V.1.....QY.5..Roaming.@......DWSlQY.5....C.........................R.o.a.m.i.n.g.....\.1.....QY.5..MICROS~1..D......DWSlQY.5....D......................H6.M.i.c.r.o.s.o.f.t.....\.1.....QY!5..TEMPLA~1..D......QY.5QY!5..............................T.e.m.p.l.a.t.e.s.......b...............-.......a............F.......C:\Users\user\AppData\Roaming\Microsoft\Templates........\.....\.T.e.m.p.l.a.t.e.s...........................>.e.L.:..er.=....`.......X.......642294...........hT..CrF.f4... ....R....,...W..hT..CrF.f4... ....R....,...W..............1SPS.XF.L8C....&.m.q............

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.630595803157794
Encrypted:	false
SSDEEP:	3:HvsQLRGK9BCm4WKQLRGK9BCpnbJlv:HvxLMKBLLMK4v
MD5:	08D8BF91A8B846AE7E16F82D8029B8D8
SHA1:	007684F2F702808A22CD31686993E5964F1200BA
SHA-256:	490262DDA05A31A67AF4BFDD909B8916A595C81F0077F36C55604E5DD693BCBE
SHA-512:	2474FB7049581789257B6E2E8608254BA95A2A9BF00CB50BF7ECFAAE335207A2F2DD5DD66B68875EF0903BE618C5AF5C9408982F1BA889E5D210ABD0E471AD17
Malicious:	false
Preview:	[misc]..Account report.LNK=0..[folders]..Account report.LNK=0..Templates.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19368
Entropy (8bit):	7.467427866667301
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUC21ifDtqCBUdMkEqc4NdOq6G/9OlPM:VAxllN410IYwNFgM
MD5:	C371909D958E7AFC20BB02284AD5B47B
SHA1:	76B0F25BA0A1903584E257B5D947335C4DF3168C
SHA-256:	2401AFF6EF06C2BDFD2C7C7888CEC2D2CF38E3B77350B15264091FFB6B48C18D
SHA-512:	A5F600C70AB02B99C61187C1A309A02A137E74775F1B38A55E4281443528C532BA5C10848FC6681329176099737AF827102ABC1AA30217E15308139C5A0C6EA7
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	3.5641237646795383
Encrypted:	false
SSDEEP:	3:klt+lllklnl1FS+BOoY34sthGlWl+FUZ/Q+ll/jqiWq/8ln:7tknvuthyWFZNtR10
MD5:	58FE2F55E6A135C5C737BCF75B205330
SHA1:	B0766784E076D0E69B3B4B13489DCC967336B45D
SHA-256:	CCE60C88C14ABB893CE75D185266B6DA63B76A3A2B813E15891D85D1BBF52F3B
SHA-512:	28011EEF3D0414FCE255BC59E02E563F3B15CB9A92F544EC7859971FAABA4AB793AC07F08A02DD6C86287A0122AC5AD1ECE656C78F1DBF71AA9CD2502528CE57
Malicious:	false
Preview:	.user.................................................a.l.f.o.n.s............`I...L.<3..Xz.kM..........i.....`I...L.@D..@.L.p0..p0..M...........p0...`I..3..@D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0002.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19368
Entropy (8bit):	7.467427866667301
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUC21ifDtqCBUdMkEqc4NdOq6G/9OlPM:VAxllN410IYwNFgM
MD5:	C371909D958E7AFC20BB02284AD5B47B
SHA1:	76B0F25BA0A1903584E257B5D947335C4DF3168C
SHA-256:	2401AFF6EF06C2BDFD2C7C7888CEC2D2CF38E3B77350B15264091FFB6B48C18D
SHA-512:	A5F600C70AB02B99C61187C1A309A02A137E74775F1B38A55E4281443528C532BA5C10848FC6681329176099737AF827102ABC1AA30217E15308139C5A0C6EA7
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.836591668108979
Encrypted:	false
SSDEEP:	3:QETlbol9:QEiv
MD5:	5FFBAD261CA1D087BDEA2DAA185561A0
SHA1:	A961E6EBC140F64BC9CBD47EB820DF77764969AB
SHA-256:	2FFE94EBE8D67CD72EE7F1D088DA8AC1B6BA2EBAB80463CC38AC10617ADF933B
SHA-512:	DE56BFA3EF7EB40E7D40CCEC2A99795CEEEB708F7D2E47520A6F82AAC3A72D69F4887BF3C515FB0C0136AF6D04DC90E4CBF4A704E13561EC3171373ABAE1D73A
Malicious:	false
Preview:	..a.l.f.o.n.s.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 17 05:41:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.982101496553648
Encrypted:	false
SSDEEP:	48:8zdvTH3jHridAKZdA19ehwiZUklqehwy+3:8FDpLy
MD5:	4F87E70B75A417A4A1DB0DA270DCCEFB
SHA1:	73A6386FD06086C92E8DC954E900CAC1046C88DF
SHA-256:	9501E4892B91663AB46DBE057D2E512F0B7B895B4D2748A7861DF89155B79399
SHA-512:	9E3C09CCBCB90F1C5735A77776A7864F6A4D16A2B00555D98075748CAD203D9EFBB53FF90A9A2448C056000A73B8C9E11A1D884AAC695CFDB8CEFA2DFCA6C2E9
Malicious:	false
Preview:	L..................F.@.. ...$+.,......._ ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQY.5....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQY)5....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQY)5....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQY)5..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VQY+5...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 17 05:41:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9949386014272092
Encrypted:	false
SSDEEP:	48:8sdvTH3jHridAKZdA1weh/iZUkAQkqeh7y+2:8oD79QSy
MD5:	075FB01E83E06E188ABFE3E448BE25D3
SHA1:	5D39D2D779763B8F304A9400DF4AAD4162AB22CD
SHA-256:	DC820B600643FDB76F9B0ADB718519603C1F6BEC31B03B274098DF9F38A39AC3
SHA-512:	6BA5737A9C3EEE2EA4C7D0932278D68ED7981FF6D207C9E822EF1954C5ED9CFF6628F84BD79C27B36738417779FC4F083F43427C1D4B384AE07E0E166B612D02
Malicious:	false
Preview:	L..................F.@.. ...$+.,....yH._ ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQY.5....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQY)5....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQY)5....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQY)5..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VQY+5...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.01020193645687
Encrypted:	false
SSDEEP:	48:8xOdvTH3sHridAKZdA14tseh7sFiZUkmgqeh7sly+BX:8xyDynXy
MD5:	0C2F82DC756C64C56522552E4789B48A
SHA1:	7EEEB39FA6815C67DC6F7656E9CDF047B1AB9159
SHA-256:	EBA0538DD7FB870AB787EEE7AEB6169A1B32F2E74093210ABE3820A30DEEF1E2
SHA-512:	2AF0917FB236D26BE0D63059138FFA0BE748A58200FAC250D5D3A87F2ECF38F94112E9AE388ADEC9A1F52DB9E946D76E8944DD4BD50FEE333A19B9FD61ACD4D5
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQY.5....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQY)5....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQY)5....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQY)5..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 17 05:41:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.996303746176538
Encrypted:	false
SSDEEP:	48:8IdvTH3jHridAKZdA1vehDiZUkwqehPy+R:88DYdy
MD5:	F1D3D01E0214701E9DAD0428EC4A2D2A
SHA1:	CFB23D00C425CE98D774B40491005226BDF17F25
SHA-256:	64D60AC223B11994DAA5BF3588B67BF126A7F31EF1290E5ECF1C0810CB477966
SHA-512:	AFA6106C17A46E84A4C9531B93D6262F8355F4DCE0A131F43794E8A9BA7A23674CB5CB0B954E4211AA30E462A9FDD3A91A3E4A36060E23261B44A0385DE3DD88
Malicious:	false
Preview:	L..................F.@.. ...$+.,......._ ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQY.5....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQY)5....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQY)5....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQY)5..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VQY+5...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 17 05:41:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.98335855402703
Encrypted:	false
SSDEEP:	48:8qdvTH3jHridAKZdA1hehBiZUk1W1qehRy+C:8mDI9xy
MD5:	BECDD21FE478D7F192FEE91F56E61B18
SHA1:	EA13A4F4BF22068160E472C5994F81C6AF0411D5
SHA-256:	B6DBBD3195433CD27193C299535253516108B914CD323C23A2E9C589154A45EB
SHA-512:	843E029E307E5C5828749D8BED0156DFA2251ABE552F3A178093C47040DCCFDFF06E3F7837C3B4A784D11969F40033F9708B63037E977B0D8E6D03BEF03731C0
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....g._ ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQY.5....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQY)5....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQY)5....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQY)5..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VQY+5...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 17 05:41:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9947129941906807
Encrypted:	false
SSDEEP:	48:83dvTH3jHridAKZdA1duT+ehOuTbbiZUk5OjqehOuTbXy+yT+:8RDmT/TbxWOvTbXy7T
MD5:	F0669231BF796D68F332A66C24289877
SHA1:	7F00D51657492954BE7C9DD51AD8A76D32B0A5C8
SHA-256:	393224FC20B4290F0EAB032CBBFB072B288785D26790AC7158EC53FDC7361237
SHA-512:	AF2A6081249308582A7E5E6E74612E5350737C00834F700744AF39421244DC749FDE467DB9C8C7812ED0205D9BC23D4B7F859BEA109BDA9BD67CD01050ED4EEE
Malicious:	false
Preview:	L..................F.@.. ...$+.,....>..._ ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IQY.5....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VQY)5....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VQY)5....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VQY)5..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VQY+5...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Desktop\Account report.docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	30868
Entropy (8bit):	7.657113757273105
Encrypted:	false
SSDEEP:	768:CvIYNA9e900lMWpswReJdeteScH7dqrS2mKERMF7hN:CQ99eyQMWKwReJ0YScHYrSLRMZ
MD5:	607B93D0C961D754853C1074CD77D476
SHA1:	F75A23AA41CC854F21972A6EDFADA50FD1D37AFD
SHA-256:	45E836D2D056BA5D30B0A22D45CB428D9A86A76CC488A551A5DB0B3F451F0780
SHA-512:	66286BFF03E58FE372058F431863C2CEF7C7D480DFDA01FA6DBD0D54193183D3618805CB851534C2EBFF9D6A65209DA93BFAE4B14F28D7481FFDF07BF7E3185F
Malicious:	false
Preview:	PK..........!.XT..............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................MO.@...&..f...z0.P<.qT.1..Nau..;..{...C....&.....N...niM..1i..v..Y.Nz..`o................g..@.H.R.f...$g`E.}.G..G+.n..!?...U...w..{Xy....J17.=....#..e....`.V.u...D0iG#B0Z..:.rj.....IY.......$T.......3j..HD\|.....G..sK.....N_.ZB...B..R..dM.T..n..C..z.n...v.}H.'.4...D.....,........=..I.....a....(~.........h.[!........%.....n.@.....a.6."..........]....~..7.d}.......l^...........PK..........!.........N......._

C:\Users\user\Desktop\~$count report.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.682258243048203
Encrypted:	false
SSDEEP:	3:klt+lllVWJXnbEDYSIVdCjUrUSErnxhlJP2AV5A:7tMnbEMSISjUA16w5A
MD5:	1869AC5D4A8682980B69CB9F6B2A69CA
SHA1:	D9749C9FEB6A5A95E1C7F0BA2B7A39855DF1ABA2
SHA-256:	61CC9340AFABAE433453817C7EF3DB33D84FF1B5CFFD99E3D2ECFFC9886F123B
SHA-512:	FDB4B27FAE3E52B7FEBAB2FA9B1BCA5C079B4D7A2B3B3086F7430956B8B229C2E3A3881315C0DA3806CA4BC14CFBB7076378D34A0C5712AC5A6FB579EF5DD823
Malicious:	false
Preview:	.user.................................................a.l.f.o.n.s.....8.r.....Ng...7.J..s..w-e...6....qJ:O..q.R.@....s..`G.._ ......r.F..%..}..i.........=.i

C:\Users\user\Desktop\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	30868
Entropy (8bit):	7.657113757273105
Encrypted:	false
SSDEEP:	768:CvIYNA9e900lMWpswReJdeteScH7dqrS2mKERMF7hN:CQ99eyQMWKwReJ0YScHYrSLRMZ
MD5:	607B93D0C961D754853C1074CD77D476
SHA1:	F75A23AA41CC854F21972A6EDFADA50FD1D37AFD
SHA-256:	45E836D2D056BA5D30B0A22D45CB428D9A86A76CC488A551A5DB0B3F451F0780
SHA-512:	66286BFF03E58FE372058F431863C2CEF7C7D480DFDA01FA6DBD0D54193183D3618805CB851534C2EBFF9D6A65209DA93BFAE4B14F28D7481FFDF07BF7E3185F
Malicious:	false
Preview:	PK..........!.XT..............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................MO.@...&..f...z0.P<.qT.1..Nau..;..{...C....&.....N...niM..1i..v..Y.Nz..`o................g..@.H.R.f...$g`E.}.G..G+.n..!?...U...w..{Xy....J17.=....#..e....`.V.u...D0iG#B0Z..:.rj.....IY.......$T.......3j..HD\|.....G..sK.....N_.ZB...B..R..dM.T..n..C..z.n...v.}H.'.4...D.....,........=..I.....a....(~.........h.[!........%.....n.@.....a.6."..........]....~..7.d}.......l^...........PK..........!.........N......._

C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5934
Entropy (8bit):	4.931906350831601
Encrypted:	false
SSDEEP:	96:fiIg+VsCy59sZUAcYLoX9U0JePXOBaxAzi80JeaOV7Fzu/B3qn6dk/nGgje/mPFd:fiP+VbyPsZxcYLot7SXsaCQuu/Nq66/v
MD5:	134D934420B13974981A9634B7380865
SHA1:	18C01D3711CF8C21C1CD0CF544002358C1C929C6
SHA-256:	B3C447F15FCE33DFA869B9D2190364509EDE3937AE05B51BA394A78E28C244BA
SHA-512:	7FAE93AD1895DCF7CC58FC2C477BA51D3EB7D7B2884FE117E21C0A7E0160981EB53D23A6ACDA07DA594AF6984F52E1B57B6F157F84220729C7EEBF9AE062C092
Malicious:	false
URL:	https://secure.encryptedconnection.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css
Preview:	/* line 2, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag {. border-bottom: 2px solid tomato;. padding-left: 3px;.}../ line 6, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag::before {. content: ' ';. display: inline-block;. background: url(/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png) no-repeat;. background-size: contain;. height: 12px;. width: 12px;. margin: 0 .1rem;.}../ line 16, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag[generic='true'] {. display: block;. border-bottom: 0px;.}../ line 21, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag[generic='true']::after {. font-family: "Courier New", Courier, monospace;. line-height: 1.8;. color: #b65555;. font-weight: bold;. content: attr(data-original-title);.}../ line 29, app/assets/stylesheets/sei-styles.scss */.x-sei.sei-flag[generic='true']::before {. content: ' ';. display: inline-block;. background: url(/assets/dark-flag-2846d82c5

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 345 x 391, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35694
Entropy (8bit):	7.975606252058602
Encrypted:	false
SSDEEP:	768:msTjct6pSl8PUiL2jssKSCkGZSblmyQHswJUcahTAe81JY1Z:msm6klqUiLqKHHZWgd2Ge8Ur
MD5:	759B962DFEF168A9309CF0E701C2175A
SHA1:	964D8DE95DA852FB38637CA3F1C521F327010402
SHA-256:	CFE0399D78C9DE0E0E01EE88BAC7CE7E46381927EE46287C23F6490EC437A88F
SHA-512:	21C586B7B7435866A640D7D4CB989533314635A63F9E1B05D233D82AD6BE45C3FE944025BC663A8C7E436DC24483C36120C944F199241DF0DC649F31EE7C59C3
Malicious:	false
Preview:	.PNG........IHDR...Y...........!.....iCCPICC Profile..H....TS....{..-.......H.H.....B.1.@.,..TD."....J..".mQ.X.d.Q....w.Cp....ys...d..g.s..P.8bq...@.(S...A..........<..X.7C......L......4........WQ..3..@!.'.2....@t.+.d......3...0M.$.p....xx..'..&}".<....'s8...d:b.gq.H.2.a+.O(BX..[z.b..G.6A\|..y">#.8...L...p.2..eR.^..q.g..y..[...g.!JN...M..YO........O..7.?..R..i.fx.M3... .6/p...>lY.Lv.4.3..Y.8LvV..5......H.=....M....,a.i.H......%.0Y.\|....>...3~.W...L...../b.......{y..D.......i!2.~........<.3{Cdw.....f... .Q:.....8..L~N.D!...K%BAr&..t....q-g.m.ll......].d.B..[.N.... ......SH.......@...]..J..l....D.=@.j@.y....$3........`..b.B... .H@6...A!(...vP......8...fp.....5p....@/........ ..A....A:.!d..@......0(.J.....By....*...P..+t.:.]....P.4.....(...`-....3`...G..`.......p.\.......5......GQ.EB..tQ.(......C%.$..."T)..U.jEu.n.zQ..h,....-..h?t$..^.^...G.B7.;..}...w....1.8c......).b.1.........,...5.:b......2...nl.......p85.9......2q.....s.[...'<........."\|>.._

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1471
Entropy (8bit):	4.754611179426391
Encrypted:	false
SSDEEP:	24:y40r8CQo40agx40mC400XLaR404hZYmx40vGk40vG/I40vGhH40VhZ40UrCmn:xdDgCFEiBZgnTOHTn
MD5:	15E89F9684B18EC43EE51F8D62A787C3
SHA1:	9CBAAACEAE96845ECD3497F41EE3B02588ABEC11
SHA-256:	16F13E16A7EF02FB6F94250AA1931DED83DBEE5D9FAD278E33DD5792D085194F
SHA-512:	79E0110A045F28437D192290AC9789270CB0D4E676A985564746DB439992D867BA89639D7738E2A7F7D83BBF37D9A02CAA2AE1DC4E0EE2519797E5840A47FABE
Malicious:	false
URL:	https://secure.encryptedconnection.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css
Preview:	/* line 1, app/assets/stylesheets/landing-watermark.scss /..watermark {. -webkit-writing-mode: vertical-rl;. -ms-writing-mode: tb-rl;. writing-mode: vertical-rl;. text-orientation: sideways;.}../ line 4, app/assets/stylesheets/landing-watermark.scss /..watermark.left {. left: 0;.}../ line 7, app/assets/stylesheets/landing-watermark.scss /..watermark.right {. right: 0;.}../ line 10, app/assets/stylesheets/landing-watermark.scss /..watermark.top {. text-align: center;. -webkit-writing-mode: horizontal-tb;. -ms-writing-mode: lr-tb;. writing-mode: horizontal-tb;. top: -38px;.}../ line 15, app/assets/stylesheets/landing-watermark.scss /..watermark h1 {. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. user-select: none;. font-size: 15px;. color: #fdfdfa;. font-weight: bold;.}../ line 24, app/assets/stylesheets/landing-watermark.scss /.#template_sei .watermark.left {. margin-left: -10px;.}../ li

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3168
Entropy (8bit):	7.704911325185365
Encrypted:	false
SSDEEP:	48:37TcgUFv95NwPpK+adjaoVaqzGfYdIO+bExaLM2uO+xVwvpoP:ftUFvdy8dXVaGNdIb1Lz8PwvpY
MD5:	A907E6E737788176B026FA71DFE8AFFE
SHA1:	6844236F638CEDCD652EB0A805476A1A13376CF5
SHA-256:	FC5E7621BA0E98C5C6728E3B2BDF802311C0A0953A05E60A7551CB0C7BED00A9
SHA-512:	3A17E66931A15B5C6553DAE241C5A7BB40240699F0608F92ED940CB203CBEA3031CB0FAC23F9C962F50D573F56DB27A3369F1A38ED1AEA0168D7E707803CA27A
Malicious:	false
Preview:	.PNG........IHDR.............>U....'IDATx..].\...e.!.H..B/J."""R..R....E)"../..".H..3s......&.O....d.QJ.L......P.m.U..u.Q..$.....}.5..M.....{.y.!A...\|.\|...3{.-M....m..~~....0.a...0..`...0........C...!`...0.a...0..<.z......w.tt<X.f..f.O.f./.(QK&s.t.{..z+.T..J..r.....3.....<r..../..Z.}.`..^.gGF6....p%.y^.,.R.....dr.c6/....w_[^........#G.j.7x...?.N.l..k.}...0< a..'.M...XO&g.....to......B..q~.......{....:...^H*QT..m..x.'..K}}.eu.&a........a..{...o..8.".-`Yi.p..zs........l........X-..tt<..=N&...H....&^...eE^M.9...U..gd..D;....gw.xL{.E.1..}}.+Q..U.......x.rO....V.8.,.n.p{...+............m...V.8.\|~``.\.........[.......>s...r......v$.+ctq...B{.A....L...j..T..K...b.V.y.M.Z....7T..8...e-.>...u...&`)..\|...... .....2...d....=:.N.~.....g%..x..5...7..-.l.e.........Y.u..=..l-...s.&.......r.vx.....{..e....).<1S(.\{>j.....+5.....kO...\|"Q-.r.k.I..........]i..!...W..._...=7[.[uo....sk....t[..B.a....\...X......7..\.96...F..]..]...M{.6..!..lv...V..C..p5..q.f

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3168
Entropy (8bit):	7.704911325185365
Encrypted:	false
SSDEEP:	48:37TcgUFv95NwPpK+adjaoVaqzGfYdIO+bExaLM2uO+xVwvpoP:ftUFvdy8dXVaGNdIb1Lz8PwvpY
MD5:	A907E6E737788176B026FA71DFE8AFFE
SHA1:	6844236F638CEDCD652EB0A805476A1A13376CF5
SHA-256:	FC5E7621BA0E98C5C6728E3B2BDF802311C0A0953A05E60A7551CB0C7BED00A9
SHA-512:	3A17E66931A15B5C6553DAE241C5A7BB40240699F0608F92ED940CB203CBEA3031CB0FAC23F9C962F50D573F56DB27A3369F1A38ED1AEA0168D7E707803CA27A
Malicious:	false
URL:	https://secure.encryptedconnection.net/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png
Preview:	.PNG........IHDR.............>U....'IDATx..].\...e.!.H..B/J."""R..R....E)"../..".H..3s......&.O....d.QJ.L......P.m.U..u.Q..$.....}.5..M.....{.y.!A...\|.\|...3{.-M....m..~~....0.a...0..`...0........C...!`...0.a...0..<.z......w.tt<X.f..f.O.f./.(QK&s.t.{..z+.T..J..r.....3.....<r..../..Z.}.`..^.gGF6....p%.y^.,.R.....dr.c6/....w_[^........#G.j.7x...?.N.l..k.}...0< a..'.M...XO&g.....to......B..q~.......{....:...^H*QT..m..x.'..K}}.eu.&a........a..{...o..8.".-`Yi.p..zs........l........X-..tt<..=N&...H....&^...eE^M.9...U..gd..D;....gw.xL{.E.1..}}.+Q..U.......x.rO....V.8.,.n.p{...+............m...V.8.\|~``.\.........[.......>s...r......v$.+ctq...B{.A....L...j..T..K...b.V.y.M.Z....7T..8...e-.>...u...&`)..\|...... .....2...d....=:.N.~.....g%..x..5...7..-.l.e.........Y.u..=..l-...s.&.......r.vx.....{..e....).<1S(.\{>j.....+5.....kO...\|"Q-.r.k.I..........]i..!...W..._...=7[.[uo....sk....t[..B.a....\...X......7..\.96...F..]..]...M{.6..!..lv...V..C..p5..q.f

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2964
Entropy (8bit):	4.472197956204951
Encrypted:	false
SSDEEP:	48:sxx8tbXTkwTCdrDfQ62h/5c1MyP66glJGJZHJ6JYJy5:sKXjQp2ZIMT0XoSk5
MD5:	3BC2B34BE2867B124BE4BECBA6168C2A
SHA1:	D01D559F2CCFB1BA8E10F5F3D3CE2F084226B984
SHA-256:	C3B621010520E3FEF12BCF312188C80C001211B5B6839D7D803C001BAFB46B11
SHA-512:	488AA7FA404E0FE00533780682A25995653B6C55752E7954CBBB0C780C2A04D43B7196EA1E635E99D3ADF38696E5E012454AC23599543E6BAA82ED8C1F9B5218
Malicious:	false
URL:	https://www.lombardins.com/wp-content/themes/lombard/images/logo.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 476.25 110.24"><defs><style>.cls-1{fill:none;}.cls-2{clip-path:url(#clip-path);}.cls-3{fill:#1f1646;}</style><clipPath id="clip-path" transform="translate(0 0)"><rect class="cls-1" width="476.37" height="110.24"/></clipPath></defs><g class="cls-2"><path class="cls-3" d="M211.67,69.27v4.67H186.81V36.25h4.81v33Zm45.69-14.12c-.05,9.34-6,19.4-19,19.4s-19-10.11-19-19.51c0-9.63,5.88-19.35,19-19.35a18.64,18.64,0,0,1,13.57,5.2,19.74,19.74,0,0,1,5.42,14.26m-4.71-.06c0-7.36-4.42-14.79-14.28-14.79a13.94,13.94,0,0,0-10.18,3.84,15.18,15.18,0,0,0-4.06,11c.05,7.15,4.52,14.85,14.24,14.85s14.28-7.7,14.28-14.85m45.19-18.84-12.92,19.9-13.08-19.9H267V73.94h4.82V44.7L284,63.15h2l12-18.42V73.94h4.77V36.25ZM346.4,63.59c0,6.58-5.08,10.35-14,10.35H316.8V36.25h15.64c5.88,0,12.74,2.81,12.74,10.75a8.71,8.71,0,0,1-4.2,7.57,10,10,0,0,1,5.42,9M321.62,40.66V52.38H332.8c5.12,0,7.72-1.81,7.72

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 345 x 391, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35694
Entropy (8bit):	7.975606252058602
Encrypted:	false
SSDEEP:	768:msTjct6pSl8PUiL2jssKSCkGZSblmyQHswJUcahTAe81JY1Z:msm6klqUiLqKHHZWgd2Ge8Ur
MD5:	759B962DFEF168A9309CF0E701C2175A
SHA1:	964D8DE95DA852FB38637CA3F1C521F327010402
SHA-256:	CFE0399D78C9DE0E0E01EE88BAC7CE7E46381927EE46287C23F6490EC437A88F
SHA-512:	21C586B7B7435866A640D7D4CB989533314635A63F9E1B05D233D82AD6BE45C3FE944025BC663A8C7E436DC24483C36120C944F199241DF0DC649F31EE7C59C3
Malicious:	false
URL:	https://helpimg.s3.amazonaws.com/landing_pages/hand_orange_grey.png
Preview:	.PNG........IHDR...Y...........!.....iCCPICC Profile..H....TS....{..-.......H.H.....B.1.@.,..TD."....J..".mQ.X.d.Q....w.Cp....ys...d..g.s..P.8bq...@.(S...A..........<..X.7C......L......4........WQ..3..@!.'.2....@t.+.d......3...0M.$.p....xx..'..&}".<....'s8...d:b.gq.H.2.a+.O(BX..[z.b..G.6A\|..y">#.8...L...p.2..eR.^..q.g..y..[...g.!JN...M..YO........O..7.?..R..i.fx.M3... .6/p...>lY.Lv.4.3..Y.8LvV..5......H.=....M....,a.i.H......%.0Y.\|....>...3~.W...L...../b.......{y..D.......i!2.~........<.3{Cdw.....f... .Q:.....8..L~N.D!...K%BAr&..t....q-g.m.ll......].d.B..[.N.... ......SH.......@...]..J..l....D.=@.j@.y....$3........`..b.B... .H@6...A!(...vP......8...fp.....5p....@/........ ..A....A:.!d..@......0(.J.....By....*...P..+t.:.]....P.4.....(...`-....3`...G..`.......p.\.......5......GQ.EB..tQ.(......C%.$..."T)..U.jEu.n.zQ..h,....-..h?t$..^.^...G.B7.;..}...w....1.8c......).b.1.........,...5.:b......2...nl.......p85.9......2q.....s.[...'<........."\|>.._

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
URL:	https://secure.encryptedconnection.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (492)
Category:	downloaded
Size (bytes):	546
Entropy (8bit):	5.872462839179125
Encrypted:	false
SSDEEP:	12:3R+xnunlwfrczLFvLz3XJ44h4U3HPhtxg9Wm5AmiLOb4AEdeIQL:3EulAcNHXJByU//xeW6AmiqNEkj
MD5:	8098BAEA29F5EB3A98F9679A0F909254
SHA1:	18B3637BAED4476EF7FD70FEF8137DD26C7195E8
SHA-256:	FC1BC9E030466A2444572B5C8263834B6C919ACFB4ABA4A2E8F529245254264B
SHA-512:	47368D8EA67789D26A1DF15BCBDEE44FA2F2D550522BB2D5BC7FBC591797BC71F0AA3F6B443F2EB0031E59B2351F02567AB137AB7AE1C7FA8F467278F2F2A1CB
Malicious:	false
URL:	https://https.www.secure.kb4.io/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=?cid=284390382
Preview:	<html>. <head>. <script>window.location.href = 'https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=';</script>. </head>. <body>. </body>.</html>.

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2964
Entropy (8bit):	4.472197956204951
Encrypted:	false
SSDEEP:	48:sxx8tbXTkwTCdrDfQ62h/5c1MyP66glJGJZHJ6JYJy5:sKXjQp2ZIMT0XoSk5
MD5:	3BC2B34BE2867B124BE4BECBA6168C2A
SHA1:	D01D559F2CCFB1BA8E10F5F3D3CE2F084226B984
SHA-256:	C3B621010520E3FEF12BCF312188C80C001211B5B6839D7D803C001BAFB46B11
SHA-512:	488AA7FA404E0FE00533780682A25995653B6C55752E7954CBBB0C780C2A04D43B7196EA1E635E99D3ADF38696E5E012454AC23599543E6BAA82ED8C1F9B5218
Malicious:	false
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 476.25 110.24"><defs><style>.cls-1{fill:none;}.cls-2{clip-path:url(#clip-path);}.cls-3{fill:#1f1646;}</style><clipPath id="clip-path" transform="translate(0 0)"><rect class="cls-1" width="476.37" height="110.24"/></clipPath></defs><g class="cls-2"><path class="cls-3" d="M211.67,69.27v4.67H186.81V36.25h4.81v33Zm45.69-14.12c-.05,9.34-6,19.4-19,19.4s-19-10.11-19-19.51c0-9.63,5.88-19.35,19-19.35a18.64,18.64,0,0,1,13.57,5.2,19.74,19.74,0,0,1,5.42,14.26m-4.71-.06c0-7.36-4.42-14.79-14.28-14.79a13.94,13.94,0,0,0-10.18,3.84,15.18,15.18,0,0,0-4.06,11c.05,7.15,4.52,14.85,14.24,14.85s14.28-7.7,14.28-14.85m45.19-18.84-12.92,19.9-13.08-19.9H267V73.94h4.82V44.7L284,63.15h2l12-18.42V73.94h4.77V36.25ZM346.4,63.59c0,6.58-5.08,10.35-14,10.35H316.8V36.25h15.64c5.88,0,12.74,2.81,12.74,10.75a8.71,8.71,0,0,1-4.2,7.57,10,10,0,0,1,5.42,9M321.62,40.66V52.38H332.8c5.12,0,7.72-1.81,7.72

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (511), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	7035
Entropy (8bit):	5.272626627312589
Encrypted:	false
SSDEEP:	96:O4/OzEDaP2sdV/k/xMVFzUTpTAFH1FhdJ4ts1MKFTLLObvzCzwDS8K0YVVsEq:ObzAsUMVFGvCMKpOb6weD9q
MD5:	A580281D670D243A12FCBFAD31E9F654
SHA1:	1CCB33C7624363A99B8B66889CF3A8E0AEA23A88
SHA-256:	D6653E397DC9EB02C920D151EB1FD5D958C5D493DBCC4164CEF4BF85CE02DBB3
SHA-512:	DB8D9D92E59E5F340A18C94B3E8642C86277FC193B38EC033EF3D6D2E5F4907C66FF8A7DB733DC8C4AE9EF29A13C037E48024891EE7746A7F23408AAF34F200A
Malicious:	false
URL:	https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN". "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">. <meta name="IMPORTANT" content="This page is part of a simulated phishing attack initiated by KnowBe4 on behalf of its customers." />. <meta name="IMPORTANT" content="If you have any questions please contact support@knowbe4.com." />. <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"/>. <meta name="robots" content="noindex, nofollow" />.. <head>. <script src="/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js"></script>.. <link rel="stylesheet" href="/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css" media="all" />. <link rel="stylesheet" href="/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css" media="all" />.. <script>.//<![CDATA[.. $(document).ready(function() {.

Static File Info

General

File type:	Microsoft OOXML
Entropy (8bit):	7.943907933785021
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	Account report.docx
File size:	32'165 bytes
MD5:	55e7b34cef7977ed1a2e616cd9112f89
SHA1:	ce06fb6a30f25ce15c212eb55c4201339fe7f3fe
SHA256:	df6b3859719297e9a95675de46ce3cec25829984b73d2c3049d5b20ea3af5f91
SHA512:	4fa3543ec1dc648659d9aad13b7dc0bfec107ac0c45c9e21e458e1e0be4e5f1006fe0a48501694346453a323d97be035da4395a2ffb0d63942b22c6ddad7fdef
SSDEEP:	768:iCZ5qG56vNFzSD2bANX4rnH4T9kYAprfIWhD5Se:X5d6lA6ANX4rH49JcfXhD5n
TLSH:	50E2DF38FE4E9532D48792BE62BC2390F40AF607548D319E3F5AB7C069569D17A32E84
File Content Preview:	PK........JQPY................[Content_Types].xml..MO.0...+.."_Q..J...).>........../.S..~.I...&.D\.3..>....N..).!&.]...)+.I..[T.....7+.........N..?f7... .K.[".?.'..+R..8..>Z....<.. ....._\z..p....ggP.......nI..,Xq.6...i.......`.....h).....7d..UI..'-uH..

File Icon


Icon Hash:	35e5c48caa8a8599

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 08:40:47.879612923 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:40:47.879615068 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:40:48.004628897 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:40:49.770910025 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 17, 2024 08:40:49.771115065 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:40:52.568983078 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:52.569104910 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:52.569459915 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:52.571492910 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:52.571540117 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:53.643171072 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:53.643269062 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:54.557320118 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:54.557358980 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:54.557697058 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:54.559571028 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:54.559614897 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:54.559669971 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:54.931633949 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:54.989029884 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:54.989078999 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:55.035886049 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:55.039824963 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:55.039891958 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:55.039988041 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:55.199208021 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:55.199290037 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:55.199323893 CEST	49713	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:55.199342012 CEST	443	49713	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:55.248533010 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:55.248595953 CEST	443	49717	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:55.248683929 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:55.249376059 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:55.249396086 CEST	443	49717	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:55.298459053 CEST	49718	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:55.298508883 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:55.298584938 CEST	49718	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:55.298969030 CEST	49718	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:55.298984051 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:55.553767920 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:55.553816080 CEST	443	49719	34.251.245.69	192.168.2.5
Oct 17, 2024 08:40:55.553894997 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:55.554439068 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:55.554454088 CEST	443	49719	34.251.245.69	192.168.2.5
Oct 17, 2024 08:40:56.319480896 CEST	443	49717	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.319607019 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.329761982 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.329781055 CEST	443	49717	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.330002069 CEST	443	49717	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.330419064 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.330463886 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.330482006 CEST	443	49717	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.359242916 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.359769106 CEST	49718	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.359798908 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.360409975 CEST	49718	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.360416889 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.360500097 CEST	49718	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.360512972 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.648014069 CEST	443	49719	34.251.245.69	192.168.2.5
Oct 17, 2024 08:40:56.648156881 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:56.652096033 CEST	443	49717	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.654360056 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:56.654376030 CEST	443	49719	34.251.245.69	192.168.2.5
Oct 17, 2024 08:40:56.654707909 CEST	443	49719	34.251.245.69	192.168.2.5
Oct 17, 2024 08:40:56.654776096 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:56.656605959 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:56.703412056 CEST	443	49719	34.251.245.69	192.168.2.5
Oct 17, 2024 08:40:56.707756042 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.707801104 CEST	443	49717	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.708014011 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.708089113 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.708270073 CEST	443	49717	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.708301067 CEST	443	49717	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:56.708369017 CEST	49717	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:56.754514933 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:56.754547119 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:56.754633904 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:56.754899979 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:56.754909992 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:57.007515907 CEST	443	49719	34.251.245.69	192.168.2.5
Oct 17, 2024 08:40:57.007595062 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:57.007625103 CEST	443	49719	34.251.245.69	192.168.2.5
Oct 17, 2024 08:40:57.007673979 CEST	443	49719	34.251.245.69	192.168.2.5
Oct 17, 2024 08:40:57.007679939 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:57.007726908 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:57.007760048 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:57.007776022 CEST	443	49719	34.251.245.69	192.168.2.5
Oct 17, 2024 08:40:57.007792950 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:57.007818937 CEST	49719	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:40:58.119673967 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:58.119707108 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:58.119729042 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:58.119823933 CEST	49718	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:58.119859934 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:58.119880915 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:58.119930983 CEST	49718	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:58.120465040 CEST	49718	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:58.120484114 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:58.120496035 CEST	49718	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:58.120502949 CEST	443	49718	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:58.231333971 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:58.231378078 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:58.231466055 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:58.231623888 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:58.231636047 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:58.436609983 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:58.436669111 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:58.436743975 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:58.442291021 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:58.442327023 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:58.510898113 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.510966063 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.513226986 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.513232946 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.513434887 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.526513100 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.571415901 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.754364014 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.754388094 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.754430056 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.754520893 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.754537106 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.754614115 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.772006989 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.772032022 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.772119045 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.772131920 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.772172928 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.870951891 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.870976925 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.871185064 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.871203899 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.871253967 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.889157057 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.889170885 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.889262915 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.889267921 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.889843941 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.891608953 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.891622066 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.897945881 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.897953033 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.898001909 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.987359047 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.987387896 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.987771034 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.987783909 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.987848997 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.988058090 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.988073111 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.988128901 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:58.988132954 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:58.988176107 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.005321980 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.005363941 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.005417109 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.005431890 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.005454063 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.005477905 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.006299019 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.006313086 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.006382942 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.006386995 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.006438971 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.007888079 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.007900000 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.008018017 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.008023024 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.008080959 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.008812904 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.008826017 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.008888006 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.008892059 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.008939028 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.009843111 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.009855986 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.009921074 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.009923935 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.009972095 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.011502981 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.011516094 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.011593103 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.011596918 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.011645079 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.104470968 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.104566097 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.104588032 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.104607105 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.104649067 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.104676962 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.104715109 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.104727983 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.104739904 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.104743958 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.155189037 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.155251980 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.155323982 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.155355930 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.155400038 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.155615091 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.155630112 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.155646086 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.156327009 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.156342983 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.156935930 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.156975031 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.157040119 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.157140017 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.157150030 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.158159971 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.158205032 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.158822060 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.158822060 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.158833027 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.158922911 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.158936024 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.158946037 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.159035921 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.159045935 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.245193958 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.245270014 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.247014999 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.247025013 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.247360945 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.289911985 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:59.301525116 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.301848888 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:59.301883936 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:59.304579020 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:59.304588079 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:59.304640055 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:40:59.304646969 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:40:59.323934078 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.367404938 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.575453997 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.575479984 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.575486898 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.575522900 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.575546026 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.575561047 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.575562954 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.575594902 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.575611115 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.575622082 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.575645924 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.576206923 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.576280117 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.576287985 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.576428890 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.576476097 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.585977077 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.585998058 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.586011887 CEST	49724	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:40:59.586019039 CEST	443	49724	172.202.163.200	192.168.2.5
Oct 17, 2024 08:40:59.878921986 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.879472971 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.879498959 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.880117893 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.880122900 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.889961958 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.890896082 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.896765947 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.900087118 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.900093079 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.900122881 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.900124073 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.900585890 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.900594950 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.900681019 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.900712013 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.901030064 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.901035070 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.901170015 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.901176929 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.904241085 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.904548883 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.904566050 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 17, 2024 08:40:59.905069113 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:40:59.905076027 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.008111954 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.008308887 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.008367062 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.008882046 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.008905888 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.008919001 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.008924007 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.012527943 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.012622118 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.012711048 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.012943983 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.012980938 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.024243116 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.024267912 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.024318933 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.024327993 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.024380922 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.024518967 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.024532080 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.024548054 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.024553061 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.026971102 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.026993990 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.027043104 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.027048111 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.027065039 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.027087927 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.027134895 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.027137995 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.027144909 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.027187109 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.027863979 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.027899981 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.027904034 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.027923107 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.027935028 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.027940035 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.027965069 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.028232098 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.028243065 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.028959036 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.028959036 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.028981924 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.028995991 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.031872988 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.031900883 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.032005072 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.032385111 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.032399893 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.032531977 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.032542944 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.032604933 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.032756090 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.032767057 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.040352106 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.040534973 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.040581942 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.040740013 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.040752888 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.040765047 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.040771008 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.043050051 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.043065071 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.043242931 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.043519020 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.043531895 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.754214048 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.755373955 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.755403996 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.756067038 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.756071091 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.764703035 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.765142918 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.765331030 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.765367031 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.765480995 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.765490055 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.765894890 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.765902042 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.766191006 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.766196012 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.772798061 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.773122072 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.773139954 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.773557901 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.773565054 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.786134005 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.786317110 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:00.786350965 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:00.786385059 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:00.786417961 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:00.786444902 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:00.786659002 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:00.787050962 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.787061930 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.787894964 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.787903070 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.789330959 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:00.789350033 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:00.789555073 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:00.789556980 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:00.789604902 CEST	443	49723	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:00.789747953 CEST	49723	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:00.884638071 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.885359049 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.885488033 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.885571003 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.885595083 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.885612011 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.885618925 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.893261909 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.893501043 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.894956112 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.895273924 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.896267891 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.896354914 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.897119999 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.897140980 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.897353888 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.897360086 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.897746086 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.897749901 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.897778034 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.897782087 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.900182962 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:00.900227070 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:00.900486946 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:00.901361942 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.901361942 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.901401997 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.901416063 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.901524067 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:00.901540041 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:00.901561022 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.901714087 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.901714087 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.901727915 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.902261972 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.902268887 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.902650118 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.902698994 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.903516054 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.903589964 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.903656960 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.903738022 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.903758049 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.903759003 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.903975010 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.903975010 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.903990984 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.904000044 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.906719923 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.906738043 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.906827927 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.906984091 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.906992912 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.918162107 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.918317080 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.918423891 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.918497086 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.918497086 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.918509960 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.918519974 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.921329021 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.921386957 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:00.921494961 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.921617985 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:00.921631098 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.624890089 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.625510931 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.625544071 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.626082897 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.626090050 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.639434099 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.639954090 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.639985085 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.640403986 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.640414000 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.642369032 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.642776012 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.642792940 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.643395901 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.643402100 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.648444891 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.648919106 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.648945093 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.649626017 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.649631977 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.651680946 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.652240038 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.652266026 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.652932882 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.652944088 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.751408100 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.751571894 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.751632929 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.751873016 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.751893044 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.751903057 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.751908064 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.755604982 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.755659103 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.755729914 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.755947113 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.755959988 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.766484976 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.766537905 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.766669035 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.766716957 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.766733885 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.766746998 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.766752958 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.769138098 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.769159079 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.769227028 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.769365072 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.769375086 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.780088902 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.780186892 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.780240059 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.780258894 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.780407906 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.780425072 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.780435085 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.780440092 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.780517101 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.780787945 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.780913115 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.780924082 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.780932903 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.780936956 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.782692909 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.782722950 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.782727003 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.782752037 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.782816887 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.782820940 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.782953978 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.782962084 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.782995939 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.783010006 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.783715963 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.783783913 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.783874035 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.783895016 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.783902884 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.783914089 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.783916950 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.786007881 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.786015987 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:01.786082983 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.786304951 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:01.786312103 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.063723087 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.064438105 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.064475060 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.067442894 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.067451000 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.067482948 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.067492008 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.490920067 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.492178917 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.492222071 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.493741989 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.493748903 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.506648064 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.507189989 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.507216930 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.508518934 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.508534908 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.519371033 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.519475937 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.519517899 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.519558907 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.519581079 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.519607067 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.519977093 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.519995928 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.520004034 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.520158052 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.520198107 CEST	443	49736	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.520271063 CEST	49736	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.520853043 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.521687984 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.521703959 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.522566080 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.522576094 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.525777102 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.526632071 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.526643991 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.527328014 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.527332067 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.530278921 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.530713081 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.530725956 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.531306982 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.531311035 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.581372023 CEST	49747	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.581443071 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.581521988 CEST	49747	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.581753016 CEST	49747	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:02.581769943 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:02.618347883 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.618540049 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.618849993 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.618968010 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.619020939 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.619051933 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.619067907 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.622221947 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.622286081 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.622395992 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.622658014 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.622675896 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.652446032 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.652529955 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.652627945 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.653009892 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.653029919 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.653043985 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.653049946 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.654896975 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.654989958 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.655483007 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.655528069 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.655546904 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.655561924 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.655567884 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.655843973 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.656076908 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.656167030 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.656284094 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.656302929 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.656316042 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.656322002 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.656970024 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.657078028 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.657207966 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.657336950 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.657360077 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.658533096 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.658690929 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.658704996 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.658725977 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.658777952 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.658859015 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.658965111 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.658982992 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.659022093 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.659034014 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.659065008 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.659070015 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.659435034 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.659511089 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.659610987 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.659701109 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.659728050 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.662117958 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.662163019 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:02.662257910 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.662473917 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:02.662488937 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.363923073 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.365061045 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.365088940 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.365504026 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.365506887 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.392332077 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.393142939 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.393172026 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.393516064 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.393524885 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.395570040 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.395931005 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.395962000 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.396276951 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.396289110 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.405333042 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.405669928 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.405684948 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.405993938 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.406001091 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.412846088 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.413230896 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.413250923 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.413671970 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.413678885 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.492886066 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.492958069 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.496808052 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.496808052 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.496808052 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.496819973 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.496927977 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.497049093 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.497325897 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.497360945 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.521327019 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.521449089 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.521702051 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.522121906 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.522144079 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.522156000 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.522162914 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.527379990 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.527435064 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.527487040 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.527551889 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.527564049 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.527616024 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.532232046 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.532263041 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.532402992 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.532402992 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.532438993 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.532454014 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.534908056 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.534948111 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.535101891 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.535368919 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.535377979 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.538762093 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.538852930 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.539005041 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.539179087 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.539197922 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.539208889 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.539215088 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.542546034 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.542553902 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.542637110 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.542798996 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.542805910 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.545459032 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.545705080 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.545759916 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.545967102 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.545981884 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.546000004 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.546005964 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.548852921 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.548893929 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.548959970 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.549240112 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.549248934 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.630156040 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.630702019 CEST	49747	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.630723000 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.632138014 CEST	49747	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.632150888 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.632287025 CEST	49747	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.632297039 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.801505089 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:03.801546097 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:03.946854115 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.946878910 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.946975946 CEST	49747	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.946993113 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.947455883 CEST	49747	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.947468042 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.947479010 CEST	49747	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.947603941 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.947630882 CEST	443	49747	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.947680950 CEST	49747	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.976788998 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.976849079 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.976931095 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.977185011 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.977202892 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.979665995 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.979707956 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:03.979778051 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.979942083 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:03.979954004 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:04.246267080 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.247056961 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.247123003 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.247652054 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.247678041 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.259516001 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.260257006 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.260282993 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.261130095 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.261140108 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.270375967 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.271068096 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.271087885 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.271580935 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.271585941 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.274425983 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.275672913 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.275681019 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.276098013 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.276102066 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.376327038 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.376425982 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.376502037 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.376693010 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.376712084 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.376725912 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.376733065 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.379472971 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.379501104 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.379594088 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.379781961 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.379792929 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.387720108 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.387866020 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.387938023 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.387980938 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.387993097 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.388004065 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.388009071 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.390441895 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.390469074 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.390562057 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.390711069 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.390721083 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.399588108 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.399647951 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.399688005 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.399801016 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.399816990 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.399828911 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.399832964 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.402035952 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.402066946 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.402122021 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.402267933 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.402278900 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.405904055 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.406021118 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.406095028 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.406148911 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.406161070 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.406186104 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.406189919 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.408201933 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.408216000 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.408292055 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.408417940 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.408426046 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.872992992 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.873470068 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.873483896 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:04.874154091 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:04.874159098 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.004981041 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.005108118 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.005181074 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.005352020 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.005367041 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.005376101 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.005381107 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.008378029 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.008414984 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.008518934 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.008701086 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.008713961 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.041861057 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.042489052 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.042562008 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.043180943 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.043210030 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.043256998 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.043281078 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.044610023 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.044707060 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.046411037 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.046433926 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.047256947 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.047625065 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.047672033 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.047703028 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.113303900 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.114162922 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.114204884 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.114666939 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.114671946 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.126167059 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.126658916 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.126688957 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.127015114 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.127027035 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.134711981 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.135101080 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.135180950 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.135417938 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.135433912 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.144078016 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.144654989 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.144681931 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.145056009 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.145080090 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.241796970 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.241925955 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.241997957 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.242207050 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.242228985 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.242239952 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.242244959 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.255558968 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.255625963 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.255709887 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.255857944 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.255887985 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.258066893 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.258266926 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.258402109 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.258438110 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.258455992 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.258466959 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.258471966 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.260746002 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.260787010 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.260852098 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.260987043 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.260996103 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.271625042 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.271697998 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.271863937 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.271945000 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.271977901 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.272006035 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.272034883 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.274733067 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.274795055 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.274913073 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.275074005 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.275100946 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.283142090 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.283229113 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.283468008 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.283550978 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.283550978 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.283596039 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.283628941 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.286407948 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.286497116 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.286601067 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.286767006 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.286801100 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.365025997 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.365084887 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.365457058 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.365490913 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.365602016 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.365624905 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.365931034 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.366014004 CEST	443	49760	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.366081953 CEST	49760	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.585247993 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.585308075 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.585407019 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.585424900 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.585441113 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.585449934 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.629595995 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.692684889 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.692822933 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.692871094 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.737149000 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.764520884 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.764520884 CEST	49761	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:05.764549971 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.764564037 CEST	443	49761	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:05.785842896 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.867897987 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.867902994 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.868756056 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.868760109 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.986191034 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.993271112 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.993364096 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:05.993453026 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:05.995423079 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.015983105 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.026778936 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.035857916 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.035872936 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.042710066 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.042778015 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.043143034 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.043157101 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.043543100 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.043555975 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.044258118 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.044274092 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.048033953 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.048058987 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.048074007 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.048080921 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.049552917 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.049566984 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.049952030 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.049963951 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.067106009 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.113327980 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.113327980 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.113343000 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.113377094 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.168725967 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.168768883 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.168952942 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.169966936 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.170043945 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.170656919 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.171598911 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.171830893 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.171894073 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.181077003 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.181149960 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.181216002 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.181941986 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.181952953 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.182271957 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.182286024 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.182312012 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.182317972 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.186819077 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.186826944 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.186845064 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.186849117 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.210725069 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.210776091 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.210803986 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.210817099 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.243252993 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.243520975 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.243598938 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.260343075 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.260400057 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.260535002 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.341897964 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.341897964 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.341953993 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.341981888 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.344239950 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.344269991 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.363945961 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.363996983 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.364137888 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.365478992 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.365523100 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.365685940 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.382297039 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.382297993 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.382307053 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.382337093 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.382493973 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.382524014 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.382531881 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.415338993 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.415374041 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.505407095 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:06.505429029 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:06.505785942 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:06.520181894 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:06.520194054 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:06.949079990 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.955918074 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.955929995 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:06.956059933 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:06.956065893 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.082252026 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.082319975 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.082483053 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.084969044 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.084969997 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.084985971 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.084994078 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.086453915 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.088782072 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.088812113 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.088995934 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.089008093 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.089037895 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.089610100 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.089610100 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.089613914 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.089622021 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.144233942 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.146022081 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.146022081 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.146034956 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.146045923 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.148226023 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.148592949 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.148616076 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.149019957 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.149030924 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.169312000 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.169687986 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.169701099 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.170106888 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.170114040 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.219084024 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.219135046 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.219255924 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.219460964 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.219472885 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.219481945 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.219487906 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.222327948 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.222357988 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.222932100 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.222932100 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.222975969 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.275825024 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.276052952 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.277302980 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.277396917 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.277396917 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.277415991 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.277426004 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.280786037 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.280821085 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.281856060 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.281959057 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.282040119 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.282041073 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.282314062 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.282321930 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.282325029 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.282330990 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.282351017 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.282355070 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.284687996 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.284730911 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.284898996 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.285082102 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.285094023 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.512193918 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.512263060 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.513983011 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.514177084 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.514192104 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.514214039 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.514219999 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.520904064 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.520935059 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.520998001 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.521367073 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.521384954 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.602652073 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.604271889 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:07.604290009 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.605508089 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:07.605513096 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.605546951 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:07.605556011 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.932362080 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.932382107 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.932420969 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.932452917 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:07.932459116 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.932528973 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:07.933649063 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:07.933649063 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:07.933661938 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.933872938 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.933907032 CEST	443	49829	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:07.933959961 CEST	49829	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:07.942481995 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.944668055 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.944668055 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.944691896 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.944706917 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.956283092 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.965801001 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.965801001 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:07.965815067 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:07.965851068 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.009937048 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.030335903 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.043065071 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.043092012 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.045397043 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.045416117 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.046596050 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.046597004 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.046621084 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.046632051 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.090631008 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.090734005 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.090821028 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.091579914 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.091579914 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.091598988 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.091609001 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.106964111 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.107151985 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.107345104 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.110347033 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.110388041 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.110441923 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.110543966 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.110567093 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.110593081 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.110600948 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.135546923 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.135574102 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.139686108 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.139777899 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.139859915 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.140446901 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.140475988 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.172316074 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.172406912 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.172555923 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.176953077 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.177241087 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.177297115 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.182054996 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.182087898 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.182106972 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.182113886 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.187223911 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.187223911 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.187246084 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.187254906 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.199951887 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.200026035 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.200411081 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.204936981 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.204978943 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.214835882 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.214867115 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.214936018 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.215069056 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.215080023 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.260920048 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.287374020 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.287422895 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.287854910 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.287859917 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.418802023 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.419214010 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.419290066 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.502074003 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.502109051 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.502125025 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.502131939 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.515472889 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.515515089 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.515595913 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.517750978 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.517765999 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.577347994 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:08.577387094 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:08.577475071 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:08.577831030 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:08.577841043 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:08.880592108 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.881154060 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.881198883 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.881608963 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.881623983 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.892146111 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.892488003 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.892519951 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.892797947 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.892802954 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.957350016 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.958266973 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.958298922 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.958795071 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.958801031 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.958822966 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.959086895 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.959094048 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:08.959533930 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:08.959537983 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.021888018 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.022123098 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.022241116 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.022241116 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.022241116 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.024944067 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.024985075 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.025118113 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.025269985 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.025285006 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.025337934 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.025422096 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.025516987 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.025556087 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.025556087 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.025573969 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.025582075 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.027420998 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.027430058 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.027504921 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.027611017 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.027623892 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.086761951 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.086877108 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.088876009 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.090583086 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.090675116 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.090739965 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.092227936 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.092242002 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.092271090 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.092276096 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.092308998 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.092314959 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.095957994 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.096010923 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.096067905 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.096108913 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.096188068 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.096328020 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.096332073 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.096343040 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.096369028 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.096375942 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.255317926 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.255963087 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.255987883 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.256434917 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.256442070 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.332798958 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.332882881 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.385646105 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.385739088 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.385802984 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.386158943 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.386178017 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.386188984 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.386193991 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.389028072 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.389081001 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.389158964 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.389364004 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.389375925 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.647514105 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:09.648428917 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:09.648463964 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:09.649183035 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:09.649194956 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:09.649218082 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:09.649228096 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:09.765494108 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.766001940 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.766545057 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.766575098 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.767029047 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.767035961 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.767261028 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.767272949 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.767608881 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.767613888 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.826991081 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.827589035 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.827615023 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.828046083 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.828052044 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.835889101 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.836209059 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.836231947 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.836584091 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.836590052 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.896156073 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.896348953 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.896459103 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.896496058 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.896513939 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.896523952 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.896529913 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.896764040 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.897236109 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.897300005 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.897444010 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.897448063 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.897463083 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.897466898 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.899458885 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.899488926 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.899528980 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.899549961 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.899612904 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.899647951 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.899794102 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.899797916 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.899811029 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.899832010 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.957685947 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.957813025 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.957926035 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.958074093 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.958074093 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.958134890 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.958162069 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.960411072 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.960499048 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.960593939 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.960725069 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.960760117 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.968341112 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.968703985 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.968756914 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.968789101 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.968789101 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.968806982 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.968815088 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.970779896 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.970817089 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:09.970895052 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.971018076 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:09.971031904 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.038383007 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:10.038403034 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:10.038439989 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:10.038472891 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:10.038495064 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:10.038506031 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:10.038904905 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:10.038914919 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:10.038923979 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:10.039103985 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:10.039139032 CEST	443	49840	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:10.039194107 CEST	49840	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:10.088437080 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:10.088489056 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:10.088551044 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:10.088738918 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:10.088752985 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:10.135623932 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.136764050 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.136801958 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.137226105 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.137233019 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.270011902 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.270231009 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.270431042 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.270489931 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.270520926 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.270535946 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.270540953 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.273397923 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.273468018 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.273544073 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.273669004 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.273699999 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.629625082 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.633301020 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.633336067 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.633768082 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.633774042 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.650525093 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.650993109 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.651025057 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.651520014 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.651525021 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.708389997 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.708865881 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.709187031 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.709214926 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.709635973 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.709642887 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.709804058 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.709844112 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.710151911 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.710160017 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.758660078 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.758765936 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.758851051 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.759058952 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.759080887 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.759095907 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.759103060 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.761857986 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.761897087 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.761991978 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.762177944 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.762195110 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.781286955 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.781642914 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.781716108 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.781759024 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.781759024 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.781778097 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.781790018 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.784285069 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.784324884 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.784404039 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.784548998 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.784564018 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.838856936 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.838941097 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.839226961 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.839263916 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.839263916 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.839282990 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.839294910 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.839776039 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.840154886 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.840837002 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.840945005 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.840945005 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.840990067 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.841057062 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.842360020 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.842390060 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.842484951 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.842593908 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.842606068 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.842919111 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.842953920 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:10.843009949 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.843149900 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:10.843158960 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.015882015 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.016690016 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.016767979 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.017266035 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.017281055 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.148031950 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.148210049 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.148289919 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.148380995 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.148380995 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.148432970 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.148459911 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.155406952 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.155599117 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.155656099 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.155833006 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.155889988 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.155906916 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.156183958 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:11.156219959 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.156965971 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:11.156971931 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.157004118 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:11.157013893 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.479368925 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.479406118 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.479476929 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:11.479484081 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.479542971 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.479557037 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:11.483689070 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:11.483711004 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.483882904 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.483910084 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.483967066 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:11.484020948 CEST	49850	443	192.168.2.5	40.126.31.73
Oct 17, 2024 08:41:11.484036922 CEST	443	49850	40.126.31.73	192.168.2.5
Oct 17, 2024 08:41:11.491795063 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.492271900 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.492295027 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.492712975 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.492717981 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.525551081 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.525981903 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.526004076 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.526504040 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.526515961 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.593862057 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.594475031 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.594504118 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.594929934 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.594940901 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.598747015 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.599055052 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.599071980 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.599394083 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.599397898 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.620542049 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.621287107 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.621390104 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.621429920 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.621429920 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.621452093 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.621462107 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.624315023 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.624366045 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.624461889 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.624638081 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.624646902 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.658191919 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.658476114 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.658571959 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.658670902 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.658693075 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.658704996 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.658710003 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.661843061 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.661890984 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.661989927 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.662148952 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.662159920 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.725145102 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.725406885 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.725497961 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.725553036 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.725553036 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.725579023 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.725589991 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.728367090 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.728416920 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.728480101 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.728614092 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.728627920 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.729404926 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.729600906 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.729643106 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.729671001 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.729680061 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.729690075 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.729696035 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.731695890 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.731713057 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.731764078 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.731899023 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.731905937 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.874413013 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.874958038 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.875036001 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:11.875567913 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:11.875583887 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.000710964 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.001036882 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.001096964 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.001147032 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.001147032 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.001173019 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.001183987 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.004041910 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.004081964 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.004159927 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.004384995 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.004396915 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.353055954 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.353637934 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.353662968 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.354091883 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.354103088 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.387646914 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.388097048 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.388134003 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.388442039 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.388452053 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.478759050 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.478851080 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.479480028 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.479497910 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.479624987 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.479655027 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.480077028 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.480087042 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.480201006 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.480205059 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.483417988 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.483530998 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.483588934 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.483719110 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.483738899 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.483764887 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.483769894 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.486462116 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.486493111 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.486728907 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.486866951 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.486877918 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.516208887 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.516818047 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.516885042 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.517060995 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.517076015 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.517086983 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.517092943 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.519423962 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.519473076 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.519617081 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.519799948 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.519814968 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.610914946 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.611335993 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.611392021 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.613992929 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.616082907 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.616177082 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.625886917 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.625900030 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.626341105 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.626341105 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.626393080 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.626418114 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.634397030 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.634424925 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.634490013 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.634706020 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.634742022 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.634785891 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.634800911 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.634816885 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.635003090 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.635016918 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.733303070 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.733853102 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.733880997 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.734329939 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.734333992 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.862606049 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.862811089 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.862934113 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.863137007 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.863159895 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.863172054 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.863177061 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.865962982 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.866008997 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:12.866099119 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.866369963 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:12.866384983 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.218956947 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.219372034 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.219397068 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.219867945 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.219878912 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.261971951 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.262502909 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.262520075 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.263024092 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.263030052 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.350081921 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.350128889 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.350251913 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.350466967 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.350481987 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.350491047 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.350496054 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.353560925 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.353595972 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.353691101 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.353879929 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.353889942 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.369077921 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.369612932 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.369640112 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.369966030 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.369970083 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.377655029 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.377943993 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.377960920 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.378278971 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.378283978 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.392534018 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.392554045 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.392657042 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.392725945 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.392913103 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.393096924 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.393116951 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.393126965 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.393132925 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.395895004 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.395924091 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.395997047 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.396147966 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.396159887 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.506067991 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.506331921 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.506385088 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.506445885 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.506464958 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.506474972 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.506479979 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.510205030 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.510247946 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.510314941 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.510512114 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.510524988 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.516335011 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.516455889 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.516505003 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.516613007 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.516628027 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.516637087 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.516640902 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.518796921 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.518817902 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.518872023 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.519036055 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.519047976 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.609893084 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.610498905 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.610521078 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.610964060 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.610969067 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.742810965 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.742830992 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.742877960 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.742937088 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.742985964 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.743240118 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.743253946 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.743267059 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.743273020 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.746375084 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.746416092 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:13.746504068 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.746675014 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:13.746689081 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.105350971 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.105948925 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.105982065 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.106426001 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.106431961 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.143229961 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.144005060 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.144049883 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.144412994 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.144418955 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.237456083 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.237478971 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.237598896 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.237631083 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.237679005 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.237684965 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.237699986 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.237833023 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.237858057 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.237873077 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.237880945 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.240613937 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.240658998 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.240736961 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.240863085 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.240875006 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.266151905 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.266941071 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.267018080 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.267616034 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.267627954 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.272588968 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.272617102 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.272682905 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.272741079 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.272774935 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.272824049 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.272948980 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.272948980 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.272983074 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.273005009 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.275583982 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.275634050 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.275717974 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.275886059 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.275904894 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.283665895 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.284153938 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.284224987 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.284811974 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.284825087 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.403750896 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.403821945 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.404033899 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.404117107 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.404117107 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.404162884 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.404191971 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.406656027 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.406682014 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.406790018 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.406948090 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.406956911 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.423214912 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.423285007 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.423352003 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.423551083 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.423571110 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.423594952 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.423609018 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.426336050 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.426353931 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.426645994 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.426812887 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.426824093 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.503787041 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.504434109 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.504476070 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.505286932 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.505296946 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.637245893 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.637321949 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.637403965 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.637574911 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.637619972 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.637672901 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.637687922 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.640872955 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.640903950 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.640969038 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.641096115 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:14.641103983 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:14.999666929 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.000267982 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.000287056 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.000881910 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.000886917 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.025715113 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.026154041 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.026180029 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.026659012 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.026667118 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.132189989 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.132428885 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.132487059 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.132884026 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.132899046 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.132910013 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.132915020 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.144706964 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.144784927 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.144865990 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.146292925 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.146331072 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.177968025 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.178121090 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.178177118 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.179796934 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.179814100 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.179836988 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.179843903 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.180833101 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.182856083 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.182871103 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.183650017 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.183727026 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.183734894 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.184211016 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.184226036 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.184566021 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.184570074 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.185842037 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.185911894 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.185996056 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.186110020 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.186148882 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.314974070 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.315032005 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.315133095 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.315412045 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.315424919 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.315433979 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.315438986 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.318700075 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.318732023 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.318836927 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.319032907 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.319046021 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.319189072 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.319242001 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.319297075 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.319463968 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.319473028 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.319503069 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.319506884 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.321549892 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.321588993 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.321666956 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.321837902 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.321852922 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.380388021 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.380865097 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.380877972 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.381270885 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.381274939 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.509708881 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.509768963 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.509819031 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.510019064 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.510025978 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.510042906 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.510046005 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.513201952 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.513273001 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.513365030 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.513648033 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.513679981 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.887480974 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.888081074 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.888128042 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.888434887 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.888442993 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.922739983 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.923193932 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.923206091 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:15.923470974 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:15.923476934 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.027640104 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.027681112 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.027849913 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.027987957 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.028008938 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.028021097 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.028028011 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.031075954 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.031136036 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.031234026 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.031456947 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.031507015 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.054796934 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.054939032 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.055008888 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.055208921 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.055208921 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.055217981 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.055227041 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.057379007 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.057451963 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.057542086 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.057698965 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.057720900 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.062186956 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.062613010 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.062639952 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.062957048 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.062966108 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.068856001 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.069132090 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.069159985 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.069474936 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.069484949 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.201920033 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.201947927 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.201977968 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.202150106 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.202150106 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.202260017 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.202260971 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.202307940 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.202337980 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.205007076 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.205040932 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.205146074 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.205297947 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.205319881 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.217175007 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.217226982 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.217386007 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.217468023 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.217468023 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.217511892 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.217540979 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.219445944 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.219475985 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.219537973 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.219646931 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.219662905 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.268420935 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.269041061 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.269094944 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.269454002 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.269465923 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.414242983 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.414397955 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.414444923 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.414482117 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.414520025 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.414688110 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.414689064 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.414716005 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.414737940 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.417433023 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.417460918 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.417570114 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.417865992 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.417876005 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.818675041 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.819212914 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.819286108 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.819647074 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.819660902 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.861330032 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.861881018 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.861946106 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.862279892 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.862293959 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.949500084 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.949542999 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.949616909 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.949857950 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.949857950 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.949891090 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.949913979 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.952999115 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.953037977 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.953114986 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.953303099 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.953316927 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.968163013 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.968903065 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.968910933 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.969614029 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.969618082 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.998523951 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.999033928 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.999135971 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.999311924 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.999313116 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:16.999356985 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:16.999381065 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.002777100 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.002799034 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.002979994 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.003108978 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.003127098 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.009113073 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.012774944 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.012825966 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.013187885 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.013201952 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.106839895 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.106889963 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.107109070 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.107144117 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.107155085 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.107166052 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.107171059 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.109694958 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.109759092 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.109848022 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.109993935 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.110024929 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.154490948 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.154563904 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.154654980 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.154665947 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.154833078 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.154870033 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.154900074 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.154900074 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.154917955 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.154936075 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.157027006 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.157052040 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.157146931 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.157383919 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.157408953 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.177794933 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.178117037 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.178132057 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.178530931 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.178536892 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.328213930 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.328392029 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.328542948 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.328767061 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.328793049 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.328838110 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.328852892 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.331496000 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.331537962 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.331603050 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.331724882 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.331741095 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.737706900 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.738219023 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.738234043 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.738658905 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.738665104 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.782712936 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.783170938 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.783179045 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.783514023 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.783518076 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.869549990 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.869605064 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.869682074 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.869889021 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.869903088 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.869910955 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.869916916 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.872613907 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.872682095 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.872772932 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.872968912 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.872994900 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.873018026 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.873147964 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.873174906 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.873361111 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.873368025 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.912867069 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.913064957 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.913135052 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.913155079 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.913160086 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.913177013 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.913181067 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.915222883 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.915292025 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.915375948 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.915493011 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.915513039 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.921974897 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.922277927 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.922291994 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:17.922641993 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:17.922652960 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.007363081 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.007392883 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.007432938 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.007499933 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.007539034 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.007625103 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.007625103 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.007653952 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.007675886 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.009649038 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.009732962 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.009840012 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.009946108 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.009975910 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.052428961 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.052647114 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.052737951 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.052799940 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.052799940 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.052818060 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.052839041 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.055337906 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.055433035 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.055537939 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.055670023 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.055701971 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.081131935 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.081501961 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.081522942 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.081942081 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.081957102 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.217755079 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.217822075 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.217880011 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.217890024 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.217915058 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.217963934 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.218003035 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.218010902 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.218020916 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.218025923 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.220314980 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.220335960 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.220407009 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.220527887 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.220535994 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.628901958 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.629535913 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.629601955 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.630048037 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.630062103 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.676615953 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.677084923 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.677140951 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.677489996 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.677503109 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.748775959 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.749279022 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.749301910 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.749728918 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.749738932 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.762170076 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.762387037 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.762495041 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.762495041 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.762586117 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.762619972 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.765178919 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.765275002 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.765363932 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.765485048 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.765522003 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.808326006 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.808507919 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.808582067 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.808795929 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.808830976 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.808861971 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.808878899 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.809576035 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.811264992 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.811306000 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.811706066 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.811717033 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.814086914 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.814155102 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.814234018 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.814599037 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.814629078 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.877847910 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.877907991 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.877964020 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.878097057 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.878097057 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.878127098 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.878150940 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.881716013 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.881745100 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.881805897 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.881915092 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.881926060 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.938188076 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.938304901 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.938402891 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.938445091 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.938478947 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.938543081 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.938580990 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.938617945 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.938642025 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.938657045 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.941010952 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.941035032 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.941102028 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.941356897 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.941368103 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.967699051 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.968096018 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.968106031 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:18.968542099 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:18.968545914 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.097637892 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.097702026 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.097786903 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.098006964 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.098020077 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.098027945 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.098031998 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.130105019 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.130150080 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.130254984 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.130415916 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.130424023 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.519153118 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.533369064 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.533395052 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.533849955 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.533857107 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.568547010 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.594361067 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.594383001 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.595026970 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.595033884 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.614732027 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.660856009 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.660932064 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.660990953 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.661097050 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.688936949 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.727962971 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.728034973 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.728116035 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.738990068 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.814516068 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.814524889 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.815021992 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.815026999 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.838869095 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.838896990 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.838938951 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.838948011 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.840153933 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.840162992 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.840965033 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.840969086 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.847330093 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.847337961 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.940099001 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.940133095 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.940181017 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.940234900 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:19.964431047 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.964556932 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:19.964756966 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.035099030 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.035124063 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.035140991 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.035147905 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.047946930 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.047966003 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.047987938 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.047992945 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.067200899 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.067236900 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.067357063 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.074223995 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.074253082 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.074316025 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.075761080 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.075826883 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.076056957 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.076913118 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.076927900 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.076945066 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.077002048 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.077388048 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.077502012 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.077538013 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.117021084 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.135072947 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.135087013 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.136023045 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.136054039 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.139097929 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.139137983 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.139523983 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.139528990 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.265686989 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.265750885 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.265886068 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.266073942 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.266089916 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.266174078 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.266179085 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.268861055 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.268893957 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.269073009 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.269211054 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.269224882 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.810534000 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.811043978 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.811096907 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.811507940 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.811512947 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.818068027 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.818720102 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.818783045 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.819048882 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.819063902 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.882251978 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.883052111 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.883337021 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.883399963 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.883760929 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.883774996 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.884210110 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.884238005 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.884578943 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.884584904 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.941875935 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.941896915 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.941951036 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.941979885 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.942019939 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.942223072 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.942236900 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.942251921 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.942256927 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.944684982 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.944725037 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.944797039 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.944915056 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.944925070 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.948472023 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.948540926 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.948851109 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.948851109 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.948851109 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.950654030 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.950685024 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:20.951843023 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.951963902 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:20.951976061 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.010970116 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.011373997 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.011471033 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.011687040 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.011728048 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.011756897 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.011771917 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.014282942 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.014369965 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.014446974 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.014847040 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.014908075 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.014974117 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.015023947 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.015044928 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.015058994 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.015065908 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.015881062 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.015899897 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.016952038 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.016971111 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.020867109 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.020991087 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.021003008 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.022847891 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.023185968 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.023212910 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.023633003 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.023637056 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.155596018 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.155643940 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.155765057 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.155973911 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.155992031 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.156002998 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.156008959 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.158922911 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.158956051 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.159171104 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.159297943 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.159315109 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.249500036 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.249574900 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.706311941 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.706474066 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.707072020 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.707087040 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.707176924 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.707195997 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.707571030 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.707576990 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.707667112 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.707679987 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.760678053 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.761096954 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.761123896 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.761497021 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.761502028 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.785656929 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.787605047 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.787635088 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.787899017 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.787906885 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.841371059 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.841473103 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.841564894 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.841573000 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.841630936 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.841809034 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.841826916 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.841836929 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.841842890 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.844481945 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.844517946 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.844588995 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.844737053 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.844753027 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.847095966 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.847156048 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.847229958 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.847404957 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.847404957 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.847440004 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.847471952 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.849255085 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.849303007 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.849370003 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.849500895 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.849513054 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.897042036 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.897078991 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.897125006 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.897155046 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.897178888 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.897347927 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.897360086 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.897370100 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.897373915 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.899466038 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.899552107 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.899647951 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.899786949 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.899840117 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.919502974 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.919959068 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.920131922 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.920419931 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.920419931 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.920464039 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.920790911 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.920798063 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.920943975 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.920959949 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.920972109 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.920979023 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.922899961 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.922923088 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:21.923000097 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.923131943 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:21.923155069 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.047683001 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.047774076 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.047848940 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.047878981 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.047903061 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.048089027 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.049766064 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.049787045 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.049803972 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.049810886 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.059773922 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.059818029 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.059885025 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.060519934 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.060554981 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.168502092 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:22.168533087 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:22.168786049 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:22.169043064 CEST	49921	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:22.169085026 CEST	443	49921	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:22.169126034 CEST	49921	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:22.169420958 CEST	49921	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:22.169435978 CEST	443	49921	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:22.169641018 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:22.169655085 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:22.584451914 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.588197947 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.588458061 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.588481903 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.588984966 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.589015961 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.589159012 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.589167118 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.589442968 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.589449883 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.641632080 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.642267942 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.642307997 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.642606020 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.642613888 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.670268059 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.670928955 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.670958042 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.671571970 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.671600103 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.743665934 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.743683100 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.743715048 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.743740082 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.743771076 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.743954897 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.743982077 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.743994951 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.744002104 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.747771978 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.747818947 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.747992039 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.748239040 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.748280048 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.750725031 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.750869036 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.750931978 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.751007080 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.751019955 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.751028061 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.751034021 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.752859116 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.752901077 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.753106117 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.753106117 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.753169060 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.782908916 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.806324959 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.806478024 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.806549072 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.806616068 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.806632996 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.806653976 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.806704998 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.810504913 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.810544014 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.811507940 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.811513901 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.811698914 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.811709881 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.821311951 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.821352005 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.821444988 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.821604013 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.821618080 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.832571030 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.832578897 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.833055973 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.833071947 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.833082914 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.833319902 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.833360910 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.833503008 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.835839987 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.835850954 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.835985899 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.836095095 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.836107969 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.936748028 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.936932087 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.936999083 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.937120914 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.937141895 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.937151909 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.937155962 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.939659119 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.939743996 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:22.939829111 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.939981937 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:22.940012932 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.004767895 CEST	443	49921	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.005098104 CEST	49921	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.005120993 CEST	443	49921	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.006547928 CEST	443	49921	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.006611109 CEST	49921	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.007554054 CEST	49921	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.007631063 CEST	443	49921	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.007813931 CEST	49921	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.007821083 CEST	443	49921	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.016028881 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.016427994 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.016459942 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.020061016 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.020131111 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.020411968 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.020586014 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.050003052 CEST	49921	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.062926054 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.062957048 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.109493971 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.335100889 CEST	443	49921	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.335721016 CEST	443	49921	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.335859060 CEST	49921	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.376988888 CEST	49921	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.377022982 CEST	443	49921	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.488552094 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.488652945 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.488744020 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.489136934 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.489181042 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.489240885 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.489831924 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.489849091 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.490081072 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:23.490120888 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:23.493372917 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.493860006 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.493900061 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.494649887 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.494657040 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.496244907 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.504755020 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.504827976 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.505204916 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.505217075 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.568952084 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.570115089 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.610071898 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.624295950 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.625493050 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.625556946 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.625708103 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.632725000 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.632850885 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.633729935 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.644778967 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.644803047 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.645539999 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.645545006 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.646120071 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.646125078 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.646773100 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.646776915 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.648581028 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.648612022 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.649705887 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.649765968 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.649810076 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.649826050 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.690660000 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.736835003 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.772563934 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.772753954 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.772838116 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.775418997 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.775516987 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.775583029 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.775597095 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.775620937 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.775664091 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.798002958 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.798022985 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.798443079 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.798459053 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.799130917 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.799150944 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.799159050 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.799164057 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.800009966 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.800014019 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.800040007 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.800043106 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.802376986 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.802417994 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.802503109 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.802622080 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.802630901 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.803504944 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.803611994 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.803682089 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.803780079 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.803801060 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.804116011 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.804146051 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.804198980 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.804335117 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.804349899 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.804605007 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.804689884 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.804826021 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.804941893 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.804974079 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.932254076 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.932332993 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.932440996 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.932523966 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.932619095 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.932657003 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.932683945 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.932698965 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.936247110 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.936289072 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:23.936378002 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.936533928 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:23.936559916 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.491134882 CEST	49935	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:41:24.491188049 CEST	443	49935	142.250.185.132	192.168.2.5
Oct 17, 2024 08:41:24.491257906 CEST	49935	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:41:24.491473913 CEST	49935	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:41:24.491493940 CEST	443	49935	142.250.185.132	192.168.2.5
Oct 17, 2024 08:41:24.547566891 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.549227953 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.549293995 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.549725056 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.549737930 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.550957918 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.551352024 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.551433086 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.551791906 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.551805973 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.555949926 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.557080030 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.557085037 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.557105064 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.557486057 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.557492018 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.557766914 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.557842016 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.558172941 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.558190107 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.563945055 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.564203978 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.564230919 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.566114902 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.566206932 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.567203999 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.567305088 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.567430019 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.567445993 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.583085060 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.583426952 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.583445072 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.584938049 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.585005999 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.585370064 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.585452080 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.610426903 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.610455036 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.625531912 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.625559092 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:24.656013012 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.670166016 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.670986891 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.671035051 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.671704054 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.671715975 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.672015905 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:24.676804066 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.677232027 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.677295923 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.677359104 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.677359104 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.677397013 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.677423954 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.680150986 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.680198908 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.680290937 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.680439949 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.680455923 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.684464931 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.684521914 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.684573889 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.684736967 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.684779882 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.684818029 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.684832096 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.685786009 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.685900927 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.686002970 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.686045885 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.686095953 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.686116934 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.686134100 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.686146975 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.686153889 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.687066078 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.687422991 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.687464952 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.687495947 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.687499046 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.687546015 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.687558889 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.687582016 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.687608004 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.687624931 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.687757969 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.687772036 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.689235926 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.689246893 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.689421892 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.689819098 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.689830065 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.691186905 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.691199064 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.691245079 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.691354990 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.691366911 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.797843933 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.798350096 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.798432112 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.798497915 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.798497915 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.798533916 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.798557997 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.800793886 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.800832987 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:24.800892115 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.801047087 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:24.801060915 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.440347910 CEST	443	49935	142.250.185.132	192.168.2.5
Oct 17, 2024 08:41:25.440622091 CEST	49935	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:41:25.440675974 CEST	443	49935	142.250.185.132	192.168.2.5
Oct 17, 2024 08:41:25.442173958 CEST	443	49935	142.250.185.132	192.168.2.5
Oct 17, 2024 08:41:25.442245960 CEST	49935	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:41:25.443305016 CEST	49935	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:41:25.443413973 CEST	443	49935	142.250.185.132	192.168.2.5
Oct 17, 2024 08:41:25.483843088 CEST	49935	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:41:25.483863115 CEST	443	49935	142.250.185.132	192.168.2.5
Oct 17, 2024 08:41:25.532147884 CEST	49935	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:41:25.568582058 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.570487976 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.571190119 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.571228027 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.571659088 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.571666002 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.571903944 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.571917057 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.572258949 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.572263002 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.574645042 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.575632095 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.578169107 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.578200102 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.578557014 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.578561068 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.578629971 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.578680992 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.578938961 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.578952074 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.580768108 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.581063032 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.581091881 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.581419945 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.581429005 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.705812931 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.705842018 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.705892086 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.705925941 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.705959082 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.706166983 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.706183910 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.706212044 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.706218004 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.708903074 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.708940029 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.709016085 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.709172964 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.709184885 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.709975004 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.710041046 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.710139036 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.710158110 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.710161924 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.710170031 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.710172892 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.711980104 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.711987972 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.712064981 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.712182045 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.712191105 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.712383986 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.712527037 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.712578058 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.712611914 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.712635040 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.712646008 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.712651968 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.714452982 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.714473009 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.714545965 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.714690924 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.714704037 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.715784073 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.715913057 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.715986967 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.716128111 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.716128111 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.716165066 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.716191053 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.717906952 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.718000889 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.718092918 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.718215942 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.718242884 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.721000910 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.721570969 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.721632957 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.721699953 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.721699953 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.721714020 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.721749067 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.723575115 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.723608971 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:25.723690987 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.723829031 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:25.723845959 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.181236029 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.181262970 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.181272984 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.181345940 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.181377888 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.181396961 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.181448936 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.304919004 CEST	49928	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.304956913 CEST	443	49928	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.306274891 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.307688951 CEST	49946	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.307732105 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.307796955 CEST	49946	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.308103085 CEST	49946	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.308123112 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.308628082 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.308665991 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.308737040 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.309057951 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.309071064 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.345258951 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:26.345335007 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:26.345408916 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:26.345577955 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:26.345611095 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:26.351406097 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.359153032 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:26.359177113 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:26.359227896 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:26.359411955 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:26.359426022 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:26.441538095 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.442071915 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.442128897 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.442539930 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.442557096 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.454037905 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.454698086 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.454730988 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.454776049 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.454786062 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.456931114 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.457237959 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.457268953 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.457535982 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.457540989 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.475831985 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.476347923 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.476398945 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.476739883 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.476749897 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.478018045 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.478322029 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.478353024 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.478658915 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.478663921 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.552124977 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.552151918 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.552238941 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.552249908 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.552325010 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.553442955 CEST	49929	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:26.553462029 CEST	443	49929	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:26.572168112 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.572995901 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.573098898 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.573158979 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.573158979 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.573194027 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.573215961 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.576385975 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.576489925 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.576607943 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.576848030 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.576884985 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.584956884 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.585045099 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.585185051 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.585249901 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.585268021 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.585292101 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.585305929 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.585972071 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.586020947 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.586070061 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.586092949 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.586117029 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.586304903 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.586322069 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.586338043 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.586343050 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.588107109 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.588154078 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.588184118 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.588201046 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.588255882 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.588305950 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.588416100 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.588445902 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.588491917 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.588515043 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.606935978 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.607084990 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.607501984 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.607568026 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.607584953 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.607599020 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.607605934 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.610263109 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.610368967 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.610466003 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.613065958 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.613131046 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.613234043 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.613254070 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.613291025 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.614784002 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.614820957 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.619561911 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.619596958 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.619873047 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.620073080 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:26.620100975 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:26.971257925 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:26.972250938 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:26.972322941 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:26.973922014 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:26.974040031 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:26.977559090 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:26.977659941 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:26.978315115 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:26.978332996 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.027450085 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.053121090 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.055244923 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.055264950 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.056713104 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.056782961 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.058080912 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.058284998 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.058293104 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.058327913 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.108299017 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.108313084 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.121984005 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.122111082 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.122206926 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.122272968 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.122312069 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.122348070 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.122375011 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.122430086 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.125556946 CEST	49948	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.125575066 CEST	443	49948	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.141356945 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.141438007 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.141618013 CEST	49946	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.141628981 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.141755104 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.141773939 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.142282009 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.142362118 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.142859936 CEST	49946	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.142985106 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.143244028 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.143332005 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.143428087 CEST	49946	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.143487930 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.150048018 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.152281046 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.152307987 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.152453899 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.152573109 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.152581930 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.191405058 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.191412926 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.240075111 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.240186930 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.240758896 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.240776062 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.241705894 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.241728067 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.241750002 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.241775990 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.241786003 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.241820097 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.241820097 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.241839886 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.241858959 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.241874933 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.241909027 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.241914988 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.288768053 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.288783073 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.340991020 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.341458082 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.341665030 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.341733932 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.341948032 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.342019081 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.342088938 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.342106104 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.342597961 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.342612028 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.344058037 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.346235991 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.346640110 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.346684933 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.346997023 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.347007990 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.348505974 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.348783970 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.348817110 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.349087954 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.349097013 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.358159065 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.358181953 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.358233929 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.358237028 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.358304977 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.358582973 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.358602047 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.358635902 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.358644962 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.358670950 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.358697891 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.358707905 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.358838081 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.358892918 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.359141111 CEST	49949	443	192.168.2.5	52.217.103.156
Oct 17, 2024 08:41:27.359158039 CEST	443	49949	52.217.103.156	192.168.2.5
Oct 17, 2024 08:41:27.365170956 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.365617990 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.365649939 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.366014957 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.366024971 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.384962082 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:27.384985924 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:27.385061026 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:27.385257006 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:27.385270119 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:27.388550997 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.388578892 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.388659000 CEST	49946	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.388668060 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.388680935 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.388710022 CEST	49946	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.388744116 CEST	49946	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.391068935 CEST	49946	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.391077042 CEST	443	49946	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.469821930 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.469974041 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.470103025 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.470345974 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.470386028 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.470415115 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.470429897 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.471741915 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.471894026 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.473258018 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.473294020 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.473294020 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.473351002 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.473489046 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.473506927 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.473520041 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.473526001 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.474334002 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.474349976 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.475842953 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.475852013 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.475924015 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.476129055 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.476141930 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.480243921 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.480309963 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.480411053 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.480474949 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.480508089 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.480508089 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.480525017 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.480544090 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.481743097 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.481766939 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.481827974 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.481842995 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.481895924 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.482068062 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.482084990 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.482106924 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.482116938 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.485199928 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.485280037 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.485291004 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.485316992 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.485373974 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.485423088 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.485476017 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.485502005 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.485552073 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.485563993 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.497493982 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.497533083 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.497581959 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.497611046 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.497639894 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.501235962 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.501255989 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.501277924 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.501288891 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.503952980 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.504040003 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.504399061 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.504427910 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.504448891 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.504488945 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.504549026 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.504574060 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.504635096 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.504782915 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:27.504820108 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:27.506174088 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.506192923 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.506269932 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.506284952 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.561986923 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.622607946 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.622634888 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.622693062 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.622699022 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.622720003 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.622756958 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.623178959 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.623202085 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.623256922 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.623271942 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.623308897 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.624015093 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.624032974 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.624073982 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.624088049 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.624123096 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.624924898 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.624947071 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.624989986 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.625004053 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.625045061 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.670608044 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.740457058 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.740482092 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.740531921 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.740556955 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.740586042 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.740605116 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.741110086 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.741127968 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.741177082 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.741190910 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.741225004 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.741246939 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.741827011 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.741846085 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.741928101 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.741942883 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.741997957 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.742727995 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.742747068 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.742794037 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.742821932 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.742852926 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.742871046 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.744314909 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.744333982 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.744378090 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.744390011 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.744431973 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.744455099 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.745419025 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.745436907 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.745485067 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.745496988 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.745534897 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.745558023 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.746123075 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.746141911 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.746181965 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.746193886 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.746233940 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.746256113 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.773053885 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.773369074 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.773417950 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.774885893 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.774959087 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.775482893 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.775577068 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.775629044 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.823407888 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.827265978 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.827286959 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.858076096 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.858131886 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.858194113 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.858215094 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.858273029 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.858285904 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.858342886 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.858350039 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.858371973 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.858407021 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.858442068 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.858650923 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.858690023 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.858735085 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.858747959 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.858773947 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.858808041 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.862687111 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.862751007 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.862778902 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.862792015 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.862835884 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.862857103 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.863158941 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.863198996 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.863225937 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.863238096 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.863265991 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.863285065 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.863457918 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.863497019 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.863521099 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.863554955 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.863578081 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.863603115 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.863769054 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.863807917 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.863833904 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.863847017 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.863882065 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.863922119 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.864010096 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.864051104 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.864074945 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.864087105 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.864123106 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.864144087 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.864222050 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.864269018 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.864296913 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.864309072 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.864337921 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.864363909 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.864409924 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.864456892 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.864475012 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.864486933 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.864521027 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.864542007 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.874265909 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.915219069 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.915288925 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.915328026 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.915417910 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.915438890 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.915460110 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.915514946 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.915555954 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.916169882 CEST	49955	443	192.168.2.5	104.18.31.107
Oct 17, 2024 08:41:27.916198015 CEST	443	49955	104.18.31.107	192.168.2.5
Oct 17, 2024 08:41:27.975526094 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.975630999 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:27.975642920 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.975727081 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.980267048 CEST	49947	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:27.980283022 CEST	443	49947	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:28.072417021 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.080451965 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.080476999 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.082041025 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.082130909 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.161680937 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.162000895 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.162671089 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.162703037 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.164002895 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:28.164036036 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:28.164118052 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:28.164290905 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:28.164299011 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:28.216120005 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.227835894 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.228367090 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:28.228416920 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:28.228504896 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:28.228563070 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.228687048 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:28.228698969 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:28.228977919 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.228997946 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.229398966 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.229406118 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.229485035 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.229593992 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.229624033 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.229924917 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.229931116 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.230093002 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.230170965 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.230406046 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.230422020 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.232033014 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.233185053 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.233201981 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.233776093 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.233782053 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.246109962 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.249358892 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.249382973 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.249941111 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.249944925 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.354408979 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.355882883 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.356034040 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.356101036 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.356115103 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.356116056 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.356146097 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.356172085 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.356179953 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.356184006 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.356205940 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.356215954 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.356244087 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.356271029 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.356283903 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.359050989 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.359116077 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.359169960 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.359222889 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.361844063 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.361896992 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.361978054 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.362018108 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.362099886 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.362325907 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.362395048 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.362503052 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.362561941 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.377950907 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.377990007 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.378062963 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.378149033 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.378202915 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.474267006 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.474330902 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.474392891 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.474407911 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.474463940 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.475104094 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.475163937 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.475168943 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.475214005 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:28.480840921 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:28.789361000 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.789395094 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.790936947 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.790968895 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.790985107 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.790991068 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.804128885 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.804161072 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.804177046 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.804184914 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.841286898 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.841286898 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.841389894 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.841428995 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.908828974 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.908849001 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:28.908864021 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:28.908869982 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.002916098 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.059156895 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.060580015 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.105870962 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.214498043 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.214519024 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.215133905 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.215209007 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.215825081 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.216202974 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.216273069 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.263268948 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.295187950 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.295521975 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.295581102 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.295736074 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.296591997 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.296614885 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.296700954 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.302428007 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.302517891 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.302617073 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.316924095 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.316961050 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.320733070 CEST	49956	443	192.168.2.5	3.5.31.150
Oct 17, 2024 08:41:29.320755959 CEST	443	49956	3.5.31.150	192.168.2.5
Oct 17, 2024 08:41:29.329567909 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.329600096 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.329668045 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.329921007 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.329936028 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.333178043 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.333204985 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.333290100 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.336750984 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.336834908 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.336915970 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.336957932 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.336977005 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.339153051 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.339173079 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.339238882 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.339277029 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.339308023 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.339353085 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:29.339375019 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:29.341876030 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.343399048 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.544066906 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.544095993 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.544184923 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.544188976 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.544244051 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.555866003 CEST	49962	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.555933952 CEST	443	49962	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.582602978 CEST	49971	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.582638979 CEST	443	49971	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.582727909 CEST	49971	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.583000898 CEST	49971	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.583017111 CEST	443	49971	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.660187960 CEST	49972	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.660284996 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.660372019 CEST	49972	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.660784006 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.660849094 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.660870075 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.660887957 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.660906076 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.660932064 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.660950899 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.660963058 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.660973072 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.660991907 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.661006927 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.661022902 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.661053896 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.661920071 CEST	49972	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.661959887 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.662267923 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.662313938 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.662328005 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.662341118 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.662395954 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.716979027 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.717010021 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.763983965 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.779278994 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.779311895 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.779356956 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.779361010 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.779376984 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.779417992 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.779438972 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.779444933 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.779489040 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.780214071 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.780235052 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.780277014 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.780277014 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.780322075 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.780334949 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.780349970 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.780378103 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.781891108 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.781940937 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.781970978 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.781980038 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.782047033 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.783883095 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.783930063 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.783967972 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.783976078 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.784008980 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.784029961 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.800519943 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:29.800621033 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:29.800935984 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:29.801028013 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:29.801151991 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:29.803375006 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:29.803421974 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:29.805480957 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:29.805614948 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:29.896974087 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.897034883 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.897119045 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.897150993 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.897166967 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.897197008 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.897306919 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.897349119 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.897380114 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.897391081 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.897422075 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.897449017 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.897767067 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.897809982 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.897840977 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.897847891 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.897885084 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.897898912 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.898350000 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.898394108 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.898427010 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.898432970 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.898475885 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.901726961 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.901787043 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.901839972 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.901846886 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.901876926 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.901904106 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.902307034 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.902350903 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.902381897 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.902388096 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.902429104 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.941720963 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.941785097 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.941864967 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.941874027 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:29.941904068 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:29.941930056 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.014523029 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.014586926 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.014662027 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.014686108 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.014719963 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.014754057 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015024900 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015069962 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015094995 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015103102 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015135050 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015168905 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015244961 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015285969 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015326977 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015332937 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015363932 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015381098 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015435934 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015477896 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015517950 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015525103 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015549898 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015575886 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015872002 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015913963 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015952110 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015960932 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.015999079 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.015999079 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.016144991 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.016186953 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.016222954 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.016228914 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.016246080 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.016268969 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.016525030 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.016566992 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.016588926 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.016597033 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.016635895 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.016755104 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.016797066 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.016813993 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.016819954 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.016860962 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.016974926 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.017051935 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.017091990 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.017138958 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.017144918 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.017154932 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.017180920 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.019464970 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.051007032 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.051544905 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.051618099 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.052195072 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.052215099 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.059139013 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.059191942 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.059253931 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.059286118 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.059304953 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.059346914 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.059355021 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.059371948 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.059499979 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.059555054 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.061005116 CEST	49964	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.061021090 CEST	443	49964	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.069412947 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.069932938 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.069950104 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.071630001 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.071634054 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.088056087 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.088445902 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.088480949 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.088828087 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.088834047 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.180650949 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.180685043 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.180761099 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.180777073 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.180835009 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.181128025 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.181148052 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.181162119 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.181169987 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.184052944 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.184077978 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.184169054 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.184298992 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.184305906 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.196980953 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.197135925 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.197232008 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.197448015 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.197469950 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.197498083 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.197505951 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.200161934 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.200186014 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.200256109 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.200453997 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.200473070 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.219779015 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.219856977 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.219975948 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.220091105 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.220107079 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.220146894 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.220154047 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.222436905 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.222467899 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.222946882 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.223134995 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.223154068 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.274295092 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.277252913 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.277292967 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.277669907 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.277679920 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.402448893 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.402654886 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.402873039 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.412653923 CEST	443	49971	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.413017035 CEST	49971	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.413034916 CEST	443	49971	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.413532019 CEST	443	49971	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.414500952 CEST	49971	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.414589882 CEST	443	49971	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.414721012 CEST	49971	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.415222883 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.415291071 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.415326118 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.415344954 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.419008017 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.419099092 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.419186115 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.419357061 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.419405937 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.459413052 CEST	443	49971	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.483795881 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:30.483946085 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.498101950 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.498364925 CEST	49972	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.498426914 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.498915911 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.501765013 CEST	49972	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.501861095 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.501921892 CEST	49972	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.515517950 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.516071081 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.516156912 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.516907930 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.516963005 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.525130987 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.525202036 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:30.526406050 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:30.526496887 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.539774895 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.539839983 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:30.540199995 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.540219069 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:30.543445110 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.543888092 CEST	49972	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.657572031 CEST	443	49971	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.657685041 CEST	443	49971	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.657747984 CEST	49971	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.658344984 CEST	49971	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.658371925 CEST	443	49971	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.658384085 CEST	49971	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.658438921 CEST	49971	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.662440062 CEST	49980	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.662488937 CEST	443	49980	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.663274050 CEST	49980	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.663574934 CEST	49980	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.663589954 CEST	443	49980	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.690903902 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.690944910 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.691005945 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.691005945 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.691055059 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.691277027 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.691301107 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.691315889 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.691323996 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.694268942 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.694303989 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.694485903 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.694626093 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.694637060 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.744620085 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.744648933 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.744735956 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.744740963 CEST	49972	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.744791985 CEST	49972	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.745651960 CEST	49972	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:30.745691061 CEST	443	49972	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:30.754275084 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:30.754641056 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.755009890 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:30.755067110 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.755103111 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:30.755198956 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.762264967 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.762264967 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.762319088 CEST	443	49975	23.1.237.91	192.168.2.5
Oct 17, 2024 08:41:30.762392998 CEST	49975	443	192.168.2.5	23.1.237.91
Oct 17, 2024 08:41:30.917579889 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.918148041 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.918183088 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.918606043 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.918613911 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.925174952 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.925616026 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.925651073 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.926026106 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.926033020 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.960634947 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.961236954 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.961251020 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:30.961637974 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:30.961643934 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.047223091 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.047379971 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.047477007 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.047669888 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.047710896 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.047743082 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.047758102 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.050436020 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.050472021 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.050940990 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.051043987 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.051049948 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.053232908 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.053267002 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.053332090 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.053359032 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.053402901 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.053483963 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.053504944 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.053519964 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.053527117 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.055603027 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.055658102 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.055736065 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.055919886 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.055927992 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.090944052 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.091192007 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.091259003 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.091360092 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.091372967 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.091392040 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.091398001 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.094640017 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.094733953 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.094819069 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.095130920 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.095166922 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.142028093 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.142508984 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.142584085 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.143312931 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.143327951 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.270585060 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.270664930 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.270725012 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.270768881 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.270837069 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.271060944 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.271100998 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.271143913 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.271161079 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.274106979 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.274171114 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.274254084 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.274430037 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.274450064 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.424776077 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.425313950 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.425331116 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.426096916 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.426104069 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.498703957 CEST	443	49980	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:31.516802073 CEST	49980	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:31.516833067 CEST	443	49980	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:31.517482042 CEST	443	49980	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:31.518707037 CEST	49980	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:31.518795967 CEST	443	49980	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:31.551120996 CEST	49980	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:31.553149939 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.553283930 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.553385019 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.553914070 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.553914070 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.553935051 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.553946018 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.557214022 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.557264090 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.557430983 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.557615995 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.557634115 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.595400095 CEST	443	49980	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:31.777331114 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.780453920 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.780468941 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.784216881 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.784221888 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.792324066 CEST	443	49980	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:31.792433977 CEST	443	49980	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:31.794790983 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.794996977 CEST	49980	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:31.808578968 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.808620930 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.808975935 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.809003115 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.818089008 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.833386898 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.833470106 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.834280968 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.834335089 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.869473934 CEST	49980	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:31.869503975 CEST	443	49980	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:31.907371044 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.907550097 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.907624006 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.907737017 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.907754898 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.907767057 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.907774925 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.911175013 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.911264896 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.911403894 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.911524057 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.911547899 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.938153982 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.938251019 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.938493013 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.938493013 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.938493013 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.940954924 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.941046000 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.941148043 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.941265106 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.941288948 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.958604097 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.958766937 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.958837986 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.958929062 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.958929062 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.958971977 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.959002972 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.960967064 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.960994005 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:31.961045980 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.961174011 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:31.961179018 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.025022030 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.025450945 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.025481939 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.026000023 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.026007891 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.155864000 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.156054974 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.156122923 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.156250954 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.156271935 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.156285048 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.156291962 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.158888102 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.158921957 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.158987045 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.159140110 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.159146070 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.246925116 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.246998072 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.287514925 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.287972927 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.287992954 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.288474083 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.288480997 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.636569977 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.637106895 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.637149096 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.637156963 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.637214899 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.637248039 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.637268066 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.637279987 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.637288094 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.640260935 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.640377045 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.640460014 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.640664101 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.640682936 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.658400059 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.659080029 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.659142017 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.659568071 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.659584999 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.674612999 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.675134897 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.675223112 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.675455093 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.675470114 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.706309080 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.706655979 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.706676960 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.707053900 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.707058907 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.788719893 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.788806915 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.789014101 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.789145947 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.789196014 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.789227962 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.789244890 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.792078972 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.792129040 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.792195082 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.792357922 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.792376995 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.805253983 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.805327892 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.805464983 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.805582047 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.805582047 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.805661917 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.805686951 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.805704117 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.805711985 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.819279909 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.819333076 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.819456100 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.819603920 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.819613934 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.836143970 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.836298943 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.836359024 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.836390972 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.836402893 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.836422920 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.836430073 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.838584900 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.838614941 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.838726997 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.838861942 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.838869095 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.895819902 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.896258116 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.896272898 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:32.896667957 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:32.896672964 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.023979902 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.024019957 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.024085999 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.024085045 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.024139881 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.024350882 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.024374962 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.024389982 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.024395943 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.027144909 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.027187109 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.027302027 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.027465105 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.027476072 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.383306026 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.388282061 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.388382912 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.388828993 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.388883114 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.516593933 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.516760111 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.516952038 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.521543026 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.521543980 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.521615982 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.521652937 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.524215937 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.524281025 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.525036097 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.525156021 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.525378942 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.525397062 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.525656939 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.525677919 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.526114941 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.526118994 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.566991091 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.567548037 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.567610025 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.568268061 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.568322897 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.576528072 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.577253103 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.577282906 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.577935934 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.577964067 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.654434919 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.654498100 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.654603958 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.654706001 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.654828072 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.654828072 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.654850960 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.654863119 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.657747984 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.657844067 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.657931089 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.658087969 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.658124924 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.698929071 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.699132919 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.699306965 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.699306965 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.699306965 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.702241898 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.702344894 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.702438116 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.702583075 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.702606916 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.733809948 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.733867884 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.734015942 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.734323025 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.734323025 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.734323025 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.736485004 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.736515045 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.736587048 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.736757994 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.736766100 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.776348114 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.776916981 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.776932955 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.777381897 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.777389050 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.909934998 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.909961939 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.910038948 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.910229921 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.911881924 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.911881924 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.911906004 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.911917925 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.915378094 CEST	50000	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.915417910 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:33.918979883 CEST	50000	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.919636965 CEST	50000	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:33.919651985 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.012439966 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.012481928 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.043720961 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.043768883 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.268049002 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.268522978 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.268556118 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.269037962 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.269048929 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.398400068 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.398469925 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.398581028 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.398597002 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.399276018 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.399312973 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.399329901 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.399338007 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.402379036 CEST	50001	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.402477026 CEST	443	50001	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.403070927 CEST	50001	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.403188944 CEST	50001	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.403219938 CEST	443	50001	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.408673048 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.411421061 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.411480904 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.411834002 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.411849976 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.437378883 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.440598011 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.440656900 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.441219091 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.441272974 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.484586954 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.487320900 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.487363100 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.487755060 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.487761021 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.540558100 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.540641069 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.540982008 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.541562080 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.541562080 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.541634083 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.541668892 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.546631098 CEST	50002	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.546724081 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.546909094 CEST	50002	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.559192896 CEST	50002	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.559278011 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.568200111 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.568253994 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.568320990 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.568389893 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.568489075 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.568506956 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.572793961 CEST	50003	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.572829962 CEST	443	50003	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.572909117 CEST	50003	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.573203087 CEST	50003	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.573220968 CEST	443	50003	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.617417097 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.617615938 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.618969917 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.619010925 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.619010925 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.619035959 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.619046926 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.621593952 CEST	50004	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.621625900 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.621701956 CEST	50004	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.621871948 CEST	50004	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.621889114 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.652271032 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.655658007 CEST	50000	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.655666113 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.656011105 CEST	50000	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.656014919 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.781821966 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.781909943 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.781991005 CEST	50000	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.782007933 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.782068968 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.782126904 CEST	50000	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.782279968 CEST	50000	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.782299995 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.782313108 CEST	50000	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.782318115 CEST	443	50000	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.784928083 CEST	50005	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.784986019 CEST	443	50005	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:34.785065889 CEST	50005	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.785209894 CEST	50005	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:34.785223007 CEST	443	50005	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.143703938 CEST	443	50001	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.145690918 CEST	50001	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.145761013 CEST	443	50001	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.146142006 CEST	50001	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.146153927 CEST	443	50001	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.240950108 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:35.241003036 CEST	443	50006	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:35.241084099 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:35.241316080 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:35.241333961 CEST	443	50006	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:35.591819048 CEST	443	50001	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.592015982 CEST	443	50001	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.592142105 CEST	50001	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.592204094 CEST	443	49935	142.250.185.132	192.168.2.5
Oct 17, 2024 08:41:35.592287064 CEST	443	49935	142.250.185.132	192.168.2.5
Oct 17, 2024 08:41:35.592489004 CEST	50001	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.592513084 CEST	443	50001	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.592520952 CEST	49935	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:41:35.592564106 CEST	50001	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.592571974 CEST	443	50001	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.596044064 CEST	50007	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.596096039 CEST	443	50007	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.596230984 CEST	50007	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.596431971 CEST	50007	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.596447945 CEST	443	50007	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.597919941 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.598154068 CEST	443	50003	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.598391056 CEST	50002	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.598414898 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.598969936 CEST	50002	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.598978996 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.599071980 CEST	50003	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.599093914 CEST	443	50003	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.599534035 CEST	50003	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.599540949 CEST	443	50003	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.603188992 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.604604006 CEST	50004	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.604621887 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.605057955 CEST	50004	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.605065107 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.732300997 CEST	443	50005	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.732795954 CEST	50005	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.732876062 CEST	443	50005	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.733072042 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.733146906 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.733222008 CEST	50002	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.733256102 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.733283043 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.733331919 CEST	50002	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.733335972 CEST	50005	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.733390093 CEST	443	50005	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.733469009 CEST	50002	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.733484983 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.733500004 CEST	50002	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.733510017 CEST	443	50002	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.733587027 CEST	443	50003	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.733683109 CEST	443	50003	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.736450911 CEST	50008	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.736485958 CEST	50003	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.736499071 CEST	443	50008	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.736558914 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.736593962 CEST	50003	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.736604929 CEST	443	50003	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.736639023 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.736684084 CEST	50008	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.736730099 CEST	50004	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.736732960 CEST	50008	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.736747980 CEST	443	50008	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.736762047 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.736785889 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.736829996 CEST	50004	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.736901045 CEST	50004	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.736915112 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.736928940 CEST	50004	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.736934900 CEST	443	50004	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.739202976 CEST	50009	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.739295959 CEST	443	50009	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.739423990 CEST	50009	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.739484072 CEST	50010	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.739504099 CEST	443	50010	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.739530087 CEST	50009	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.739557028 CEST	443	50009	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.739581108 CEST	50010	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.739774942 CEST	50010	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.739787102 CEST	443	50010	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.863986969 CEST	443	50005	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.864140034 CEST	443	50005	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.864281893 CEST	50005	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.864355087 CEST	50005	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.864392996 CEST	443	50005	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.864439964 CEST	50005	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.864455938 CEST	443	50005	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.866575003 CEST	50011	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.866617918 CEST	443	50011	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:35.866684914 CEST	50011	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.866808891 CEST	50011	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:35.866823912 CEST	443	50011	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.127027988 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:36.127120018 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:36.127196074 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:36.127557039 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:36.127599001 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:36.264373064 CEST	49935	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:41:36.264440060 CEST	443	49935	142.250.185.132	192.168.2.5
Oct 17, 2024 08:41:36.345892906 CEST	443	50007	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.346363068 CEST	50007	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.346395969 CEST	443	50007	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.346792936 CEST	50007	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.346807003 CEST	443	50007	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.411726952 CEST	443	50006	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:36.411928892 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:36.412332058 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:36.412359953 CEST	443	50006	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:36.412560940 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:36.412573099 CEST	443	50006	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:36.464746952 CEST	443	50008	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.465523005 CEST	50008	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.465558052 CEST	443	50008	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.465934038 CEST	50008	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.465961933 CEST	443	50008	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.471801996 CEST	443	50009	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.472107887 CEST	50009	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.472138882 CEST	443	50009	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.472543001 CEST	50009	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.472553968 CEST	443	50009	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.473189116 CEST	443	50007	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.473386049 CEST	443	50007	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.473480940 CEST	50007	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.473537922 CEST	50007	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.473537922 CEST	50007	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.473562956 CEST	443	50007	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.473573923 CEST	443	50007	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.476433039 CEST	50013	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.476476908 CEST	443	50013	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.476577044 CEST	50013	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.476788998 CEST	50013	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.476803064 CEST	443	50013	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.488778114 CEST	443	50010	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.489244938 CEST	50010	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.489281893 CEST	443	50010	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.489753962 CEST	50010	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.489761114 CEST	443	50010	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.594566107 CEST	443	50008	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.594691992 CEST	443	50008	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.594748974 CEST	443	50008	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.594784021 CEST	50008	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.594852924 CEST	50008	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.594942093 CEST	50008	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.594991922 CEST	443	50008	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.595022917 CEST	50008	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.595038891 CEST	443	50008	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.602339983 CEST	50014	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.602386951 CEST	443	50014	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.602473974 CEST	50014	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.602598906 CEST	50014	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.602613926 CEST	443	50014	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.604345083 CEST	443	50009	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.604443073 CEST	443	50009	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.604509115 CEST	50009	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.604571104 CEST	50009	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.604594946 CEST	443	50009	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.604619026 CEST	50009	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.604626894 CEST	443	50009	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.607228041 CEST	50015	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.607289076 CEST	443	50015	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.607409954 CEST	50015	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.607614994 CEST	50015	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.607631922 CEST	443	50015	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.615011930 CEST	443	50011	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.615463018 CEST	50011	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.615525007 CEST	443	50011	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.615839958 CEST	50011	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.615854979 CEST	443	50011	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.619890928 CEST	443	50010	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.620049953 CEST	443	50010	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.620110035 CEST	50010	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.620151997 CEST	50010	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.620157003 CEST	443	50010	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.620171070 CEST	50010	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.620174885 CEST	443	50010	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.622436047 CEST	50016	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.622454882 CEST	443	50016	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.622535944 CEST	50016	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.622776031 CEST	50016	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.622819901 CEST	443	50016	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.721410036 CEST	443	50006	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:36.721493006 CEST	443	50006	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:36.721600056 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:36.721600056 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:36.721697092 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:36.721744061 CEST	443	50006	34.251.245.69	192.168.2.5
Oct 17, 2024 08:41:36.721776009 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:36.721807957 CEST	50006	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:41:36.751625061 CEST	443	50011	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.751663923 CEST	443	50011	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.751712084 CEST	443	50011	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.751719952 CEST	50011	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.751765013 CEST	50011	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.752938032 CEST	50011	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.752938032 CEST	50011	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.752958059 CEST	443	50011	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.752969980 CEST	443	50011	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.757436037 CEST	50017	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.757467031 CEST	443	50017	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.757534981 CEST	50017	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.758249998 CEST	50017	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:36.758261919 CEST	443	50017	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:36.885993004 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:36.886081934 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:36.887907028 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:36.887922049 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:36.888401031 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:36.892448902 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:36.939405918 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.142218113 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.142254114 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.142313004 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.142369986 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:37.142412901 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.142433882 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:37.142469883 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:37.144032001 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.144078970 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.144121885 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:37.144145012 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.144165993 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:37.144172907 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.144248962 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:37.145971060 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:37.146011114 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.146034002 CEST	50012	443	192.168.2.5	172.202.163.200
Oct 17, 2024 08:41:37.146042109 CEST	443	50012	172.202.163.200	192.168.2.5
Oct 17, 2024 08:41:37.227514029 CEST	443	50013	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.228014946 CEST	50013	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.228030920 CEST	443	50013	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.228636980 CEST	50013	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.228642941 CEST	443	50013	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.347891092 CEST	443	50014	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.348511934 CEST	50014	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.348531008 CEST	443	50014	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.348977089 CEST	50014	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.348983049 CEST	443	50014	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.351783037 CEST	443	50015	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.352236032 CEST	50015	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.352305889 CEST	443	50015	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.352818966 CEST	50015	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.352833033 CEST	443	50015	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.358354092 CEST	443	50013	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.358514071 CEST	443	50013	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.358571053 CEST	50013	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.358721018 CEST	50013	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.358741045 CEST	443	50013	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.358753920 CEST	50013	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.358761072 CEST	443	50013	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.361879110 CEST	50018	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.361928940 CEST	443	50018	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.362150908 CEST	50018	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.362360954 CEST	50018	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.362380028 CEST	443	50018	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.371042013 CEST	443	50016	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.371476889 CEST	50016	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.371526957 CEST	443	50016	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.371896029 CEST	50016	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.371907949 CEST	443	50016	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.476938009 CEST	443	50014	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.476967096 CEST	443	50014	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.477015018 CEST	443	50014	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.477183104 CEST	50014	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.477509022 CEST	50014	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.477536917 CEST	443	50014	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.477551937 CEST	50014	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.477561951 CEST	443	50014	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.480948925 CEST	50019	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.481070042 CEST	443	50019	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.481194973 CEST	50019	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.481430054 CEST	50019	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.481476068 CEST	443	50019	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.483401060 CEST	443	50015	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.483488083 CEST	443	50015	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.483637094 CEST	50015	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.483681917 CEST	50015	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.483681917 CEST	50015	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.483705044 CEST	443	50015	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.483727932 CEST	443	50015	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.484703064 CEST	443	50017	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.485157967 CEST	50017	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.485177994 CEST	443	50017	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.485754967 CEST	50017	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.485759974 CEST	443	50017	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.485886097 CEST	50020	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.485991955 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.486078024 CEST	50020	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.486269951 CEST	50020	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.486303091 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.501593113 CEST	443	50016	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.501782894 CEST	443	50016	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.501880884 CEST	50016	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.501955986 CEST	50016	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.501955986 CEST	50016	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.501990080 CEST	443	50016	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.502019882 CEST	443	50016	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.504283905 CEST	50021	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.504333019 CEST	443	50021	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.504430056 CEST	50021	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.504594088 CEST	50021	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.504610062 CEST	443	50021	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.622203112 CEST	443	50017	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.622236967 CEST	443	50017	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.622306108 CEST	443	50017	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.622414112 CEST	50017	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.622414112 CEST	50017	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.624186993 CEST	50017	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.624214888 CEST	443	50017	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.624231100 CEST	50017	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.624243021 CEST	443	50017	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.627001047 CEST	50022	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.627073050 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:37.627163887 CEST	50022	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.627280951 CEST	50022	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:37.627298117 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.096653938 CEST	443	50018	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.138423920 CEST	50018	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.138453960 CEST	443	50018	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.139070988 CEST	50018	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.139080048 CEST	443	50018	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.230520964 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.231121063 CEST	50020	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.231204033 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.231412888 CEST	50020	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.231427908 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.233676910 CEST	443	50019	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.234076023 CEST	50019	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.234117031 CEST	443	50019	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.234442949 CEST	50019	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.234450102 CEST	443	50019	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.253863096 CEST	443	50021	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.265536070 CEST	443	50018	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.265710115 CEST	443	50018	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.265834093 CEST	50018	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.322232962 CEST	50021	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.338352919 CEST	50021	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.338397026 CEST	443	50021	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.338990927 CEST	50021	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.339004040 CEST	443	50021	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.363436937 CEST	443	50019	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.363656044 CEST	443	50019	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.363768101 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.363796949 CEST	50019	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.364599943 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.364674091 CEST	50020	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.364737034 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.364774942 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.364840031 CEST	50020	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.379538059 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.430716038 CEST	50018	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.430743933 CEST	443	50018	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.430768967 CEST	50018	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.430778027 CEST	443	50018	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.434812069 CEST	50022	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.465460062 CEST	50019	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.465529919 CEST	443	50019	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.465574980 CEST	50019	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.465594053 CEST	443	50019	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.473387003 CEST	443	50021	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.473551989 CEST	443	50021	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.473635912 CEST	50021	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.479003906 CEST	50022	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.479027987 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.481487036 CEST	50022	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.481507063 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.481587887 CEST	50020	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.481587887 CEST	50020	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.481652975 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.481710911 CEST	443	50020	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.512641907 CEST	50021	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.512676001 CEST	443	50021	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.512728930 CEST	50021	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.512741089 CEST	443	50021	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.542243004 CEST	50023	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.542303085 CEST	443	50023	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.542390108 CEST	50023	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.543502092 CEST	50024	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.543553114 CEST	443	50024	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.543621063 CEST	50024	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.543826103 CEST	50023	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.543848991 CEST	443	50023	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.545773029 CEST	50025	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.545835018 CEST	443	50025	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.545916080 CEST	50025	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.546062946 CEST	50024	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.546066999 CEST	50025	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.546078920 CEST	443	50024	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.546082020 CEST	443	50025	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.547085047 CEST	50026	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.547101021 CEST	443	50026	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.547171116 CEST	50026	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.547347069 CEST	50026	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.547358990 CEST	443	50026	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.609452963 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.609529972 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.609596968 CEST	50022	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.609630108 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.609664917 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.609710932 CEST	50022	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.609849930 CEST	50022	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.609869003 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.609879971 CEST	50022	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.609888077 CEST	443	50022	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.612608910 CEST	50027	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.612653017 CEST	443	50027	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:38.612740040 CEST	50027	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.612906933 CEST	50027	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:38.612916946 CEST	443	50027	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.274512053 CEST	443	50024	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.275208950 CEST	50024	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.275252104 CEST	443	50024	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.275595903 CEST	50024	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.275604963 CEST	443	50024	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.287990093 CEST	443	50023	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.288301945 CEST	443	50025	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.288429976 CEST	50023	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.288465023 CEST	443	50023	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.288868904 CEST	50023	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.288877010 CEST	443	50023	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.289088964 CEST	50025	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.289119005 CEST	443	50025	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.289441109 CEST	50025	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.289448977 CEST	443	50025	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.298502922 CEST	443	50026	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.299045086 CEST	50026	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.299062967 CEST	443	50026	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.299525976 CEST	50026	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.299531937 CEST	443	50026	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.362793922 CEST	443	50027	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.364152908 CEST	50027	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.364191055 CEST	443	50027	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.364583015 CEST	50027	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.364588976 CEST	443	50027	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.404823065 CEST	443	50024	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.404911995 CEST	443	50024	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.404974937 CEST	50024	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.405179977 CEST	50024	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.405203104 CEST	443	50024	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.405211926 CEST	50024	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.405216932 CEST	443	50024	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.408202887 CEST	50028	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.408252954 CEST	443	50028	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.408349991 CEST	50028	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.408520937 CEST	50028	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.408534050 CEST	443	50028	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.418925047 CEST	443	50023	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.419001102 CEST	443	50023	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.419059038 CEST	50023	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.419305086 CEST	50023	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.419305086 CEST	50023	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.419339895 CEST	443	50023	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.419361115 CEST	443	50023	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.420310020 CEST	443	50025	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.420485973 CEST	443	50025	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.420747995 CEST	50025	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.420748949 CEST	50025	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.420748949 CEST	50025	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.421643972 CEST	50029	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.421736956 CEST	443	50029	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.421823025 CEST	50029	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.421931028 CEST	50029	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.421971083 CEST	443	50029	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.422362089 CEST	50030	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.422390938 CEST	443	50030	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.422457933 CEST	50030	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.422547102 CEST	50030	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.422569990 CEST	443	50030	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.444060087 CEST	443	50026	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.444449902 CEST	443	50026	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.444504023 CEST	443	50026	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.444550037 CEST	50026	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.444657087 CEST	50026	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.444725990 CEST	50026	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.444772959 CEST	443	50026	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.444806099 CEST	50026	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.444820881 CEST	443	50026	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.446866035 CEST	50031	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.446901083 CEST	443	50031	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.446959972 CEST	50031	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.447078943 CEST	50031	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.447093964 CEST	443	50031	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.497040033 CEST	443	50027	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.497242928 CEST	443	50027	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.497402906 CEST	50027	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.497756004 CEST	50027	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.497777939 CEST	443	50027	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.497787952 CEST	50027	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.497793913 CEST	443	50027	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.500180006 CEST	50032	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.500230074 CEST	443	50032	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.500304937 CEST	50032	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.500421047 CEST	50032	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.500435114 CEST	443	50032	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:39.731697083 CEST	50025	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:39.731770992 CEST	443	50025	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.144923925 CEST	443	50028	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.145910978 CEST	50028	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.145935059 CEST	443	50028	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.146559000 CEST	50028	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.146564960 CEST	443	50028	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.165838957 CEST	443	50029	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.166245937 CEST	50029	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.166322947 CEST	443	50029	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.166564941 CEST	50029	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.166579962 CEST	443	50029	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.197680950 CEST	443	50030	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.198515892 CEST	50030	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.198580027 CEST	443	50030	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.198784113 CEST	50030	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.198798895 CEST	443	50030	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.201189041 CEST	443	50031	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.205087900 CEST	50031	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.205096960 CEST	443	50031	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.205461025 CEST	50031	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.205465078 CEST	443	50031	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.243416071 CEST	443	50032	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.245475054 CEST	50032	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.245507002 CEST	443	50032	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.245842934 CEST	50032	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.245848894 CEST	443	50032	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.284670115 CEST	443	50028	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.284707069 CEST	443	50028	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.284770966 CEST	443	50028	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.284877062 CEST	50028	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.284877062 CEST	50028	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.285020113 CEST	50028	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.285041094 CEST	443	50028	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.285054922 CEST	50028	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.285060883 CEST	443	50028	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.287628889 CEST	50033	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.287729025 CEST	443	50033	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.287837982 CEST	50033	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.288142920 CEST	50033	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.288223982 CEST	443	50033	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.294778109 CEST	443	50029	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.294842958 CEST	443	50029	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.295114994 CEST	50029	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.295114994 CEST	50029	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.295114994 CEST	50029	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.297015905 CEST	50034	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.297101021 CEST	443	50034	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.297359943 CEST	50034	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.297360897 CEST	50034	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.297485113 CEST	443	50034	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.328217983 CEST	443	50030	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.328284979 CEST	443	50030	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.328340054 CEST	443	50030	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.328417063 CEST	50030	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.328418016 CEST	50030	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.328722954 CEST	50030	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.328789949 CEST	443	50030	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.328840971 CEST	50030	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.328860044 CEST	443	50030	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.330631971 CEST	50035	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.330672979 CEST	443	50035	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.330743074 CEST	50035	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.330887079 CEST	50035	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.330904961 CEST	443	50035	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.343938112 CEST	443	50031	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.344003916 CEST	443	50031	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.344090939 CEST	50031	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.344238997 CEST	50031	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.344257116 CEST	443	50031	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.344266891 CEST	50031	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.344273090 CEST	443	50031	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.346240044 CEST	50036	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.346272945 CEST	443	50036	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.346342087 CEST	50036	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.346498966 CEST	50036	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.346504927 CEST	443	50036	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.375477076 CEST	443	50032	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.375565052 CEST	443	50032	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.375664949 CEST	50032	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.376219034 CEST	50032	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.376234055 CEST	443	50032	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.376246929 CEST	50032	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.376252890 CEST	443	50032	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.382339954 CEST	50037	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.382390976 CEST	443	50037	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.382473946 CEST	50037	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.382601976 CEST	50037	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.382611990 CEST	443	50037	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:40.606780052 CEST	50029	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:40.606828928 CEST	443	50029	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.200289965 CEST	443	50036	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.201073885 CEST	50036	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.201091051 CEST	443	50036	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.201539040 CEST	50036	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.201543093 CEST	443	50036	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.202410936 CEST	443	50037	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.204425097 CEST	50037	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.204489946 CEST	443	50037	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.204792976 CEST	50037	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.204807997 CEST	443	50037	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.205918074 CEST	443	50033	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.206378937 CEST	50033	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.206455946 CEST	443	50033	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.206557989 CEST	443	50034	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.206751108 CEST	50033	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.206804991 CEST	443	50033	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.207082987 CEST	50034	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.207144022 CEST	443	50034	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.207429886 CEST	50034	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.207444906 CEST	443	50034	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.209925890 CEST	443	50035	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.210235119 CEST	50035	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.210294962 CEST	443	50035	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.210611105 CEST	50035	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.210624933 CEST	443	50035	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.336123943 CEST	443	50036	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.336184025 CEST	443	50036	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.336406946 CEST	50036	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.336467028 CEST	50036	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.336481094 CEST	443	50036	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.336489916 CEST	50036	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.336496115 CEST	443	50036	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.339108944 CEST	50038	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.339150906 CEST	443	50038	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.339225054 CEST	50038	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.339389086 CEST	50038	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.339397907 CEST	443	50038	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.342242002 CEST	443	50034	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.342308044 CEST	443	50034	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.342547894 CEST	443	50034	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.342628956 CEST	50034	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.342714071 CEST	50034	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.342714071 CEST	50034	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.342760086 CEST	443	50034	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.342788935 CEST	443	50034	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.343806982 CEST	443	50033	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.343899012 CEST	443	50033	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.343961954 CEST	50033	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.344125986 CEST	50033	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.344156981 CEST	443	50033	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.344186068 CEST	50033	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.344202042 CEST	443	50033	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.344660997 CEST	50039	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.344688892 CEST	443	50039	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.344759941 CEST	50039	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.344918013 CEST	50039	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.344934940 CEST	443	50039	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.345124960 CEST	443	50037	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.345220089 CEST	443	50037	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.346142054 CEST	50040	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.346168995 CEST	443	50040	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.346180916 CEST	50037	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.346229076 CEST	50040	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.346244097 CEST	50037	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.346244097 CEST	50037	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.346276999 CEST	443	50037	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.346298933 CEST	443	50037	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.346404076 CEST	50040	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.346417904 CEST	443	50040	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.348139048 CEST	50041	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.348170042 CEST	443	50041	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.348237991 CEST	50041	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.348373890 CEST	50041	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.348390102 CEST	443	50041	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.416981936 CEST	443	50035	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.417154074 CEST	443	50035	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.417268038 CEST	50035	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.417500019 CEST	50035	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.417500019 CEST	50035	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.417546034 CEST	443	50035	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.417570114 CEST	443	50035	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.420600891 CEST	50042	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.420653105 CEST	443	50042	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:41.420748949 CEST	50042	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.420865059 CEST	50042	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:41.420874119 CEST	443	50042	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.091145992 CEST	443	50040	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.091188908 CEST	443	50038	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.091835976 CEST	50040	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.091871023 CEST	443	50040	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.092267990 CEST	50040	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.092276096 CEST	443	50040	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.092479944 CEST	50038	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.092504025 CEST	443	50038	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.092827082 CEST	50038	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.092834949 CEST	443	50038	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.094194889 CEST	443	50041	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.094438076 CEST	50041	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.094465971 CEST	443	50041	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.094794989 CEST	50041	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.094803095 CEST	443	50041	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.102555990 CEST	443	50039	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.105269909 CEST	50039	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.105285883 CEST	443	50039	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.105717897 CEST	50039	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.105724096 CEST	443	50039	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.182332039 CEST	443	50042	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.186239004 CEST	50042	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.186269999 CEST	443	50042	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.186703920 CEST	50042	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.186712027 CEST	443	50042	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.225728989 CEST	443	50040	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.225826025 CEST	443	50040	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.225934029 CEST	50040	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.226191998 CEST	50040	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.226210117 CEST	443	50040	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.226224899 CEST	50040	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.226231098 CEST	443	50040	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.227040052 CEST	443	50041	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.227142096 CEST	443	50038	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.227196932 CEST	443	50041	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.227211952 CEST	443	50038	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.227252960 CEST	50041	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.227427006 CEST	50038	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.227427006 CEST	50038	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.227464914 CEST	50038	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.227483034 CEST	443	50038	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.227514982 CEST	50041	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.227538109 CEST	443	50041	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.227550983 CEST	50041	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.227559090 CEST	443	50041	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.230372906 CEST	50043	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.230397940 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.230472088 CEST	50043	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.230557919 CEST	50044	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.230607033 CEST	50043	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.230621099 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.230705023 CEST	443	50044	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.230771065 CEST	50044	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.230890036 CEST	50044	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.230911970 CEST	443	50044	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.230941057 CEST	50045	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.230973005 CEST	443	50045	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.231025934 CEST	50045	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.231106997 CEST	50045	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.231115103 CEST	443	50045	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.234500885 CEST	443	50039	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.234566927 CEST	443	50039	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.234613895 CEST	50039	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.234719992 CEST	50039	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.234735012 CEST	443	50039	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.234745979 CEST	50039	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.234750986 CEST	443	50039	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.236715078 CEST	50046	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.236732006 CEST	443	50046	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.236807108 CEST	50046	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.236941099 CEST	50046	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.236953020 CEST	443	50046	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.313261032 CEST	443	50042	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.313301086 CEST	443	50042	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.313359976 CEST	443	50042	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.313435078 CEST	50042	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.313474894 CEST	50042	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.313600063 CEST	50042	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.313631058 CEST	443	50042	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.313646078 CEST	50042	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.313657999 CEST	443	50042	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.316344023 CEST	50047	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.316401005 CEST	443	50047	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.316518068 CEST	50047	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.316685915 CEST	50047	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:42.316695929 CEST	443	50047	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.953150988 CEST	443	50045	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.967396021 CEST	443	50044	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.972321987 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.974406004 CEST	443	50046	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:42.997412920 CEST	50045	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.012933016 CEST	50044	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.014879942 CEST	50043	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.031666040 CEST	50046	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.052753925 CEST	50045	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.052791119 CEST	443	50045	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.053086996 CEST	50045	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.053095102 CEST	443	50045	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.053317070 CEST	50044	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.053354025 CEST	443	50044	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.054383993 CEST	50044	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.054395914 CEST	443	50044	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.057060003 CEST	443	50047	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.061885118 CEST	50043	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.061913967 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.062344074 CEST	50043	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.062351942 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.062634945 CEST	50047	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.062653065 CEST	443	50047	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.063015938 CEST	50047	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.063021898 CEST	443	50047	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.063247919 CEST	50046	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.063257933 CEST	443	50046	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.063604116 CEST	50046	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.063607931 CEST	443	50046	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.177608013 CEST	443	50045	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.177687883 CEST	443	50045	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.177736044 CEST	50045	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.178015947 CEST	50045	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.178031921 CEST	443	50045	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.178041935 CEST	50045	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.178046942 CEST	443	50045	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.180941105 CEST	50048	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.180991888 CEST	443	50048	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.181073904 CEST	50048	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.181107998 CEST	443	50044	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.181191921 CEST	443	50044	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.181202888 CEST	50048	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.181220055 CEST	443	50048	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.181236982 CEST	50044	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.181324005 CEST	50044	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.181348085 CEST	443	50044	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.181363106 CEST	50044	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.181370974 CEST	443	50044	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.183414936 CEST	50049	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.183446884 CEST	443	50049	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.183505058 CEST	50049	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.183687925 CEST	50049	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.183701992 CEST	443	50049	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.190875053 CEST	443	50047	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.190973043 CEST	443	50047	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.191184044 CEST	50047	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.191184044 CEST	50047	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.191211939 CEST	50047	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.191225052 CEST	443	50047	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.191236019 CEST	443	50046	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.191278934 CEST	443	50046	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.191328049 CEST	443	50046	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.191327095 CEST	50046	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.191373110 CEST	50046	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.191472054 CEST	50046	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.191488981 CEST	443	50046	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.191499949 CEST	50046	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.191504955 CEST	443	50046	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.193943977 CEST	50050	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.193967104 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.194056988 CEST	50050	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.194271088 CEST	50050	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.194286108 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.194964886 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.194974899 CEST	50051	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.194996119 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.195007086 CEST	443	50051	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.195051908 CEST	50043	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.195067883 CEST	50051	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.195074081 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.195178032 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.195218086 CEST	50043	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.195308924 CEST	50043	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.195323944 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.195338964 CEST	50043	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.195346117 CEST	443	50043	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.195357084 CEST	50051	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.195365906 CEST	443	50051	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.197410107 CEST	50052	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.197452068 CEST	443	50052	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.197554111 CEST	50052	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.197691917 CEST	50052	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.197704077 CEST	443	50052	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.909756899 CEST	443	50049	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.910537958 CEST	50049	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.910562038 CEST	443	50049	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.910974979 CEST	50049	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.910979033 CEST	443	50049	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.913814068 CEST	443	50048	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.914239883 CEST	50048	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.914272070 CEST	443	50048	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.914586067 CEST	50048	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.914594889 CEST	443	50048	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.940773010 CEST	443	50052	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.941298008 CEST	50052	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.941327095 CEST	443	50052	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.941911936 CEST	50052	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.941917896 CEST	443	50052	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.946698904 CEST	443	50051	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.947284937 CEST	50051	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.947305918 CEST	443	50051	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.947891951 CEST	50051	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.947897911 CEST	443	50051	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.955792904 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.959517002 CEST	50050	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.959527969 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:43.959944010 CEST	50050	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:43.959948063 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.040636063 CEST	443	50049	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.040709019 CEST	443	50049	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.040924072 CEST	50049	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.040962934 CEST	50049	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.040982008 CEST	443	50049	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.040992975 CEST	50049	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.041001081 CEST	443	50049	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.043994904 CEST	50053	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.044045925 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.044162035 CEST	50053	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.044401884 CEST	50053	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.044416904 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.048211098 CEST	443	50048	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.048283100 CEST	443	50048	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.048418999 CEST	50048	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.048470974 CEST	50048	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.048495054 CEST	443	50048	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.048510075 CEST	50048	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.048516989 CEST	443	50048	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.050960064 CEST	50054	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.050987005 CEST	443	50054	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.051084995 CEST	50054	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.051273108 CEST	50054	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.051299095 CEST	443	50054	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.107882977 CEST	443	50052	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.107985020 CEST	443	50052	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.107997894 CEST	443	50051	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.108072042 CEST	443	50051	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.108099937 CEST	50052	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.108125925 CEST	50051	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.108298063 CEST	50051	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.108314037 CEST	443	50051	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.108329058 CEST	50052	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.108330011 CEST	50051	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.108336926 CEST	443	50051	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.108354092 CEST	443	50052	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.108370066 CEST	50052	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.108376980 CEST	443	50052	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.109025955 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.109087944 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.109160900 CEST	50050	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.109174013 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.109203100 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.109453917 CEST	50050	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.109469891 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.109483957 CEST	50050	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.109488010 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.109509945 CEST	50050	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.109513998 CEST	443	50050	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.111560106 CEST	50055	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.111589909 CEST	443	50055	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.111901045 CEST	50056	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.111947060 CEST	443	50056	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.111948967 CEST	50055	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.112010956 CEST	50056	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.112200975 CEST	50055	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.112220049 CEST	443	50055	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.112375021 CEST	50056	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.112390041 CEST	443	50056	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.112485886 CEST	50057	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.112535000 CEST	443	50057	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.112601042 CEST	50057	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.112695932 CEST	50057	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.112709045 CEST	443	50057	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.784573078 CEST	443	50054	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.785161018 CEST	50054	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.785206079 CEST	443	50054	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.785604000 CEST	50054	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.785619974 CEST	443	50054	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.792673111 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.793025017 CEST	50053	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.793040991 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.793329000 CEST	50053	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.793339014 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.843450069 CEST	443	50056	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.843940973 CEST	50056	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.843964100 CEST	443	50056	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.844357014 CEST	50056	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.844363928 CEST	443	50056	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.860225916 CEST	443	50057	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.860888958 CEST	50057	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.860949039 CEST	443	50057	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.861186028 CEST	50057	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.861202955 CEST	443	50057	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.862983942 CEST	443	50055	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.863285065 CEST	50055	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.863346100 CEST	443	50055	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.863605976 CEST	50055	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.863620043 CEST	443	50055	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.913995028 CEST	443	50054	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.914197922 CEST	443	50054	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.914290905 CEST	50054	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.914387941 CEST	50054	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.914433002 CEST	443	50054	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.914479017 CEST	50054	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.914494991 CEST	443	50054	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.917721033 CEST	50058	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.917819977 CEST	443	50058	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.917920113 CEST	50058	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.918320894 CEST	50058	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.918400049 CEST	443	50058	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.924122095 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.924138069 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.924194098 CEST	50053	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.924206018 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.924293995 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.924346924 CEST	50053	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.924403906 CEST	50053	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.924403906 CEST	50053	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.924412012 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.924420118 CEST	443	50053	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.926592112 CEST	50059	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.926620960 CEST	443	50059	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.926706076 CEST	50059	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.926868916 CEST	50059	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.926876068 CEST	443	50059	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.973042011 CEST	443	50056	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.973069906 CEST	443	50056	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.973135948 CEST	443	50056	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.973164082 CEST	50056	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.973192930 CEST	50056	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.973417997 CEST	50056	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.973439932 CEST	443	50056	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.973450899 CEST	50056	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.973457098 CEST	443	50056	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.975986958 CEST	50060	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.976022959 CEST	443	50060	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.976109982 CEST	50060	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.976277113 CEST	50060	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.976281881 CEST	443	50060	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.992275000 CEST	443	50057	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.992306948 CEST	443	50057	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.992376089 CEST	443	50057	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.992599964 CEST	50057	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.992599964 CEST	50057	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.992599964 CEST	50057	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.992599964 CEST	50057	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.995009899 CEST	50061	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.995100975 CEST	443	50061	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.995203018 CEST	50061	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.995431900 CEST	50061	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.995450974 CEST	443	50061	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.995681047 CEST	443	50055	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.995702028 CEST	443	50055	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.995760918 CEST	443	50055	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.995908976 CEST	50055	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.995909929 CEST	50055	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.995999098 CEST	50055	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.995999098 CEST	50055	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.996042013 CEST	443	50055	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.996073961 CEST	443	50055	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.998868942 CEST	50062	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.998951912 CEST	443	50062	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:44.999087095 CEST	50062	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.999238968 CEST	50062	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:44.999259949 CEST	443	50062	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.294270992 CEST	50057	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:45.294353008 CEST	443	50057	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.988382101 CEST	443	50059	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.992429018 CEST	50059	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:45.992451906 CEST	443	50059	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.993077040 CEST	50059	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:45.993083000 CEST	443	50059	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.995016098 CEST	443	50062	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.996284008 CEST	443	50060	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.996646881 CEST	443	50058	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.999145031 CEST	50062	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:45.999175072 CEST	443	50062	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.999530077 CEST	50060	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:45.999552011 CEST	443	50060	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.999572039 CEST	50062	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:45.999579906 CEST	443	50062	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:45.999651909 CEST	443	50061	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.000122070 CEST	50060	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.000129938 CEST	443	50060	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.000201941 CEST	50058	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.000231981 CEST	443	50058	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.000477076 CEST	50061	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.000483990 CEST	443	50061	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.000549078 CEST	50058	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.000555992 CEST	443	50058	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.001173973 CEST	50061	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.001178026 CEST	443	50061	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.120439053 CEST	443	50059	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.120511055 CEST	443	50059	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.120562077 CEST	50059	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.120788097 CEST	50059	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.120804071 CEST	443	50059	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.120815039 CEST	50059	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.120820999 CEST	443	50059	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.125046015 CEST	50063	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.125080109 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.125149012 CEST	50063	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.125355005 CEST	50063	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.125365973 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.125478983 CEST	443	50062	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.125545025 CEST	443	50062	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.125613928 CEST	50062	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.125705004 CEST	50062	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.125705004 CEST	50062	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.125749111 CEST	443	50062	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.125782013 CEST	443	50062	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.128338099 CEST	443	50058	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.128354073 CEST	443	50058	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.128390074 CEST	50064	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.128396988 CEST	443	50058	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.128423929 CEST	50058	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.128433943 CEST	443	50064	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.128514051 CEST	50058	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.128524065 CEST	50064	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.128678083 CEST	50064	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.128691912 CEST	443	50064	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.128897905 CEST	50058	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.128917933 CEST	443	50058	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.128936052 CEST	50058	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.128942013 CEST	443	50058	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.130472898 CEST	443	50060	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.130567074 CEST	443	50060	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.130618095 CEST	50060	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.130712032 CEST	50060	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.130723000 CEST	443	50060	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.130733013 CEST	50060	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.130739927 CEST	443	50060	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.130909920 CEST	443	50061	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.131124973 CEST	443	50061	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.131172895 CEST	50061	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.131339073 CEST	50061	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.131354094 CEST	443	50061	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.131412029 CEST	50061	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.131432056 CEST	443	50061	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.132061958 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.132107019 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.132170916 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.132534027 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.132549047 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.133421898 CEST	50066	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.133431911 CEST	443	50066	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.133517027 CEST	50066	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.133625984 CEST	50066	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.133637905 CEST	443	50066	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.133780003 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.133793116 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.133852959 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.134020090 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.134037971 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.849877119 CEST	443	50064	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.850465059 CEST	50064	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.850506067 CEST	443	50064	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.850939035 CEST	50064	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.850945950 CEST	443	50064	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.865376949 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.865777016 CEST	50063	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.865797997 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.866137028 CEST	50063	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.866142035 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.870635986 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.870917082 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.871014118 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.871222973 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.871237040 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.873888969 CEST	443	50066	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.875307083 CEST	50066	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.875329018 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.875365973 CEST	443	50066	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.875562906 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.875575066 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.875922918 CEST	50066	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.875955105 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.875958920 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.875976086 CEST	443	50066	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.978339911 CEST	443	50064	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.978409052 CEST	443	50064	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.978529930 CEST	50064	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.978545904 CEST	443	50064	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.978607893 CEST	50064	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.978868961 CEST	50064	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.978898048 CEST	443	50064	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.978912115 CEST	50064	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.978919983 CEST	443	50064	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.982311010 CEST	50068	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.982345104 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.982438087 CEST	50068	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.982675076 CEST	50068	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.982703924 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.997380972 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.997404099 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.997498035 CEST	50063	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.997513056 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.997559071 CEST	50063	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.997562885 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.997574091 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.997618914 CEST	50063	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.997636080 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:46.997663021 CEST	50063	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:46.997668028 CEST	443	50063	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.000408888 CEST	50069	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.000482082 CEST	443	50069	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.000586987 CEST	50069	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.000765085 CEST	50069	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.000778913 CEST	443	50069	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.006344080 CEST	443	50066	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.006472111 CEST	443	50066	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.006616116 CEST	443	50066	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.006645918 CEST	50066	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.006705999 CEST	50066	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.006742954 CEST	50066	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.006784916 CEST	443	50066	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.006817102 CEST	50066	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.006833076 CEST	443	50066	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.009221077 CEST	50070	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.009304047 CEST	443	50070	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.009398937 CEST	50070	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.009533882 CEST	50070	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.009555101 CEST	443	50070	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.114123106 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.114155054 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.114286900 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.114348888 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.114444971 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.121061087 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.121068954 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.121129990 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.121134996 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.121170998 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.121211052 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.121223927 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.121236086 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.121236086 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.121236086 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.121275902 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.121296883 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.121321917 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.124228954 CEST	50071	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.124257088 CEST	443	50071	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.124356985 CEST	50071	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.124583006 CEST	50071	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.124594927 CEST	443	50071	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.128278971 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.128325939 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.128360033 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.128387928 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.128405094 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.128432035 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.128469944 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.128571033 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.128571033 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.128595114 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.128609896 CEST	50067	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.128617048 CEST	443	50067	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.130646944 CEST	50072	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.130731106 CEST	443	50072	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.130815983 CEST	50072	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.130995989 CEST	50072	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.131023884 CEST	443	50072	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.419322968 CEST	50065	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.419435978 CEST	443	50065	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.728461027 CEST	443	50069	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.729252100 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.729340076 CEST	50069	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.729406118 CEST	443	50069	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.729617119 CEST	50068	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.729640961 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.729804039 CEST	50069	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.729887962 CEST	443	50069	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.730254889 CEST	50068	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.730261087 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.764374018 CEST	443	50070	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.765456915 CEST	50070	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.765516043 CEST	443	50070	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.765718937 CEST	50070	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.765737057 CEST	443	50070	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.854566097 CEST	443	50071	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.855359077 CEST	50071	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.855372906 CEST	443	50071	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.855948925 CEST	50071	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.855953932 CEST	443	50071	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.857497931 CEST	443	50069	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.857525110 CEST	443	50069	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.857575893 CEST	443	50069	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.857603073 CEST	50069	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.857676029 CEST	50069	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.857861042 CEST	50069	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.857908964 CEST	443	50069	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.857937098 CEST	50069	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.857952118 CEST	443	50069	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.858859062 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.858918905 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.858988047 CEST	50068	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.858999014 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.859040022 CEST	50068	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.859059095 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.859078884 CEST	50068	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.859105110 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.859117985 CEST	50068	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.859117985 CEST	50068	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.859127045 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.859133005 CEST	443	50068	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.860923052 CEST	50073	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.860975027 CEST	443	50073	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.861076117 CEST	50073	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.861198902 CEST	50073	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.861219883 CEST	443	50073	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.861234903 CEST	50074	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.861242056 CEST	443	50074	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.861301899 CEST	50074	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.861377954 CEST	50074	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.861388922 CEST	443	50074	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.868628025 CEST	443	50072	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.869000912 CEST	50072	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.869060993 CEST	443	50072	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.869365931 CEST	50072	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.869379997 CEST	443	50072	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.894248962 CEST	443	50070	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.894395113 CEST	443	50070	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.894572020 CEST	50070	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.894634962 CEST	50070	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.894634962 CEST	50070	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.894664049 CEST	443	50070	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.894686937 CEST	443	50070	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.897099972 CEST	50075	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.897180080 CEST	443	50075	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.897280931 CEST	50075	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.897447109 CEST	50075	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.897476912 CEST	443	50075	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.983594894 CEST	443	50071	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.983664989 CEST	443	50071	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.983856916 CEST	50071	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.983930111 CEST	50071	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.983942986 CEST	443	50071	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.983953953 CEST	50071	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.983958006 CEST	443	50071	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.987102032 CEST	50076	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.987195015 CEST	443	50076	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.987294912 CEST	50076	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.987456083 CEST	50076	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.987476110 CEST	443	50076	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.999080896 CEST	443	50072	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.999141932 CEST	443	50072	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.999233961 CEST	50072	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.999427080 CEST	50072	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.999428034 CEST	50072	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:47.999470949 CEST	443	50072	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:47.999500990 CEST	443	50072	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.002589941 CEST	50077	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.002616882 CEST	443	50077	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.002690077 CEST	50077	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.002787113 CEST	50077	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.002794027 CEST	443	50077	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.601066113 CEST	443	50074	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.601598978 CEST	50074	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.601635933 CEST	443	50074	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.602051973 CEST	50074	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.602056980 CEST	443	50074	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.604971886 CEST	443	50073	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.605221033 CEST	50073	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.605228901 CEST	443	50073	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.605551958 CEST	50073	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.605556011 CEST	443	50073	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.632699966 CEST	443	50075	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.635468960 CEST	50075	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.635533094 CEST	443	50075	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.635998011 CEST	50075	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.636050940 CEST	443	50075	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.719691038 CEST	443	50076	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.722609997 CEST	50076	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.722649097 CEST	443	50076	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.723086119 CEST	50076	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.723093987 CEST	443	50076	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.731800079 CEST	443	50074	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.732031107 CEST	443	50074	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.732079029 CEST	50074	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.732088089 CEST	443	50074	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.732291937 CEST	50074	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.732291937 CEST	50074	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.732291937 CEST	50074	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.733609915 CEST	443	50073	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.733711004 CEST	443	50073	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.733755112 CEST	50073	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.733827114 CEST	50073	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.733845949 CEST	443	50073	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.733855009 CEST	50073	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.733860016 CEST	443	50073	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.735466003 CEST	50078	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.735512972 CEST	443	50078	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.735603094 CEST	50078	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.735718966 CEST	50078	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.735733032 CEST	443	50078	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.746602058 CEST	443	50077	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.746927977 CEST	50077	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.746939898 CEST	443	50077	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.747526884 CEST	50077	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.747531891 CEST	443	50077	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.760323048 CEST	443	50075	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.760476112 CEST	443	50075	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.760541916 CEST	50075	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.760684013 CEST	50075	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.760705948 CEST	443	50075	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.760720015 CEST	50075	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.760727882 CEST	443	50075	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.848010063 CEST	443	50076	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.848083019 CEST	443	50076	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.848248005 CEST	50076	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.848329067 CEST	50076	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.848329067 CEST	50076	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.848373890 CEST	443	50076	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.848400116 CEST	443	50076	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.878272057 CEST	443	50077	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.878436089 CEST	443	50077	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.878595114 CEST	50077	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.878618956 CEST	50077	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.878632069 CEST	443	50077	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:48.878640890 CEST	50077	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:48.878647089 CEST	443	50077	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:49.044203997 CEST	50074	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:49.044229984 CEST	443	50074	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:49.472366095 CEST	443	50078	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:49.472908974 CEST	50078	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:49.472945929 CEST	443	50078	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:49.473370075 CEST	50078	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:49.473375082 CEST	443	50078	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:49.857732058 CEST	443	50078	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:49.857822895 CEST	443	50078	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:49.857887983 CEST	50078	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:49.858086109 CEST	50078	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:49.858109951 CEST	443	50078	13.107.246.45	192.168.2.5
Oct 17, 2024 08:41:49.858119965 CEST	50078	443	192.168.2.5	13.107.246.45
Oct 17, 2024 08:41:49.858125925 CEST	443	50078	13.107.246.45	192.168.2.5
Oct 17, 2024 08:42:08.076186895 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:42:08.076250076 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:42:17.894903898 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:42:17.895013094 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:42:17.895107985 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:42:18.264730930 CEST	49920	443	192.168.2.5	34.251.245.69
Oct 17, 2024 08:42:18.264805079 CEST	443	49920	34.251.245.69	192.168.2.5
Oct 17, 2024 08:42:24.545142889 CEST	50082	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:42:24.545238972 CEST	443	50082	142.250.185.132	192.168.2.5
Oct 17, 2024 08:42:24.545339108 CEST	50082	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:42:24.545594931 CEST	50082	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:42:24.545627117 CEST	443	50082	142.250.185.132	192.168.2.5
Oct 17, 2024 08:42:25.389549971 CEST	443	50082	142.250.185.132	192.168.2.5
Oct 17, 2024 08:42:25.389919996 CEST	50082	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:42:25.389952898 CEST	443	50082	142.250.185.132	192.168.2.5
Oct 17, 2024 08:42:25.390399933 CEST	443	50082	142.250.185.132	192.168.2.5
Oct 17, 2024 08:42:25.390700102 CEST	50082	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:42:25.390763998 CEST	443	50082	142.250.185.132	192.168.2.5
Oct 17, 2024 08:42:25.434627056 CEST	50082	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:42:35.411150932 CEST	443	50082	142.250.185.132	192.168.2.5
Oct 17, 2024 08:42:35.411242008 CEST	443	50082	142.250.185.132	192.168.2.5
Oct 17, 2024 08:42:35.411457062 CEST	50082	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:42:36.264349937 CEST	50082	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:42:36.264415026 CEST	443	50082	142.250.185.132	192.168.2.5
Oct 17, 2024 08:43:24.613910913 CEST	50084	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:43:24.613975048 CEST	443	50084	142.250.185.132	192.168.2.5
Oct 17, 2024 08:43:24.614063025 CEST	50084	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:43:24.614428997 CEST	50084	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:43:24.614447117 CEST	443	50084	142.250.185.132	192.168.2.5
Oct 17, 2024 08:43:25.511854887 CEST	443	50084	142.250.185.132	192.168.2.5
Oct 17, 2024 08:43:25.512183905 CEST	50084	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:43:25.512252092 CEST	443	50084	142.250.185.132	192.168.2.5
Oct 17, 2024 08:43:25.513432026 CEST	443	50084	142.250.185.132	192.168.2.5
Oct 17, 2024 08:43:25.514087915 CEST	50084	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:43:25.514313936 CEST	443	50084	142.250.185.132	192.168.2.5
Oct 17, 2024 08:43:25.559724092 CEST	50084	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:43:35.505717039 CEST	443	50084	142.250.185.132	192.168.2.5
Oct 17, 2024 08:43:35.505887032 CEST	443	50084	142.250.185.132	192.168.2.5
Oct 17, 2024 08:43:35.505997896 CEST	50084	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:43:36.264221907 CEST	50084	443	192.168.2.5	142.250.185.132
Oct 17, 2024 08:43:36.264292955 CEST	443	50084	142.250.185.132	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 08:40:55.524811983 CEST	52895	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:40:55.552810907 CEST	53	52895	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:20.118232012 CEST	53	64296	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:20.142693996 CEST	53	53249	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:21.396400928 CEST	53	60528	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:22.131448984 CEST	61024	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:22.132920027 CEST	64811	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:22.156955957 CEST	53	61024	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:22.177856922 CEST	53	64811	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:23.441164017 CEST	61998	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:23.441299915 CEST	61519	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:23.473736048 CEST	53	61998	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:23.482287884 CEST	53	61519	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:24.483407021 CEST	60633	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:24.483527899 CEST	49329	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:24.490044117 CEST	53	60633	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:24.490178108 CEST	53	49329	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:26.309815884 CEST	49903	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:26.309953928 CEST	52528	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:26.323909044 CEST	53	52528	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:26.338510036 CEST	50765	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:26.338695049 CEST	65018	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:26.344873905 CEST	53	49903	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:26.356666088 CEST	53	50765	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:26.358736992 CEST	53	65018	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:27.133985043 CEST	62781	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:27.134125948 CEST	62910	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:27.147767067 CEST	53	62910	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:27.151684999 CEST	53	62781	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:27.364217997 CEST	62049	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:27.364356041 CEST	62916	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:27.382968903 CEST	53	62916	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:27.384507895 CEST	53	62049	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:28.178369999 CEST	59356	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:28.178585052 CEST	50273	53	192.168.2.5	1.1.1.1
Oct 17, 2024 08:41:28.218995094 CEST	53	50273	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:28.227885008 CEST	53	59356	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:39.146858931 CEST	53	49783	1.1.1.1	192.168.2.5
Oct 17, 2024 08:41:57.958758116 CEST	53	51926	1.1.1.1	192.168.2.5
Oct 17, 2024 08:42:19.695333958 CEST	53	58208	1.1.1.1	192.168.2.5
Oct 17, 2024 08:42:20.787373066 CEST	53	62032	1.1.1.1	192.168.2.5
Oct 17, 2024 08:42:48.489974022 CEST	53	57619	1.1.1.1	192.168.2.5
Oct 17, 2024 08:43:32.804322004 CEST	53	53261	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 17, 2024 08:41:22.177944899 CEST	192.168.2.5	1.1.1.1	c264	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 17, 2024 08:40:55.524811983 CEST	192.168.2.5	1.1.1.1	0x2555	Standard query (0)	https.www.secure.kb4.io	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:22.131448984 CEST	192.168.2.5	1.1.1.1	0x6995	Standard query (0)	https.www.secure.kb4.io	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:22.132920027 CEST	192.168.2.5	1.1.1.1	0x9f14	Standard query (0)	https.www.secure.kb4.io	65	IN (0x0001)	false
Oct 17, 2024 08:41:23.441164017 CEST	192.168.2.5	1.1.1.1	0x5102	Standard query (0)	secure.encryptedconnection.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:23.441299915 CEST	192.168.2.5	1.1.1.1	0x370c	Standard query (0)	secure.encryptedconnection.net	65	IN (0x0001)	false
Oct 17, 2024 08:41:24.483407021 CEST	192.168.2.5	1.1.1.1	0x1a1d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:24.483527899 CEST	192.168.2.5	1.1.1.1	0x5e49	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 17, 2024 08:41:26.309815884 CEST	192.168.2.5	1.1.1.1	0x2cfc	Standard query (0)	www.lombardins.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.309953928 CEST	192.168.2.5	1.1.1.1	0x1aa6	Standard query (0)	www.lombardins.com	65	IN (0x0001)	false
Oct 17, 2024 08:41:26.338510036 CEST	192.168.2.5	1.1.1.1	0xc5b9	Standard query (0)	helpimg.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.338695049 CEST	192.168.2.5	1.1.1.1	0x5410	Standard query (0)	helpimg.s3.amazonaws.com	65	IN (0x0001)	false
Oct 17, 2024 08:41:27.133985043 CEST	192.168.2.5	1.1.1.1	0x6d1d	Standard query (0)	www.lombardins.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.134125948 CEST	192.168.2.5	1.1.1.1	0xe4c2	Standard query (0)	www.lombardins.com	65	IN (0x0001)	false
Oct 17, 2024 08:41:27.364217997 CEST	192.168.2.5	1.1.1.1	0x3c7	Standard query (0)	helpimg.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.364356041 CEST	192.168.2.5	1.1.1.1	0x7ae9	Standard query (0)	helpimg.s3.amazonaws.com	65	IN (0x0001)	false
Oct 17, 2024 08:41:28.178369999 CEST	192.168.2.5	1.1.1.1	0x176b	Standard query (0)	secure.encryptedconnection.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:28.178585052 CEST	192.168.2.5	1.1.1.1	0xac97	Standard query (0)	secure.encryptedconnection.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 17, 2024 08:40:55.552810907 CEST	1.1.1.1	192.168.2.5	0x2555	No error (0)	https.www.secure.kb4.io	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:40:55.552810907 CEST	1.1.1.1	192.168.2.5	0x2555	No error (0)	landing.eu.knowbe4.com		34.251.245.69	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:40:55.552810907 CEST	1.1.1.1	192.168.2.5	0x2555	No error (0)	landing.eu.knowbe4.com		52.49.180.15	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:03.058332920 CEST	1.1.1.1	192.168.2.5	0x7daa	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:22.156955957 CEST	1.1.1.1	192.168.2.5	0x6995	No error (0)	https.www.secure.kb4.io	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:22.156955957 CEST	1.1.1.1	192.168.2.5	0x6995	No error (0)	landing.eu.knowbe4.com		34.251.245.69	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:22.156955957 CEST	1.1.1.1	192.168.2.5	0x6995	No error (0)	landing.eu.knowbe4.com		52.49.180.15	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:22.177856922 CEST	1.1.1.1	192.168.2.5	0x9f14	No error (0)	https.www.secure.kb4.io	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:23.473736048 CEST	1.1.1.1	192.168.2.5	0x5102	No error (0)	secure.encryptedconnection.net	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:23.473736048 CEST	1.1.1.1	192.168.2.5	0x5102	No error (0)	landing.eu.knowbe4.com		34.251.245.69	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:23.473736048 CEST	1.1.1.1	192.168.2.5	0x5102	No error (0)	landing.eu.knowbe4.com		52.49.180.15	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:23.482287884 CEST	1.1.1.1	192.168.2.5	0x370c	No error (0)	secure.encryptedconnection.net	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:24.490044117 CEST	1.1.1.1	192.168.2.5	0x1a1d	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:24.490178108 CEST	1.1.1.1	192.168.2.5	0x5e49	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 17, 2024 08:41:26.323909044 CEST	1.1.1.1	192.168.2.5	0x1aa6	No error (0)	www.lombardins.com			65	IN (0x0001)	false
Oct 17, 2024 08:41:26.344873905 CEST	1.1.1.1	192.168.2.5	0x2cfc	No error (0)	www.lombardins.com		104.18.31.107	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.344873905 CEST	1.1.1.1	192.168.2.5	0x2cfc	No error (0)	www.lombardins.com		104.18.30.107	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.356666088 CEST	1.1.1.1	192.168.2.5	0xc5b9	No error (0)	helpimg.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:26.356666088 CEST	1.1.1.1	192.168.2.5	0xc5b9	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:26.356666088 CEST	1.1.1.1	192.168.2.5	0xc5b9	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.103.156	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.356666088 CEST	1.1.1.1	192.168.2.5	0xc5b9	No error (0)	s3-w.us-east-1.amazonaws.com		16.15.178.100	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.356666088 CEST	1.1.1.1	192.168.2.5	0xc5b9	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.29.222	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.356666088 CEST	1.1.1.1	192.168.2.5	0xc5b9	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.65.169	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.356666088 CEST	1.1.1.1	192.168.2.5	0xc5b9	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.198.33	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.356666088 CEST	1.1.1.1	192.168.2.5	0xc5b9	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.96.105	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.356666088 CEST	1.1.1.1	192.168.2.5	0xc5b9	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.163.73	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.356666088 CEST	1.1.1.1	192.168.2.5	0xc5b9	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.210.57	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:26.358736992 CEST	1.1.1.1	192.168.2.5	0x5410	No error (0)	helpimg.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:26.358736992 CEST	1.1.1.1	192.168.2.5	0x5410	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:27.147767067 CEST	1.1.1.1	192.168.2.5	0xe4c2	No error (0)	www.lombardins.com			65	IN (0x0001)	false
Oct 17, 2024 08:41:27.151684999 CEST	1.1.1.1	192.168.2.5	0x6d1d	No error (0)	www.lombardins.com		104.18.31.107	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.151684999 CEST	1.1.1.1	192.168.2.5	0x6d1d	No error (0)	www.lombardins.com		104.18.30.107	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.382968903 CEST	1.1.1.1	192.168.2.5	0x7ae9	No error (0)	helpimg.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:27.382968903 CEST	1.1.1.1	192.168.2.5	0x7ae9	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:27.384507895 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	helpimg.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:27.384507895 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:27.384507895 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.31.150	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.384507895 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.198.145	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.384507895 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.29.254	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.384507895 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.88.12	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.384507895 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.40.129	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.384507895 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.179.179	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.384507895 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.165.49	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:27.384507895 CEST	1.1.1.1	192.168.2.5	0x3c7	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.100.41	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:28.218995094 CEST	1.1.1.1	192.168.2.5	0xac97	No error (0)	secure.encryptedconnection.net	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:28.227885008 CEST	1.1.1.1	192.168.2.5	0x176b	No error (0)	secure.encryptedconnection.net	landing.eu.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 08:41:28.227885008 CEST	1.1.1.1	192.168.2.5	0x176b	No error (0)	landing.eu.knowbe4.com		34.251.245.69	A (IP address)	IN (0x0001)	false
Oct 17, 2024 08:41:28.227885008 CEST	1.1.1.1	192.168.2.5	0x176b	No error (0)	landing.eu.knowbe4.com		52.49.180.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https.www.secure.kb4.io

otelrules.azureedge.net

slscr.update.microsoft.com

https:

secure.encryptedconnection.net

www.lombardins.com

helpimg.s3.amazonaws.com

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-17 06:40:54 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-17 06:40:54 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 17 Oct 2024 06:39:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: d2456181-e5ee-4fee-98b0-06288d21d8b0 PPServer: PPV: 30 H: SN1PEPF0002FA79 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:40:54 GMT Connection: close Content-Length: 1276
2024-10-17 06:40:54 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49717	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-17 06:40:56 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-17 06:40:56 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 17 Oct 2024 06:39:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 6402c064-6cb2-4072-a73b-e50b60e23537 PPServer: PPV: 30 H: BL02EPF0001D887 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:40:56 GMT Connection: close Content-Length: 1276
2024-10-17 06:40:56 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49718	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:56 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-17 06:40:56 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 67 62 61 6a 78 71 6e 65 6c 76 70 63 66 78 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 6e 4d 2b 58 71 64 71 23 38 79 73 4a 6a 4a 67 4d 6d 64 30 53 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02gbajxqnelvpcfx</Membername><Password>nM+Xqdq#8ysJjJgMmd0S</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-17 06:40:58 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Thu, 17 Oct 2024 06:39:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: dcdb24fc-088b-42aa-929a-d77942bb6230 PPServer: PPV: 30 H: SN1PEPF0002F9FF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:40:57 GMT Connection: close Content-Length: 17166
2024-10-17 06:40:58 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 30 31 39 35 41 36 41 41 46 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 31 33 34 36 37 65 39 61 2d 65 63 35 32 2d 34 66 33 31 2d 62 36 61 39 2d 66 65 62 30 66 61 37 35 36 66 31 39 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>00184010195A6AAF</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="13467e9a-ec52-4f31-b6a9-feb0fa756f19" LicenseID="3252b20c-d425-4711
2024-10-17 06:40:58 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49719	34.251.245.69	443	180	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:56 UTC	419	OUT	GET /XOUJPNkVXNEFDSXNvYUpqeXNSR3BNT2ovWHFVU1ZwbTQ1TVo4aElvME1kZ2hqTDFkV2VaVitnbGgrZC9OYjFFVlRNQ0xuWEJtV1FRNXVZTTM4a3cxUVRyQnJkckIweFNXbG11OXhPRisyQjY1UVZ0ck4vTkx1ek5hZUE9PS0tR3R4Ymx5Q293V2cvNXdiVy0tdnZVNk9tTUlRdEZ1SHVUUGpodEh6QT09?cid=284390382 HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16) Accept-Encoding: gzip, deflate Host: https.www.secure.kb4.io Connection: Keep-Alive
2024-10-17 06:40:57 UTC	486	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:40:56 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 240a1606-e0e0-4e46-b30e-4ae9c2c87b56 X-Runtime: 0.103654 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:58 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:40:58 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:40:58 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 14 Oct 2024 13:20:05 GMT ETag: "0x8DCEC52EAEA89D6" x-ms-request-id: 0d9e48e6-501e-0035-0f97-1ec923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064058Z-r197bdfb6b4kkrkjmxpfy2et1000000009fg00000000b1f2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:40:58 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-17 06:40:58 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-17 06:40:58 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-17 06:40:58 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-17 06:40:58 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-17 06:40:58 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-17 06:40:58 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-17 06:40:59 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-17 06:40:59 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-17 06:40:59 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49723	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-17 06:40:59 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-17 06:41:00 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 17 Oct 2024 06:40:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30389.5 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_SN1 x-ms-request-id: 64064e37-4bc3-4f7a-8ab4-c0b7e476d943 PPServer: PPV: 30 H: SN1PEPF0002F1BD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:41:00 GMT Connection: close Content-Length: 11392
2024-10-17 06:41:00 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49724	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:59 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x4shzDNpudrZyDn&MD=zAydarpR HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-17 06:40:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 13101c3f-cbe2-4eb0-8f4b-acb13bee3c29 MS-RequestId: f697283f-104a-4dde-9eff-4acf2377ee82 MS-CV: erwadW8mLkGHLSHC.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 17 Oct 2024 06:40:59 GMT Connection: close Content-Length: 24490
2024-10-17 06:40:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-17 06:40:59 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:59 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:40:59 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 43a19f6a-101e-008e-12d8-1ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064059Z-r197bdfb6b4kzncfk35mqx2yu400000009c0000000009yw3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:00 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:59 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:00 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:40:59 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 2bfbe8ba-001e-00ad-34d8-1e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064059Z-16b659b4499j6gq7pkfa2qzkk400000008m0000000000z7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:00 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:59 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:00 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:40:59 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: fe1af26d-601e-00ab-11d8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064059Z-15b8d89586fwzdd8ab09pbrekn00000002x000000000fn36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:00 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:59 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:00 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:40:59 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c8d8f407-d01e-005a-22d8-1e7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064059Z-16b659b4499f5gh931bbxe97rs000000084000000000kp06 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:00 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:40:59 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:40:59 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b1f12986-201e-0085-35d8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064059Z-16b659b449999m8hsuhyf00exs000000099g00000000ez35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:00 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:00 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ad3de8e9-901e-0064-05d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064100Z-15b8d89586fx2hlt035xdehq58000000039g000000004mny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:00 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:00 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 01fc4235-701e-0032-5afa-1fa540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064100Z-r197bdfb6b4qpk6v9629ad4b5s00000001h0000000000yen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:00 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:00 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3d3525b4-b01e-0001-72d8-1e46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064100Z-15b8d89586fcvr6pym2snavm4w000000035g00000000cx2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:00 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 2b077638-201e-003c-08d8-1e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064100Z-16b659b44994sjcfes83c39y400000000740000000006xz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:00 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:00 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 52ecfd05-901e-0029-01d8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064100Z-16b659b4499tswxxb16erk3cdn00000009ug00000000e7my x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:00 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:01 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 2ef95996-601e-0070-2cd8-1ea0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064101Z-15b8d89586fmhkw4gksnr1w3ds0000000370000000004p7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:01 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ad3e2c7c-901e-0064-12d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064101Z-15b8d89586fbt6nfd56ex08ru400000003c0000000000018 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:01 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:01 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 84133f47-001e-0014-21d8-1e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064101Z-16b659b44994gzgd4bz42hx7vg00000008gg00000000exvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:01 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 51d0ecd1-b01e-0098-43d8-1ecead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064101Z-r197bdfb6b4vlqfn9hfre6k1s800000001d0000000002yun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:01 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:01 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:01 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0c01d776-601e-0084-1bd8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064101Z-16b659b4499vb6rgub5604hgz0000000086g000000004f54 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49736	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-17 06:41:02 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-17 06:41:02 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 17 Oct 2024 06:40:02 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30389.5 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_SN1 x-ms-request-id: d531502c-3117-4c28-b102-6b15c53ca34a PPServer: PPV: 30 H: SN1PEPF0002F1B6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:41:02 GMT Connection: close Content-Length: 11392
2024-10-17 06:41:02 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:02 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:02 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 36d9383c-e01e-0051-1394-1f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064102Z-15b8d89586f8l5967udr7u2zg400000001tg0000000024pg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:02 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:02 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:02 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 7ef348a1-e01e-0051-48d8-1e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064102Z-16b659b4499rgn6gzhcff90q8g00000009bg000000009cy0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:02 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:02 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:02 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: ad3e2dfb-901e-0064-71d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064102Z-16b659b44998rw28css0tq67fn0000000ar000000000c85v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:02 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:02 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fe1afdc6-601e-00ab-1fd8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064102Z-16b659b4499j6g8p9q09hdsh1000000008u0000000006wk1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:02 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:02 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:02 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 72fae4a7-c01e-000b-6fd8-1ee255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064102Z-r197bdfb6b42sc4ddemybqpm1400000009kg000000005ukk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:02 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:03 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 22e262fd-c01e-008d-23d8-1e2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064103Z-15b8d89586flzzksd4nk2msxr400000002f000000000c57q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:03 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:03 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 96577f27-301e-0099-1ad8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064103Z-15b8d89586fxdh48yvzh6as6u40000000360000000002fva x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:03 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:03 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:03 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ff358c34-401e-0064-2ed8-1e54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064103Z-16b659b44994sjcfes83c39y40000000076g000000001mw4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:03 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:03 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:03 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: c7f49864-601e-003d-6fd8-1e6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064103Z-16b659b44994gzgd4bz42hx7vg00000008qg0000000007dh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:03 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:03 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: b1f13374-201e-0085-05d8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064103Z-16b659b4499mcktpfn1m4deuag000000078g00000000hpz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:03 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49747	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:03 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-17 06:41:03 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-17 06:41:03 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 17 Oct 2024 06:40:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 9d0e0b3a-e2c8-4e4b-8319-28e38feddf16 PPServer: PPV: 30 H: BL02EPF0001D740 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:41:03 GMT Connection: close Content-Length: 1918
2024-10-17 06:41:03 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:04 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:04 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: a14da665-f01e-003f-4ed8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064104Z-15b8d89586fsx9lfqmgrbzpgmg00000003c000000000005b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:04 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:04 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 783e1ebc-401e-00ac-5ed8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064104Z-15b8d89586f8nxpt6pvtkfw3pg00000002zg00000000fwt0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:04 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 619deb8e-b01e-005c-5ed8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064104Z-16b659b4499v5jm96nrcwszga000000007zg00000000gm6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:04 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:04 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:04 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: ff35c8d8-401e-0064-01d8-1e54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064104Z-16b659b44999mb85a5wquzbrz800000007a0000000001axy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:04 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:04 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:04 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: dd484488-801e-0035-08d8-1e752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064104Z-16b659b4499r9jvzdsrvx9g86w00000007sg000000008d18 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:05 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49761	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-17 06:41:05 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-17 06:41:05 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 17 Oct 2024 06:40:05 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BL2 x-ms-request-id: dd54d9cb-f330-4dc3-a4e2-a6b08b0a2f15 PPServer: PPV: 30 H: BL02EPF0001D794 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:41:05 GMT Connection: close Content-Length: 11412
2024-10-17 06:41:05 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49760	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-17 06:41:05 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-17 06:41:05 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 17 Oct 2024 06:40:05 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: efbd980a-9819-40e5-9104-78779b2cbc2d PPServer: PPV: 30 H: BL02EPF0001D984 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:41:04 GMT Connection: close Content-Length: 1918
2024-10-17 06:41:05 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:05 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 2a2929eb-001e-0065-08d8-1e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064105Z-15b8d89586fmhkw4gksnr1w3ds00000003900000000011eb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:05 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:05 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:05 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: a7eb38d6-901e-005b-12d8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064105Z-16b659b44994c5rr2b3ze9shcc00000008n000000000an83 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:05 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:05 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 20e65ee1-a01e-000d-7cd8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064105Z-16b659b4499gh2srh1fh903xkw00000009b000000000aan5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:05 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:05 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 68e1e18e-f01e-005d-01d8-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064105Z-16b659b4499j6gq7pkfa2qzkk400000008e000000000e98q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:05 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:05 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 90ca98f1-701e-001e-52d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064105Z-16b659b4499j6g8p9q09hdsh1000000008q000000000gpqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:05 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:06 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:06 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: d34f4ef6-701e-0053-0cd8-1e3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064106Z-16b659b4499z4tq4vyreufa8gn00000005xg00000000an4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:06 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:06 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:06 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 10950230-501e-007b-4cd8-1e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064106Z-16b659b44994c5rr2b3ze9shcc00000008pg000000006mfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:06 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:06 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:06 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 52ecbb12-901e-0029-18d8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064106Z-16b659b4499j6gq7pkfa2qzkk400000008f000000000ad58 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:06 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:06 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: fe1c9c5c-601e-00ab-47d8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064106Z-16b659b4499vb6rgub5604hgz000000008800000000014bu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:06 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:07 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: d34f4f33-701e-0053-48d8-1e3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064107Z-15b8d89586fvk4kme36hucfwyc00000002b0000000001htm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:07 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:07 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:07 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d34f521c-701e-0053-12d8-1e3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064107Z-16b659b4499rgn6gzhcff90q8g00000009d0000000006t14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:07 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:07 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:07 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 279cc631-801e-00a3-30d8-1e7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064107Z-15b8d89586f4zwgbz365q03b0c000000036g000000006v8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:07 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:07 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:07 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 20e60820-a01e-000d-5fd8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064107Z-16b659b4499f5gh931bbxe97rs000000085g00000000fh5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:07 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:07 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:07 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: c529dd24-301e-001f-72d8-1eaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064107Z-15b8d89586fzhrwg5nzgg1z60000000003900000000016sx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:07 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49829	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:07 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-17 06:41:07 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-17 06:41:07 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 17 Oct 2024 06:40:07 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BL2 x-ms-request-id: 951ce70f-5db2-49e6-bdb4-0eac524fcdfc PPServer: PPV: 30 H: BL02EPF0001D96E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:41:07 GMT Connection: close Content-Length: 11412
2024-10-17 06:41:07 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:07 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:08 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 37388c9a-b01e-0053-59d8-1ecdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064108Z-r197bdfb6b49k6rshrw4zhxpu000000009m0000000001wc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:08 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:07 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:08 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: e4802b25-101e-0017-06d8-1e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064108Z-r197bdfb6b4kq4j58bsux2hzu000000005v0000000002aym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:08 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:08 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:08 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: aa24ed06-601e-0002-21d8-1ea786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064108Z-15b8d89586f57l94wp7c4y4r2w00000003a0000000003srq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:08 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:08 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:08 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: f00277d0-001e-0079-80d8-1e12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064108Z-r197bdfb6b4qz2jg69037h393n00000002zg000000006x6z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:08 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:08 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 68eacd2a-f01e-005d-61d9-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064108Z-r197bdfb6b46dlbhxh69g4rk5g00000009f0000000006wva x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:08 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 68e3779b-f01e-005d-74d8-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064108Z-16b659b44998rw28css0tq67fn0000000ap000000000kge2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:09 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:08 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: bf620502-f01e-0052-01d8-1e9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064108Z-r197bdfb6b49k6rshrw4zhxpu000000009dg00000000dx4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:08 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 9658ea3f-301e-0099-7cd8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064108Z-16b659b4499vb6rgub5604hgz0000000087g0000000021sb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:08 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 52ed194d-901e-0029-34d8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064108Z-16b659b4499stprh7pcpsc0x3n0000000a9g00000000nph9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:09 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:09 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: dd489f40-801e-0035-5bd8-1e752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064109Z-16b659b44992vd4bkk50pmnxt00000000b6g00000000fegn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49840	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:09 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-17 06:41:09 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-17 06:41:10 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 17 Oct 2024 06:40:09 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BAY x-ms-request-id: 6af120aa-9158-4fba-b04e-51dea800c0a2 PPServer: PPV: 30 H: PH1PEPF00011E8D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:41:09 GMT Connection: close Content-Length: 11412
2024-10-17 06:41:10 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:09 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:09 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 783e300b-401e-00ac-05d8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064109Z-16b659b4499f5gh931bbxe97rs000000085g00000000fh7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:09 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:09 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1edf1d90-301e-000c-38d8-1e323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064109Z-15b8d89586fsx9lfqmgrbzpgmg000000035000000000db0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:09 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:09 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 90caf802-701e-001e-1cd8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064109Z-16b659b4499v5jm96nrcwszga000000007zg00000000gmcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:09 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:09 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:09 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 746b139f-101e-00a2-24d8-1e9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064109Z-16b659b4499bnwsctrq8dt6ghw00000007xg00000000ann0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:09 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:10 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: caad3713-c01e-0034-63d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064110Z-16b659b44994c5rr2b3ze9shcc00000008q0000000005p7n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:10 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:10 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 98ba4995-901e-00a0-7ad8-1e6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064110Z-r197bdfb6b4qz2jg69037h393n00000002yg000000008qf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:10 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:10 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: e635f68c-501e-0029-54d8-1ed0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064110Z-r197bdfb6b4kdv8k52pqueg71800000009mg000000008848 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:10 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:10 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: edd4371e-d01e-0028-3cd8-1e7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064110Z-r197bdfb6b49k6rshrw4zhxpu000000009cg00000000fzyq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:10 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:10 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:10 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0c0228f0-601e-0084-03d8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064110Z-16b659b4499gfl4fdbx49yxptw0000000b2000000000gwpm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:10 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:11 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:11 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 8d8985e4-f01e-0085-0bd8-1e88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064111Z-16b659b44994gzgd4bz42hx7vg00000008g000000000f65h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:11 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49850	40.126.31.73	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:11 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-10-17 06:41:11 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-17 06:41:11 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 17 Oct 2024 06:40:11 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BL2 x-ms-request-id: 201b21a4-4d62-4cd1-86ae-3a1da0d01adb PPServer: PPV: 30 H: BL02EPF0001D893 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 17 Oct 2024 06:41:11 GMT Connection: close Content-Length: 10197
2024-10-17 06:41:11 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:11 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:11 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9d49eb5a-b01e-0001-477b-1f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064111Z-r197bdfb6b4h2vct0gzb37213s000000097g00000000350x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:11 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:11 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 2ef97557-601e-0070-42d8-1ea0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064111Z-16b659b4499mcktpfn1m4deuag00000007a000000000ee6s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:11 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:11 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: dd485b55-801e-0035-4fd8-1e752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064111Z-16b659b44994sjcfes83c39y40000000071g00000000d5ec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:11 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:11 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:11 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 15a03fc6-e01e-0051-19ce-1f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064111Z-r197bdfb6b4vlqfn9hfre6k1s800000001cg000000003qgz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:11 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:11 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:11 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4d3d3003-601e-0070-6292-1fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064111Z-15b8d89586f8l5967udr7u2zg400000001r0000000007uz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:11 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:12 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: d4bc84b0-b01e-0097-04d8-1e4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064112Z-15b8d89586f8nxpt6pvtkfw3pg0000000370000000000azx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:12 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 2ef97735-601e-0070-7dd8-1ea0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064112Z-15b8d89586fzhrwg5nzgg1z6000000000360000000006eq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:12 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:12 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 6747bc6b-c01e-0066-50d8-1ea1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064112Z-r197bdfb6b4tq6ld2w31u8wmcc00000009f000000000k0fb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:12 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:12 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:12 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 43a1e15a-101e-008e-2ed8-1ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064112Z-r197bdfb6b4rt57kw3q0f43mqg00000000zg000000009wsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:12 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:12 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:12 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 338a0e48-c01e-00a2-02d8-1e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064112Z-15b8d89586f8nxpt6pvtkfw3pg000000030000000000g0re x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:12 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:13 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:13 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 9004b710-501e-005b-4cd8-1ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064113Z-r197bdfb6b4rt57kw3q0f43mqg00000000xg00000000g2h8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:13 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:13 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:13 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:13 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: caad41a3-c01e-0034-68d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064113Z-16b659b4499mcktpfn1m4deuag000000079000000000h8es x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:13 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:13 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:13 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 9909a593-401e-0029-54d8-1e9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064113Z-15b8d89586fst84k5f3z220tec000000034g00000000asth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:13 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:13 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:13 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 619e0788-b01e-005c-44d8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064113Z-15b8d89586fbt6nfd56ex08ru4000000036000000000bck3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:13 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:13 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:13 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:13 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fe1cb938-601e-00ab-39d8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064113Z-16b659b4499mcktpfn1m4deuag00000007fg000000001thk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:13 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:14 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:14 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:14 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: a14e0622-f01e-003f-07d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064114Z-16b659b4499sg56vuc9t9dmdq40000000b9000000000h7y3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:14 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:14 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:14 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:14 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: f8617515-201e-0071-0ed8-1eff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064114Z-15b8d89586ff5l62quxsfe8ugg000000032g000000009aen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:14 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:14 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:14 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:14 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 619f2964-b01e-005c-1cd8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064114Z-15b8d89586fsx9lfqmgrbzpgmg00000003b00000000025m8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:14 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:14 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:14 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:14 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 746ae867-101e-00a2-15d8-1e9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064114Z-16b659b4499xhcppz4ucy307n40000000770000000007skv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:14 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:14 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:14 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:14 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: a14e0af2-f01e-003f-22d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064114Z-16b659b4499mcktpfn1m4deuag00000007a000000000eeee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:14 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:14 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:15 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:15 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 0446b29f-401e-0048-48fe-1f0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064115Z-15b8d89586fst84k5f3z220tec000000034000000000bfx7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:15 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:15 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:15 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:15 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: caad473b-c01e-0034-52d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064115Z-16b659b4499bnwsctrq8dt6ghw00000007w000000000g3n7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:15 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:15 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:15 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:15 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 057c9cd8-201e-0096-5dd8-1eace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064115Z-15b8d89586f57l94wp7c4y4r2w00000003b0000000001ur3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:15 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:15 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:15 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:15 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 52eece22-901e-0029-4cd8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064115Z-16b659b4499wvth4ttszf0h3n400000006z000000000b1x9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:15 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:15 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:15 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:15 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 630882ef-001e-0049-7ebc-1f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064115Z-r197bdfb6b49q495mwvq3xv6v000000009gg0000000080m2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:15 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:15 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:16 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:15 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 3d354aa7-b01e-0001-62d8-1e46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064115Z-16b659b4499w2mwkzdhtwtt78c00000009xg00000000fcf3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:16 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:15 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:16 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:15 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 338a1818-c01e-00a2-36d8-1e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064115Z-16b659b4499v5jm96nrcwszga00000000850000000002fnw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:16 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:16 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:16 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:16 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 20e62c17-a01e-000d-57d8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064116Z-16b659b449999m8hsuhyf00exs00000009fg000000000q88 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:16 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:16 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:16 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:16 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: f8617a56-201e-0071-7ad8-1eff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064116Z-15b8d89586f6nn8zwfkdy3t04s00000002xg00000000gbq6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:16 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:16 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:16 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:16 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: db3d69cc-a01e-0070-02d8-1e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064116Z-r197bdfb6b49hhzxb6arg8z9fw00000001b0000000006h79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:16 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:16 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:16 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:16 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 7ef1cc09-e01e-0051-19d8-1e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064116Z-16b659b44994gzgd4bz42hx7vg00000008q00000000018qh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:16 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:16 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:16 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 31a5708d-d01e-007a-0dd8-1ef38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064116Z-r197bdfb6b4gdlhqvqfas3qb54000000097000000000at2r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:16 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:17 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:17 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: dd0072de-501e-0064-4cd8-1e1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064117Z-r197bdfb6b49k6rshrw4zhxpu000000009g0000000007w2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:17 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:17 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:17 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: ae2fb09b-d01e-007a-377f-1ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064117Z-r197bdfb6b429k2srg5tfm6hnn00000000rg000000003qm2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:17 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:17 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 37bf9419-001e-0049-58d8-1e5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064117Z-16b659b44998rw28css0tq67fn0000000as000000000a449 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:17 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:17 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 2b07ac6c-201e-003c-64d8-1e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064117Z-16b659b4499j4zt514u3dvn84n0000000akg000000002tk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:17 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:17 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:17 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:17 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 75addd74-001e-0065-0e92-1f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064117Z-15b8d89586f57l94wp7c4y4r2w000000038g000000006m23 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:17 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:17 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:17 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 07cb3381-d01e-002b-61d8-1e25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064117Z-r197bdfb6b4sn8wg20e97vn7ps00000009e000000000ekpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:18 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:17 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:17 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 619dcaab-b01e-005c-28d8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064117Z-15b8d89586f8nxpt6pvtkfw3pg000000035g000000003r04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:18 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:18 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:18 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:18 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: e1d8db9a-401e-0048-7bd8-1e0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064118Z-16b659b4499rzdzwehs0w9w5d800000008pg00000000myu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:18 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:18 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:18 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:18 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2a29193b-001e-0065-3fd8-1e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064118Z-16b659b4499lfw4zscvav76bhn00000007vg00000000721a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:18 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:18 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:18 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: b1f1651c-201e-0085-16d8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064118Z-16b659b4499vb6rgub5604hgz0000000087g00000000227z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:18 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:18 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:18 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 4f3c0613-901e-0083-7ed8-1ebb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064118Z-16b659b4499t9g2t855zkdgzd000000009r000000000h9kw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:18 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:18 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: f36390f8-001e-00a2-0e96-1fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064118Z-15b8d89586f42m67uh3prmsdrs00000003ag000000003bb9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:18 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: a235b62e-001e-0082-0cd8-1e5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064119Z-16b659b4499lfw4zscvav76bhn00000007y0000000001xed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:19 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 90cac500-701e-001e-74d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064119Z-15b8d89586flspj6f2320qac94000000036g000000006nr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:19 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:19 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: a14f1cd6-f01e-003f-2ad8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064119Z-16b659b4499rgn6gzhcff90q8g000000099000000000h1m9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:19 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:19 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 783e4b83-401e-00ac-1cd8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064119Z-15b8d89586fmhkw4gksnr1w3ds0000000370000000004psy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:19 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: d6ae7f49-501e-008c-58d8-1ecd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064119Z-15b8d89586f8nxpt6pvtkfw3pg0000000330000000007ywd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:20 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 8f2f9f45-501e-008f-59d8-1e9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064120Z-16b659b4499xhcppz4ucy307n4000000077g000000007233 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:20 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:20 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 0f1be019-201e-0096-3b92-1face6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064120Z-15b8d89586f8l5967udr7u2zg400000001qg000000007t9g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:20 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 90cac76b-701e-001e-3bd8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064120Z-15b8d89586ff5l62quxsfe8ugg000000031g00000000apxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:20 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 7ef379bb-e01e-0051-73d8-1e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064120Z-r197bdfb6b4k6h5j1g5mvtmsmn000000013g00000000fpdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:20 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 2ef9462c-601e-0070-27d8-1ea0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064120Z-16b659b4499tswxxb16erk3cdn00000009x00000000096ng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:21 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:21 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 9657b123-301e-0099-06d8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064121Z-16b659b44998rw28css0tq67fn0000000awg00000000052z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:21 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:21 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 8dc46b47-c01e-008d-2792-1f2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064121Z-15b8d89586flzzksd4nk2msxr400000002mg0000000039x6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:21 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:21 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:21 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 90cacb5b-701e-001e-72d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064121Z-15b8d89586fxdh48yvzh6as6u4000000031000000000d2e8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:21 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:21 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:21 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:21 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6c58199a-d01e-0017-35d8-1eb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064121Z-16b659b4499v5jm96nrcwszga00000000820000000009gcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:21 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:21 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:21 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 10952a79-501e-007b-7ed8-1e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064121Z-16b659b4499qzkzdaxyf40k2c000000008ag00000000a83k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:21 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:21 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:21 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 0c00f04d-601e-0084-4dd8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064121Z-15b8d89586fzhrwg5nzgg1z6000000000350000000008zz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:22 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:22 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:22 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:22 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 38994204-401e-0015-7c63-1f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064122Z-15b8d89586fxdh48yvzh6as6u4000000031000000000d2f8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:22 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:22 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:22 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:22 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: caad5b66-c01e-0034-07d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064122Z-16b659b4499r9jvzdsrvx9g86w00000007vg000000001uwr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:22 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:22 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:22 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:22 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 8f2fa5bd-501e-008f-01d8-1e9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064122Z-16b659b449999m8hsuhyf00exs00000009ag00000000bkvt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:22 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:22 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:22 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: a6b4f5d3-c01e-0014-56d8-1ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064122Z-r197bdfb6b4kzncfk35mqx2yu400000009d0000000007zfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:22 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:22 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:22 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a7e9f920-901e-005b-7bd8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064122Z-16b659b4499hn29ks1ddp5hvac0000000aqg000000009h8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:22 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49921	34.251.245.69	443	7400	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:23 UTC	1045	OUT	GET /XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=?cid=284390382 HTTP/1.1 Host: https.www.secure.kb4.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-17 06:41:23 UTC	574	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 546 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade ETag: W/"fc1bc9e030466a2444572b5c8263834b" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: f1ae9915-3576-498d-bd55-7f13b67b4dff X-Runtime: 0.085584 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-17 06:41:23 UTC	546	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 2e 65 6e 63 72 79 70 74 65 64 63 6f 6e 6e 65 63 74 69 6f 6e 2e 6e 65 74 2f 70 61 67 65 73 2f 63 62 36 64 31 34 66 34 32 37 65 37 63 32 30 35 37 30 39 34 37 34 65 35 35 37 37 34 62 65 33 30 2f 58 54 7a 4e 75 52 54 6b 72 5a 46 4a 4a 4d 53 39 45 54 57 56 54 59 69 74 56 52 6a 67 30 62 6b 5a 57 57 6c 6f 34 56 33 56 32 64 55 5a 70 65 6d 6c 78 57 56 49 72 63 58 67 78 4d 6c 4a 52 54 6d 6c 58 63 45 31 43 4e 54 5a 42 4f 47 70 4d 53 33 41 79 65 58 42 51 55 6b 46 32 61 47 4e 4f 64 55 56 50 4e 47 49 34 65 48 4e 50 4d 48 5a 72 52 48 64 45 54 6b 35 74 62 55 64 6d 4e 44 Data Ascii: <html> <head> <script>window.location.href = 'https://secure.encryptedconnection.net/pages/cb6d14f427e7c205709474e55774be30/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmND

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:23 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:23 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 9afff02c-d01e-00ad-4ad9-1ee942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064123Z-16b659b4499r9jvzdsrvx9g86w00000007sg000000008dwt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:23 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:23 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:23 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:23 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 838d9442-801e-0047-1a63-1f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064123Z-15b8d89586fst84k5f3z220tec000000036g000000006057 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:23 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:23 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:23 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:23 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 36b15b9b-c01e-0082-6ad8-1eaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064123Z-16b659b4499sg56vuc9t9dmdq40000000bfg00000000130w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 06:41:23 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:23 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:23 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 1bf97a49-901e-007b-42d8-1eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064123Z-r197bdfb6b49q495mwvq3xv6v000000009dg00000000dpty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:23 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:23 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:23 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: afc1423d-101e-0034-03d8-1e96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064123Z-16b659b4499sg56vuc9t9dmdq40000000b8g00000000k6w5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:23 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 06:41:24 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 06:41:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 06:41:24 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: a02d454d-501e-00a0-57d8-1e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T064124Z-15b8d89586fvk4kme36hucfwyc00000002bg000000000qf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 06:41:24 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Target ID:	0
Start time:	02:40:44
Start date:	17/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x630000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:41:17
Start date:	17/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:41:18
Start date:	17/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2084,i,2615446868929396096,10562732040043706015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:41:20
Start date:	17/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://https.www.secure.kb4.io/XTzNuRTkrZFJJMS9ETWVTYitVRjg0bkZWWlo4V3V2dUZpemlxWVIrcXgxMlJRTmlXcE1CNTZBOGpMS3AyeXBQUkF2aGNOdUVPNGI4eHNPMHZrRHdETk5tbUdmNDJDdWhrR3VleXpCSmNpNG5XeWREdnZVbmdaVVhwNklHd2twV3RCWGg5WVNSYXB4b2hqT251NGFQS3BzWHNlRktESHYxbXQ1Nk41ZFZ0em55dE9PaDNJQ1g0ZVRvcnBKekc5YzFlWFQwVjVqdWdJWllQejVJbHlOc3lSVi9ReEQvTDVvUE1pZz09LS1zK0pIb3M3WmpTcjZ3MmZXLS1rc2pCc01hbE0wbHQ2WDlMbUdwcWhBPT0=?cid=284390382"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Account report.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\72F50284.jpeg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{470FD81D-4272-462C-8AEB-8B260DF79631}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{5B23A64C-4CB0-4A06-99F3-6629C3883CF3}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F6F2FFCA-8895-4694-BD53-609A6B7CCFDE}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1729147245624804700_BBC3DA36-6ABA-4EB0-8476-24F5493B6EF9.log

C:\Users\user\AppData\Local\Temp\TCD8519.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD8519.tmp\harvardanglia2008officeonline.xsl

C:\Users\user\AppData\Local\Temp\TCD852B.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD852B.tmp\chevronaccent.glox

C:\Users\user\AppData\Local\Temp\TCD853C.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD853C.tmp\sist02.xsl

C:\Users\user\AppData\Local\Temp\TCD8570.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD8570.tmp\chicago.xsl

C:\Users\user\AppData\Local\Temp\TCD8571.tmp\CircleProcess.glox

C:\Users\user\AppData\Local\Temp\TCD8571.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD8572.tmp\Content.inf

Windows Analysis Report
Account report.docx